Hardcoded PHP passwords not found

[ghost]

I did some tests and a number of passwords (e.g. in an array or constant) were not found in a php file:

Array example:

     array (
                                        'host' => self::processHost('database05'),
                                        'database' => 'test',
                                        'user' => 'test',
                                        'password' => 'tzlzhzgpazlvaffudrnkbhlkyawtgzc',
                                ),

Constants:

   const   DB_TEST_PWD = 'jex0`&?c950?\7$ya5',
               DB_PWD = 'plqudzxtlhchccoqfirgmqqzxpyyoik';

I've used the following command: detect-secrets scan > .secrets.baseline

[domanchi]

@BlueCanary-DM , what version of detect-secrets are you running? Have you tried using detect-secrets scan --string to see what the individual plugins report?

[ghost]

I'm running version 0.13.1 as I had the issue described here:
Yelp/detect-secrets-server#62

However, using the docker container provided here, which uses the latest version I have the same results.

[adityak80]

I am facing the same problem with PHP files, the following code is not caught by any of the plugins:

define('DB_GLOBAL_MASTER',
    array(
        'database' => 'GLOBAL_MASTER',
        'host' => 'xxx.xx.203.94',
        'port' => '1433',
        'username' => 'xxxxweb-xxadmin',
        'password' => '***@9mIn',
    )
);

Even 'password' is not flagged by KeywordDetector unless one removes the single quotes around the word password.

[jpdakran]

After doing some investigation on this issue. The issue with the array declaration is valid. The => operator is not picked up by the keyword detect. I have added 567 to fix this issue.

With respect to the const secrets noted above. The first secret (DB_TEST_PWD) is detected. The second secret (DB_PWD) indeed is not detected. However this is because it is filtered out by the detect_secrets.filters.gibberish.should_exclude_secret

This investigation was performed on detect-secrets v1.2.0