Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Fix False Positives: Use Word Boundaries for EasyPost Tokens #1116

Merged

Conversation

wolframhaussig
Copy link
Contributor

@wolframhaussig wolframhaussig commented Mar 13, 2023

Use Word Boundaries for EasyPost Tokens

Description:

I am storing Elastic Kibana Exports in a GIT repo which look like:

{
     "asset-a30a06eb-2276-44b1-a62d-856e2116138c": {
          "@created": "2019-03-29T14:02:51.349Z",
          "id": "asset-a30a06eb-2276-44b1-a62d-856e2116138c",
          "type": "dataurl",
          "value": "data:image/jpeg;base64,/9j/4AAQSkZJRgABAQEASABIAAD/4gxYSU..aEZAKjP3cFfmXvke1VN43DcuR1BJyTjPNZx0AfLLuRmCAKrAAkcEf0qgqbJ..."
     }
}

The Base64 encoded images cause a false positive as GitLeaks detects an EasyPost API Token starting with EZAK. I added a word boundary to prevent detecting EasyPost tokens in a Base64 string.

Checklist:

  • Does your PR pass tests?
  • Have you written new tests for your changes?
  • Have you lint your code locally prior to submission?

@zricethezav
Copy link
Collaborator

Looks good to me @wolframhaussig, but would you mind following the directions in the contributing guidelines for adding new rules? https://github.com/gitleaks/gitleaks/blob/master/CONTRIBUTING.md

Use Word Boundaries for EasyPost Tokens
@wolframhaussig
Copy link
Contributor Author

@zricethezav Done. Sorry for that - I thought this was just for new rules

@zricethezav
Copy link
Collaborator

Thanks @wolframhaussig and the gitleaks-action is failing because I recently migrated zricethezav/gitleaks to gitleaks/gitleaks, which is an organization that requires a license key. I.e, failure is unrelated to this PR and has been fixed in master

@zricethezav zricethezav merged commit 1fb3a77 into gitleaks:master Mar 14, 2023
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

None yet

2 participants