Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

#404 - Add Arrow Key Assignment Operator Regex to Keyword Plugin #567

Merged
merged 2 commits into from
Jun 23, 2022

Conversation

jpdakran
Copy link
Member

Problem:

  • It was reported that hardcoded PHP passwords were not detected by the keyword plugin
  • This is specific to the array constructor where elements are assigned like the following:
    array( key => value, key2 => value2, key3 => value3, ... )
  • The problem here is the => operator does not have a corresponding regex in the keyword plugin

Solution:

  • Added regex to catch secrets with form of password => "bar"
  • This regex will require the secret keyword denylist followed by the => operator and lastly followed by a string wrapped in quotes
  • This was added to the default grouping of QUOTES_REQUIRED_DENYLIST_REGEX_TO_GROUP which is a grouping of regexes for all file types that do not have specified overrides.

@jpdakran jpdakran linked an issue Jun 21, 2022 that may be closed by this pull request
@jpdakran jpdakran merged commit 8996b7a into master Jun 23, 2022
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

Hardcoded PHP passwords not found
2 participants