diff --git a/README.md b/README.md index 93eb29e74..e20fa99f1 100644 --- a/README.md +++ b/README.md @@ -182,6 +182,8 @@ See the `git log` [documentation](https://git-scm.com/docs/git-log) for more inf You can scan files and directories by using the `--no-git` option. +If you want to run only specific rules you can do so by using the `--enable-rule` option (with a rule ID as a parameter), this flag can be used multiple times. For example: `--enable-rule=atlassian-api-token` will only apply that rule. You can find a list of rules [here](config/gitleaks.toml). + #### Protect The `protect` command is used to scan uncommitted changes in a git repo. This command should be used on developer machines in accordance with diff --git a/cmd/detect.go b/cmd/detect.go index bcbe0f8e4..8ebe6a8be 100644 --- a/cmd/detect.go +++ b/cmd/detect.go @@ -3,6 +3,7 @@ package cmd import ( "os" "path/filepath" + "strings" "time" "github.com/rs/zerolog/log" @@ -20,6 +21,7 @@ func init() { detectCmd.Flags().Bool("no-git", false, "treat git repo as a regular directory and scan those files, --log-opts has no effect on the scan when --no-git is set") detectCmd.Flags().Bool("pipe", false, "scan input from stdin, ex: `cat some_file | gitleaks detect --pipe`") detectCmd.Flags().Bool("follow-symlinks", false, "scan files that are symlinks to other files") + detectCmd.Flags().StringSlice("enable-rule", []string{}, "only enable specific rules by id, ex: `gitleaks detect --enable-rule=atlassian-api-token --enable-rule=slack-access-token`") detectCmd.Flags().StringP("gitleaks-ignore-path", "i", ".", "path to .gitleaksignore file or folder containing one") } @@ -113,6 +115,21 @@ func runDetect(cmd *cobra.Command, args []string) { } } + // If set, only apply rules that are defined in the flag + rules, _ := cmd.Flags().GetStringSlice("enable-rule") + if len(rules) > 0 { + log.Info().Msg("Overriding enabled rules: " + strings.Join(rules, ", ")) + ruleOverride := make(map[string]config.Rule) + for _, ruleName := range rules { + if rule, ok := cfg.Rules[ruleName]; ok { + ruleOverride[ruleName] = rule + } else { + log.Fatal().Msgf("Requested rule %s not found in rules", ruleName) + } + } + detector.Config.Rules = ruleOverride + } + // set follow symlinks flag if detector.FollowSymlinks, err = cmd.Flags().GetBool("follow-symlinks"); err != nil { log.Fatal().Err(err).Msg("")