Support url-safe base64 secrets

detect_secrets/plugins/common/filters.py

@@ -80,13 +80,34 @@ def is_sequential_string(secret, *args):
     return False
 
 
-ALL_FALSE_POSITIVE_HEURISTICS = (
+# This only finds UUIDs which only have lowercase characters.
+_UUID_REGEX = re.compile(r'[a-f0-9]{8}\-[a-f0-9]{4}\-[a-f0-9]{4}\-[a-f0-9]{4}\-[a-f0-9]{12}')
+
+
+def is_potential_uuid(secret, *args):
+    """
+    Determines if a potential secret contains any UUIDs.
+
+    :type secret: str
+
+    :rtype: bool
+    Returns True if the string has a UUID, false otherwise.
+    """
+
+    # Using a regex to find strings that look like false-positives
+    # will find us more false-positives than if we just tried validate
+    # the input string as a UUID (for example, if the string has a prefix
+    # or suffix).
+    return len(_UUID_REGEX.findall(secret.lower())) > 0
+
+
+DEFAULT_FALSE_POSITIVE_HEURISTICS = [
     is_found_with_aho_corasick,
     is_sequential_string,
-)
+]
 
 
-# NOTE: this doesn't handle key-values on a line properly.
+# NOTE: this doesn't handle multiple key-values on a line properly.
 # NOTE: words that end in "id" will be treated as ids
 _ID_DETECTOR_REGEX = re.compile(r'[iI][dD][^A-Za-z0-9]')
 
@@ -108,12 +129,12 @@ def is_likely_id_string(secret, line):
     return _ID_DETECTOR_REGEX.findall(line, pos=0, endpos=secret_index)
 
 
-ALL_FALSE_POSITIVE_WITH_LINE_CONTEXT_HEURISTICS = [
+DEFAULT_FALSE_POSITIVE_WITH_LINE_CONTEXT_HEURISTICS = [
     is_likely_id_string,
 ]
 
 
-def is_false_positive(secret, automaton, functions=ALL_FALSE_POSITIVE_HEURISTICS):
+def is_false_positive(secret, automaton, functions=DEFAULT_FALSE_POSITIVE_HEURISTICS):
     """
     :type secret: str
 
@@ -135,7 +156,7 @@ def is_false_positive(secret, automaton, functions=ALL_FALSE_POSITIVE_HEURISTICS
 def is_false_positive_with_line_context(
     secret,
     line,
-    functions=ALL_FALSE_POSITIVE_WITH_LINE_CONTEXT_HEURISTICS,
+    functions=DEFAULT_FALSE_POSITIVE_WITH_LINE_CONTEXT_HEURISTICS,
 ):
     """
     :type secret: str

detect_secrets/plugins/high_entropy_strings.py

@@ -20,6 +20,8 @@
 from .common.filetype import FileType
 from .common.filters import is_false_positive
 from .common.filters import is_false_positive_with_line_context
+from .common.filters import is_potential_uuid
+from .common.filters import DEFAULT_FALSE_POSITIVE_HEURISTICS
 from .common.ini_file_parser import IniFileParser
 from .common.yaml_file_parser import YamlFileParser
 from detect_secrets.core.potential_secret import PotentialSecret
@@ -113,7 +115,11 @@ def analyze_string_content(self, string, line_num, filename):
         output = {}
 
         for result in self.secret_generator(string):
-            if is_false_positive(result, self.automaton):
+            # py2+py3 compatible way of copying a list
+            functions = list(DEFAULT_FALSE_POSITIVE_HEURISTICS)
+            functions.append(is_potential_uuid)
+
+            if is_false_positive(result, self.automaton, functions=functions):
                 continue
 
             secret = PotentialSecret(self.secret_type, filename, result, line_num)

test_data/config.yaml

@@ -15,3 +15,5 @@ high_entropy_binary_secret: !!binary MjNjcnh1IDJieXJpdXYyeXJpaTJidnl1MnI4OXkyb3U
 
 # this should be ignored as a potential id
 allowlisted_id: 'ToCynx5Se4e2PtoZxEhW7lUJcOX15c54'
+
+uuid_should_be_ignored: '203db13e-70c7-462b-9a3d-bf32640cb0be'

tests/plugins/common/filters_test.py

@@ -73,3 +73,16 @@ def test_success(self, secret, line):
     )
     def test_failure(self, secret, line):
         assert not filters.is_likely_id_string(secret, line)
+
+
+class TestIsPotentialUuid(object):
+    @pytest.mark.parametrize(
+        'secret',
+        [
+            '3636dd46-ea21-11e9-81b4-2a2ae2dbcce4',  # uuid1
+            '97fb0431-46ac-41df-9ef9-1a18545ce2a0',  # uuid4
+            'prefix-3636dd46-ea21-11e9-81b4-2a2ae2dbcce4-suffix',  # uuid in middle of string
+        ],
+    )
+    def test_success(self, secret):
+        assert filters.is_potential_uuid(secret)