Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

fix: generic support special character #1371

Open
wants to merge 24 commits into
base: master
Choose a base branch
from

Commits on Mar 13, 2024

  1. add @ to the generic token

    Baruch Odem committed Mar 13, 2024
    Configuration menu
    Copy the full SHA
    1f3cbbc View commit details
    Browse the repository at this point in the history
  2. add more special characters

    Baruch Odem committed Mar 13, 2024
    Configuration menu
    Copy the full SHA
    46ac992 View commit details
    Browse the repository at this point in the history
  3. add '!'

    Baruch Odem committed Mar 13, 2024
    Configuration menu
    Copy the full SHA
    fa549fc View commit details
    Browse the repository at this point in the history

Commits on Mar 14, 2024

  1. you know what, include any non-space char

    Baruch Odem committed Mar 14, 2024
    Configuration menu
    Copy the full SHA
    e528deb View commit details
    Browse the repository at this point in the history
  2. fp

    Baruch Odem committed Mar 14, 2024
    Configuration menu
    Copy the full SHA
    c8d4720 View commit details
    Browse the repository at this point in the history

Commits on Mar 28, 2024

  1. Remove funding and release workflows

    Baruch Odem committed Mar 28, 2024
    Configuration menu
    Copy the full SHA
    51a8409 View commit details
    Browse the repository at this point in the history
  2. trigger

    Baruch Odem committed Mar 28, 2024
    Configuration menu
    Copy the full SHA
    70f6bf3 View commit details
    Browse the repository at this point in the history
  3. dont test on push

    Baruch Odem committed Mar 28, 2024
    Configuration menu
    Copy the full SHA
    f604e9a View commit details
    Browse the repository at this point in the history
  4. Merge branch 'master' of github.com:Checkmarx/gitleaks

    Baruch Odem committed Mar 28, 2024
    Configuration menu
    Copy the full SHA
    4f6df59 View commit details
    Browse the repository at this point in the history
  5. gitleaks require a token for running from organization

    Baruch Odem committed Mar 28, 2024
    Configuration menu
    Copy the full SHA
    304b4a8 View commit details
    Browse the repository at this point in the history
  6. Configuration menu
    Copy the full SHA
    94ebd30 View commit details
    Browse the repository at this point in the history
  7. feat: catch secret in XML child (#1)

    ### Description:
    - Added generic API key inside an XML element:
    `<password>edf8f16608465858a6c9e3cccb97d3c2</password>`
    - Added True-Positives and False-Positives to the Generic API Key rule
    
    ### Checklist:
    
    * [x] Does your PR pass tests?
    * [x] Have you written new tests for your changes?
    * [x] Have you lint your code locally prior to submission?
    
    Original: gitleaks#1265
    baruchiro committed Mar 28, 2024
    Configuration menu
    Copy the full SHA
    93df1a4 View commit details
    Browse the repository at this point in the history
  8. chore: refactor regex for redundant pipe (#2)

    ### Description:
    > since this part is enclosed in `[]`, the pipes aren't necessary.
    
    _Originally posted by @rgmz in
    gitleaks#1265 (comment)
    
    ### Checklist:
    
    * [x] Does your PR pass tests?
    * [x] Have you written new tests for your changes?
    * [x] Have you lint your code locally prior to submission?
    
    Original: gitleaks#1266
    baruchiro committed Mar 28, 2024
    Configuration menu
    Copy the full SHA
    170b7c8 View commit details
    Browse the repository at this point in the history
  9. feat: catch JSON stringified (#3)

    ### Description:
    I have a code sample when someone writting a hard-coded JSON as string,
    and it looks like this:
    ```java
    var json = "{ \"access-key\": \"access key here\" }"
    ```
    
    ### Checklist:
    
    * [x] Does your PR pass tests?
    * [x] Have you written new tests for your changes?
    * [x] Have you lint your code locally prior to submission?
    
    Original: gitleaks#1267
    baruchiro committed Mar 28, 2024
    Configuration menu
    Copy the full SHA
    5a9153a View commit details
    Browse the repository at this point in the history
  10. fix: secrets found with quotas (#4)

    I found some rules that returns the value ended with `"`. This happened
    because missing `secretGroup` value.
    
    It is an _hot fix_.
    
    For the future, I think we need:
    1. Refactor the `validate` function or create another suite of tests
    with declaration of the expected found secret.
    1. Fix the suffix regex to not include the `"`, because even with my
    change, it only fixes the `Secret` but not the `Match`
    
    Original: gitleaks#1350
    baruchiro committed Mar 28, 2024
    Configuration menu
    Copy the full SHA
    4a80c88 View commit details
    Browse the repository at this point in the history
  11. tests: scalingo validation consistent test (#7)

    ### Description:
    Sometimes the tp of Scalingo is failing during the Github Actions
    workflow and after re-triggering it passed. I think the problem was when
    the generated example secret was ended with `-`, and combined with the
    `Regex` that expect for a word boundary `\b`, it was failed.
    
    I think in any way it is better to use the common
    `generateUniqueTokenRegex` instead of wrapping the regex with `\b`.
    
    ### Checklist:
    
    * [x] Does your PR pass tests?
    * [x] Have you written new tests for your changes?
    * [x] Have you lint your code locally prior to submission?
    
    Original: gitleaks#1359
    baruchiro committed Mar 28, 2024
    Configuration menu
    Copy the full SHA
    ca72e87 View commit details
    Browse the repository at this point in the history
  12. feat: add aws-secret-key rule (#5)

    ### Description:
    I fixes few issues (gitleaks#1049, gitleaks#1324, gitleaks#1337) and added a rule for AWS Secret
    Key.
    
    I renamed the `AWS()` function name to `AWSAccessKey()`, and changed the
    `RuleID` too, which may lead to breaking changes ⚠️.
    
    ### Checklist:
    
    * [x] Does your PR pass tests?
    * [x] Have you written new tests for your changes?
    * [x] Have you lint your code locally prior to submission?
    
    Original: gitleaks#1356
    baruchiro committed Mar 28, 2024
    Configuration menu
    Copy the full SHA
    bfa12e0 View commit details
    Browse the repository at this point in the history
  13. Configuration menu
    Copy the full SHA
    d5664d6 View commit details
    Browse the repository at this point in the history
  14. feat: Add PuttyPrivateKey rule and allowlist for raw content (#9)

    ### Description:
    [PuTTY](https://www.putty.org/) is a common SSH and telnet client for
    Windows. It installed with a "PuTTY Key Generator, which is generating a
    regular private/public keys, but saves them in a different format.
    
    To support this, I added support for apply the `AllowList.Regexes` on
    the `fragment.Raw` content.
    
    I also added a `validateFragment` to validate a rule that accept the
    `Path` field.
    
    ### Checklist:
    
    * [x] Does your PR pass tests?
    * [x] Have you written new tests for your changes?
    * [x] Have you lint your code locally prior to submission?
    
    Original: gitleaks#1373
    baruchiro committed Mar 28, 2024
    Configuration menu
    Copy the full SHA
    33e0634 View commit details
    Browse the repository at this point in the history
  15. add real (test) standard and restricted keys (#11)

    ### Description:
    I just generated keys from Stripe and adjusted the rule.
    
    ### Checklist:
    
    * [x] Does your PR pass tests?
    * [x] Have you written new tests for your changes?
    * [x] Have you lint your code locally prior to submission?
    
    Original: gitleaks#1375
    baruchiro committed Mar 28, 2024
    Configuration menu
    Copy the full SHA
    b30d2e6 View commit details
    Browse the repository at this point in the history
  16. feat: Add Cloudflare API and Origin CA keys (#10)

    ### Description:
    Added rules for real (revoked) cloudflare secrets
    
    ### Checklist:
    
    * [x] Does your PR pass tests?
    * [x] Have you written new tests for your changes?
    * [x] Have you lint your code locally prior to submission?
    
    Original: gitleaks#1374
    baruchiro committed Mar 28, 2024
    Configuration menu
    Copy the full SHA
    b4c1a00 View commit details
    Browse the repository at this point in the history
  17. fix: reduce false positives by hashicorp (#6)

    ### Description:
    To add this rule I took examples from the official Hashicorp
    documentation, but now I used this rule and it find too generic cases
    such as `const TagPassword = "password"`.
    
    Using the `Entropy` field is a balance between true/false positives,
    since with `3.5` it will ignore almost all passwords less then 10
    characters length.
    
    ### Checklist:
    
    * [x] Does your PR pass tests?
    * [x] Have you written new tests for your changes?
    * [x] Have you lint your code locally prior to submission?
    
    Original: gitleaks#1358
    baruchiro committed Mar 28, 2024
    Configuration menu
    Copy the full SHA
    aea43c0 View commit details
    Browse the repository at this point in the history
  18. Configuration menu
    Copy the full SHA
    aaa90c3 View commit details
    Browse the repository at this point in the history
  19. Update generic API key regex pattern

    Baruch Odem committed Mar 28, 2024
    Configuration menu
    Copy the full SHA
    04f605d View commit details
    Browse the repository at this point in the history