Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Fix JWT pattern #179

Closed
wants to merge 8 commits into from
Closed

Fix JWT pattern #179

wants to merge 8 commits into from

Conversation

babenek
Copy link
Contributor

@babenek babenek commented Aug 8, 2022

meanrin
meanrin requested changes Aug 9, 2022
View reviewed changes
Copy link
Contributor

@meanrin meanrin left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This change referring to the #178 issue, but note that it is not a JWT issue on itself
Same issue can happen with all short patterns
So it would be more correct to apply fix to all pattern based regular expressions

credsweeper/rules/config.yaml Outdated
@@ -162,7 +162,7 @@
severity: medium
type: pattern
values:
- (?P<value>eyJ[A-Za-z0-9-_=]+(\.[A-Za-z0-9-_.+\/=]+)?)
- (?<![0-9a-zA-Z_-])(?P<value>eyJ[A-Za-z0-9-_=]+\.eyJ[A-Za-z0-9-_=]+(\.[A-Za-z0-9-_=]+)?)
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

JWT with a single eyJ entry might still be a valid credential

#104

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

?<![0-9a-zA-Z_-]) probably should not be in JWT regular expression itself
We can concatenate it to ALL pattern based expressions, so it would fix all other short expressions

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

'''(?<![0-9a-zA-Z_-])''' removes case when eyJ is only a substring in long base64 case. even (?<![0-9a-zA-Z]) might reduce suspicious strings.

babenek
babenek commented Aug 9, 2022
View reviewed changes
credsweeper/rules/config.yaml Outdated Show resolved Hide resolved
@babenek babenek self-assigned this Aug 9, 2022
@babenek babenek closed this Aug 31, 2022
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@meanrin meanrin meanrin requested changes

Assignees

@babenek babenek

Labels
None yet
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.

False positive for short regular expressions
2 participants
@babenek @meanrin