Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

IBM COS HMAC Detector False Positives? #288

Closed
domanchi opened this issue Mar 26, 2020 · 1 comment · Fixed by #289
Closed

IBM COS HMAC Detector False Positives? #288

domanchi opened this issue Mar 26, 2020 · 1 comment · Fixed by #289
Labels
false positives question The issue is a technical question related to the project.

Comments

@domanchi
Copy link
Contributor

When testing these new plugins, I noticed this plugin was capturing more than what I'd expect it to capture.

Reproduction Steps

$ cat aws_credentials.json
{
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "secretAccessKey": "81442db33ceee1092586feb635d7b3c5d72257c775ee323414bac8e673d41af3"
}
$ detect-secrets scan aws_credentials.json > baseline
$ detect-secrets audit baseline

It looks like the regex is capturing 81442db33ceee1092586feb635d7b3c5d72257c775ee3234, rather than the full string.

Proposed Fix

@killuazhu : Does this password regex need to be $ terminated?

@domanchi domanchi added question The issue is a technical question related to the project. accuracy false positives labels Mar 26, 2020
@killuazhu
Copy link
Contributor

@domanchi That would be a good idea. Would put up a fix for this.

killuazhu pushed a commit to IBM/detect-secrets that referenced this issue May 28, 2020
killuazhu pushed a commit to IBM/detect-secrets that referenced this issue Jul 9, 2020
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
false positives question The issue is a technical question related to the project.
Projects
None yet
Development

Successfully merging a pull request may close this issue.

2 participants