[question] How to skip password detection in Java Properties File ?

[sylvainmouquet]

Hello,

We have tried to allow a secret in a property file but java read the full string "xyz # pragram: allowlist secrets"

password=xyz # pragma: allowlist secret

How to manage it ?

Thanks
Sylvain

[OiCMudkips]

If you are using pre-commit you can use the exclude option to exclude Java properties files. If you are using this tool directly, you can use the --exclude-files flag.

Let us know if this works for you.

[prashpb]

The same issue we are facing.
we cannot add exclude files as user may commit actual passwords and the scan will not detect it.
Any solution on how to add whitelist to .properties file will be helpful.

[domanchi]

From https://en.wikipedia.org/wiki/.properties, it looks like the issue with this is that the Java .properties doesn't allow inline comments. This mirrors other config-file like files. For example:

>>> import configparser
>>> parser = configparser.ConfigParser()
>>> parser.read_string("""\
...    [section]
...    password = xyz    # pragma: allowlist secret
... """)

>>> print(parser.items('section')[0])
('password', 'xyz  # pragma: allowlist secret')

The only way we can address this is by adding some form of "skip next line" pragma, like eslint-disable-next-line. Let me see whether I can address this in our new filters system in v1.

[nickiaconis]

Fwiw I just encountered this same issue in a Dockerfile today. It will be very helpful to have a "skip next line" pragma. Anything I can do to help move this along?

[domanchi]

@nickiaconis : if you wanted to help, you can certainly contribute a PR that bases atop the current pre-v1-adding-verification branch -- this will give you access to the dependency injected context variable (more information here: https://github.com/Yelp/detect-secrets/blob/pre-v1-launch/docs/filters.md#a-word-about-filter-internals

I'd imagine that with this context object, you can create a new filter that checks the line before to see if the flagged secret has been ignored.