Skip to content
This repository has been archived by the owner on Jun 21, 2022. It is now read-only.

fix(secrets): skip aws secrets of greater length #514

Merged
merged 4 commits into from
May 12, 2022
Merged

fix(secrets): skip aws secrets of greater length #514

Changes from 2 commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
0edc9b9
fix(secrets): changed aws-secret-access-key regex
DmitriyLewen May 5, 2022
26f3498
refactor(secrets): added variables for aws secrets
DmitriyLewen May 11, 2022
47b29b1
refactor(secrets): used fmt.sprintf, added tests for invalid aws keys
DmitriyLewen May 12, 2022
c0c5c98
test(secrets): added tests for aws secrets
DmitriyLewen May 12, 2022
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
14 changes: 12 additions & 2 deletions secret/builtin-rules.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -64,6 +64,16 @@ var (
CategoryTypeform = types.SecretRuleCategory("Typeform")
)

// Reusable regex patterns
const (
quote = `["']?`
connect = `\s*(:|=>|=)\s*`
startSecret = `(^|\s+)`
endSecret = `(\s+|$)`

aws = `(aws)?_?`
)

var builtinRules = []Rule{
{
ID: "aws-access-key-id",
Expand All @@ -78,7 +88,7 @@ var builtinRules = []Rule{
Category: CategoryAWS,
Severity: "CRITICAL",
Title: "AWS Secret Access Key",
Regex: MustCompile(`(?i)["']?(aws)?_?(secret)?_?(access)?_?key["']?\s*(:|=>|=)\s*(?P<secret>["']?[A-Za-z0-9\/\+=]{40})["']?`),
Regex: MustCompile(`(?i)` + startSecret + quote + aws + `(secret)?_?(access)?_?key` + quote + connect + quote + `(?P<secret>[A-Za-z0-9\/\+=]{40})` + quote + endSecret),
Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Can we use fmt.Sprintf?

Copy link
Collaborator Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Done

SecretGroupName: "secret",
Keywords: []string{"key"},
},
Expand All @@ -87,7 +97,7 @@ var builtinRules = []Rule{
Category: CategoryAWS,
Severity: "HIGH",
Title: "AWS Account ID",
Regex: MustCompile(`(?i)["']?(aws)?_?account_?(id)?["']?\s*(:|=>|=)\s*['"]?(?P<secret>[0-9]{4}\-?[0-9]{4}\-?[0-9]{4})['"]?`),
Regex: MustCompile(`(?i)` + startSecret + quote + aws + `account_?(id)?` + quote + connect + quote + `(?P<secret>[0-9]{4}\-?[0-9]{4}\-?[0-9]{4})` + quote + endSecret),
SecretGroupName: "secret",
Keywords: []string{"account"},
},
Expand Down