🐛 False-Positive Secret Detection - Base64String Matches AWS Access Key ID Pattern #2060
Comments
|
It appears that this is also happening for me, for portions of the default web.config file in windows containers. |
|
Thanks @DmitriyLewen, in the Secrets Configuration documentation, I don't see an example of how to skip a specific file or directory. I only see how to disable rules. Can the documentation be updated with an example on how to ignore paths/files? Thanks. |
|
@AErmie Please see also: We're trying to improve this rule now. Thanks for your patience. |
|
Thanks @knqyf263, my apologies, what I meant was, I didn't see an example of how to include skipping a specific file or directory using the Thank you for everyone's work on improving the rule. |
|
I also need an example of ignoring a path from a config file. I want the ignored files to be in source control and not configured on the command line. |
|
For instance I would expect the following to ignore files under |
|
This issue is stale because it has been labeled with inactivity. |
github-actions
bot
added
the
lifecycle/stale
Checklist
-f jsonthat shows data sources and make sure that the security advisory is correct.Description
Trivy
imagescan identifies a critical secret vulnerability. We believe this is a false positive, as the matched "secret" is actually part of a base64string of a mock image we have in the source code and gets transpired in a backend.js file.We don't want to suppress the secret rule completely (as we want to catch any legitimate ones).
JSON Output of run with
-debug:Trivy Debug output
Trivy
-f JSONoutput{ "SchemaVersion": 2, "ArtifactName": "myapp-backend:20220427-24", "ArtifactType": "container_image", "Metadata": { "OS": { "Family": "alpine", "Name": "3.15.4" }, "ImageID": "sha256:35660d82fcd6208eafd8b5c0efe3efb5b825b2ea02e02af466be573c85e304e1", "DiffIDs": [ "sha256:4fc242d58285699eca05db3cc7c7122a2b8e014d9481f323bd9277baacfa0628", "sha256:cdb4a052fad7cfcbe8a8bcd37edb2da38de007f259ddb31deeedd8860f14e601", "sha256:b5a53db2b893ada6519f1d261e83866ffa7f650eee6cbf0dbc4b172a98c114fc", "sha256:9c8958a02c6e3fcc89c7de2299c6a56c79777b5374e49b46d0c1f44ac07ba3fc", "sha256:3a53a4029ebdc781d7419ae570688859f2a627be0d289c84f49a3be655903973", "sha256:b098c7dbb7cccbd1de3b992a6ad1a6fbcab01609ff6e7d86e79c135e0535fc62", "sha256:09f2f6cafe72823f33dd566f1d127759f4796bd88695be833b8bf6bda9a81a1a", "sha256:42329f51e8fbb64538d3bfeb1c9e3c4c5822eb934c561350bae7ca45bacc5471", "sha256:e123887aba9a55f5c0b56e046abdbd93e9d9bf3db97de448711bf7bed0b3ba03", "sha256:31ead3a476dfafc438526c440d84585953ffeab5b1614a0a50c9d74854c2c619", "sha256:aae9aa238b19dbfd33d61d5cbe7f23a0fb0b7b8c99a9d0c3b0c454a8a1745532" ], "RepoTags": [ "myapp-backend:20220427-24" ], "ImageConfig": { "architecture": "amd64", "created": "2022-04-27T15:23:03.687884974Z", "history": [ { "created": "2022-04-05T00:19:59Z", "created_by": "/bin/sh -c #(nop) ADD file:5d673d25da3a14ce1f6cf66e4c7fd4f4b85a3759a9d93efb3fd9ff852b5b56e4 in / " }, { "created": "2022-04-05T00:19:59Z", "created_by": "/bin/sh -c #(nop) CMD [\"/bin/sh\"]", "empty_layer": true }, { "created": "2022-04-05T10:10:43Z", "created_by": "/bin/sh -c #(nop) ENV NODE_VERSION=16.14.2", "empty_layer": true }, { "created": "2022-04-05T10:10:51Z", "created_by": "/bin/sh -c addgroup -g 1000 node \u0026\u0026 adduser -u 1000 -G node -s /bin/sh -D node \u0026\u0026 apk add --no-cache libstdc++ \u0026\u0026 apk add --no-cache --virtual .build-deps curl \u0026\u0026 ARCH= \u0026\u0026 alpineArch=\"$(apk --print-arch)\" \u0026\u0026 case \"${alpineArch##*-}\" in x86_64) ARCH='x64' CHECKSUM=\"a6dc255e1ef1f20372306eec932b4a3648575c6d3024bcd685b8efc93dc95569\" ;; *) ;; esac \u0026\u0026 if [ -n \"${CHECKSUM}\" ]; then set -eu; curl -fsSLO --compressed \"[https://unofficial-builds.nodejs.org/download/release/v$NODE_VERSION/node-v$NODE_VERSION-linux-$ARCH-musl.tar.xz\";](https://unofficial-builds.nodejs.org/download/release/v$NODE_VERSION/node-v$NODE_VERSION-linux-$ARCH-musl.tar.xz/%22;) echo \"$CHECKSUM node-v$NODE_VERSION-linux-$ARCH-musl.tar.xz\" | sha256sum -c - \u0026\u0026 tar -xJf \"node-v$NODE_VERSION-linux-$ARCH-musl.tar.xz\" -C /usr/local --strip-components=1 --no-same-owner \u0026\u0026 ln -s /usr/local/bin/node /usr/local/bin/nodejs; else echo \"Building from source\" \u0026\u0026 apk add --no-cache --virtual .build-deps-full binutils-gold g++ gcc gnupg libgcc linux-headers make python3 \u0026\u0026 for key in 4ED778F539E3634C779C87C6D7062848A1AB005C 141F07595B7B3FFE74309A937405533BE57C7D57 94AE36675C464D64BAFA68DD7434390BDBE9B9C5 74F12602B6F1C4E913FAA37AD3A89613643B6201 71DCFD284A79C3B38668286BC97EC7A07EDE3FC1 8FCCA13FEF1D0C2E91008E09770F7A9A5AE15600 C4F0DFFF4E8C1A8236409D08E73BC641CC11F4C8 C82FA3AE1CBEDC6BE46B9360C43CEC45C17AB93C DD8F2338BAE7501E3DD5AC78C273792F7D83545D A48C2BEE680E841632CD4E44F07496B3EB3C1762 108F52B48DB57BB0CC439B2997B01419BD92F80A B9E2F5981AA6E0CD28160D9FF13993A75599653C ; do gpg --batch --keyserver hkps://keys.openpgp.org --recv-keys \"$key\" || gpg --batch --keyserver keyserver.ubuntu.com --recv-keys \"$key\" ; done \u0026\u0026 curl -fsSLO --compressed \"[https://nodejs.org/dist/v$NODE_VERSION/node-v$NODE_VERSION.tar.xz\"](https://nodejs.org/dist/v$NODE_VERSION/node-v$NODE_VERSION.tar.xz/%22) \u0026\u0026 curl -fsSLO --compressed \"[https://nodejs.org/dist/v$NODE_VERSION/SHASUMS256.txt.asc\"](https://nodejs.org/dist/v$NODE_VERSION/SHASUMS256.txt.asc/%22) \u0026\u0026 gpg --batch --decrypt --output SHASUMS256.txt SHASUMS256.txt.asc \u0026\u0026 grep \" node-v$NODE_VERSION.tar.xz\\$\" SHASUMS256.txt | sha256sum -c - \u0026\u0026 tar -xf \"node-v$NODE_VERSION.tar.xz\" \u0026\u0026 cd \"node-v$NODE_VERSION\" \u0026\u0026 ./configure \u0026\u0026 make -j$(getconf _NPROCESSORS_ONLN) V= \u0026\u0026 make install \u0026\u0026 apk del .build-deps-full \u0026\u0026 cd .. \u0026\u0026 rm -Rf \"node-v$NODE_VERSION\" \u0026\u0026 rm \"node-v$NODE_VERSION.tar.xz\" SHASUMS256.txt.asc SHASUMS256.txt; fi \u0026\u0026 rm -f \"node-v$NODE_VERSION-linux-$ARCH-musl.tar.xz\" \u0026\u0026 apk del .build-deps \u0026\u0026 node --version \u0026\u0026 npm --version" }, { "created": "2022-04-05T10:10:51Z", "created_by": "/bin/sh -c #(nop) ENV YARN_VERSION=1.22.18", "empty_layer": true }, { "created": "2022-04-05T10:10:55Z", "created_by": "/bin/sh -c apk add --no-cache --virtual .build-deps-yarn curl gnupg tar \u0026\u0026 for key in 6A010C5166006599AA17F08146C2130DFD2497F5 ; do gpg --batch --keyserver hkps://keys.openpgp.org --recv-keys \"$key\" || gpg --batch --keyserver keyserver.ubuntu.com --recv-keys \"$key\" ; done \u0026\u0026 curl -fsSLO --compressed \"[https://yarnpkg.com/downloads/$YARN_VERSION/yarn-v$YARN_VERSION.tar.gz\"](https://yarnpkg.com/downloads/$YARN_VERSION/yarn-v$YARN_VERSION.tar.gz/%22) \u0026\u0026 curl -fsSLO --compressed \"[https://yarnpkg.com/downloads/$YARN_VERSION/yarn-v$YARN_VERSION.tar.gz.asc\"](https://yarnpkg.com/downloads/$YARN_VERSION/yarn-v$YARN_VERSION.tar.gz.asc/%22) \u0026\u0026 gpg --batch --verify yarn-v$YARN_VERSION.tar.gz.asc yarn-v$YARN_VERSION.tar.gz \u0026\u0026 mkdir -p /opt \u0026\u0026 tar -xzf yarn-v$YARN_VERSION.tar.gz -C /opt/ \u0026\u0026 ln -s /opt/yarn-v$YARN_VERSION/bin/yarn /usr/local/bin/yarn \u0026\u0026 ln -s /opt/yarn-v$YARN_VERSION/bin/yarnpkg /usr/local/bin/yarnpkg \u0026\u0026 rm yarn-v$YARN_VERSION.tar.gz.asc yarn-v$YARN_VERSION.tar.gz \u0026\u0026 apk del .build-deps-yarn \u0026\u0026 yarn --version" }, { "created": "2022-04-05T10:10:55Z", "created_by": "/bin/sh -c #(nop) COPY file:4d192565a7220e135cab6c77fbc1c73211b69f3d9fb37e62857b2c6eb9363d51 in /usr/local/bin/ " }, { "created": "2022-04-05T10:10:56Z", "created_by": "/bin/sh -c #(nop) ENTRYPOINT [\"docker-entrypoint.sh\"]", "empty_layer": true }, { "created": "2022-04-05T10:10:56Z", "created_by": "/bin/sh -c #(nop) CMD [\"node\"]", "empty_layer": true }, { "created": "2022-04-27T13:15:28Z", "created_by": "RUN /bin/sh -c npm install -g [email protected] # buildkit", "comment": "buildkit.dockerfile.v0" }, { "created": "2022-04-27T13:15:28Z", "created_by": "USER node", "comment": "buildkit.dockerfile.v0", "empty_layer": true }, { "created": "2022-04-27T13:15:28Z", "created_by": "WORKDIR /app", "comment": "buildkit.dockerfile.v0", "empty_layer": true }, { "created": "2022-04-27T15:22:56Z", "created_by": "COPY /app/dist/backend /app/dist/backend # buildkit", "comment": "buildkit.dockerfile.v0" }, { "created": "2022-04-27T15:22:56Z", "created_by": "COPY /app/package.json /app # buildkit", "comment": "buildkit.dockerfile.v0" }, { "created": "2022-04-27T15:23:03Z", "created_by": "COPY /app/node_modules /app/node_modules # buildkit", "comment": "buildkit.dockerfile.v0" }, { "created": "2022-04-27T15:23:03Z", "created_by": "COPY /app/src/features-* /app/src/ # buildkit", "comment": "buildkit.dockerfile.v0" }, { "created": "2022-04-27T15:23:03Z", "created_by": "COPY /app/src/controllers/v1/mock/data/currentUser /app/src/controllers/v1/mock/data/currentUser # buildkit", "comment": "buildkit.dockerfile.v0" }, { "created": "2022-04-27T15:23:03Z", "created_by": "EXPOSE map[3000/tcp:{}]", "comment": "buildkit.dockerfile.v0", "empty_layer": true }, { "created": "2022-04-27T15:23:03Z", "created_by": "CMD [\"node\" \"/app/dist/backend/backend.js\"]", "comment": "buildkit.dockerfile.v0", "empty_layer": true } ], "os": "linux", "rootfs": { "type": "layers", "diff_ids": [ "sha256:4fc242d58285699eca05db3cc7c7122a2b8e014d9481f323bd9277baacfa0628", "sha256:cdb4a052fad7cfcbe8a8bcd37edb2da38de007f259ddb31deeedd8860f14e601", "sha256:b5a53db2b893ada6519f1d261e83866ffa7f650eee6cbf0dbc4b172a98c114fc", "sha256:9c8958a02c6e3fcc89c7de2299c6a56c79777b5374e49b46d0c1f44ac07ba3fc", "sha256:3a53a4029ebdc781d7419ae570688859f2a627be0d289c84f49a3be655903973", "sha256:b098c7dbb7cccbd1de3b992a6ad1a6fbcab01609ff6e7d86e79c135e0535fc62", "sha256:09f2f6cafe72823f33dd566f1d127759f4796bd88695be833b8bf6bda9a81a1a", "sha256:42329f51e8fbb64538d3bfeb1c9e3c4c5822eb934c561350bae7ca45bacc5471", "sha256:e123887aba9a55f5c0b56e046abdbd93e9d9bf3db97de448711bf7bed0b3ba03", "sha256:31ead3a476dfafc438526c440d84585953ffeab5b1614a0a50c9d74854c2c619", "sha256:aae9aa238b19dbfd33d61d5cbe7f23a0fb0b7b8c99a9d0c3b0c454a8a1745532" ] }, "config": { "Cmd": [ "node", "/app/dist/backend/backend.js" ], "Entrypoint": [ "docker-entrypoint.sh" ], "Env": [ "PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin", "NODE_VERSION=16.14.2", "YARN_VERSION=1.22.18" ], "User": "node", "WorkingDir": "/app", "ArgsEscaped": true } } }, "Results": [ { "Target": "myapp-backend:20220427-24 (alpine 3.15.4)", "Class": "os-pkgs", "Type": "alpine" }, { "Target": "Node.js", "Class": "lang-pkgs", "Type": "node-pkg" }, { "Target": "app/node_modules/esbuild/bin/esbuild", "Class": "lang-pkgs", "Type": "gobinary" }, { "Target": "app/dist/backend/backend.js", "Class": "secret", "Secrets": [ { "RuleID": "aws-access-key-id", "Category": "AWS", "Severity": "CRITICAL", "Title": "AWS Access Key ID", "StartLine": 34209, "EndLine": 34209, "Match": "EVGSTo7PxJlV0hOIYOEZ1w//EABwBA*****AECAAMEBQYHCP/EAEURA" } ] } ] }Output of
trivy -v:Digest: sha256:5c8043510bb84ed663a4c0b23887c96edb7e78093bceef0083921887e961494f Status: Downloaded newer image for aquasec/trivy:latest docker.io/aquasec/trivy:latest Version: 0.27.1Additional details (base image name, container registry info...):
I am running Trivy via the Docker container using the following:
The text was updated successfully, but these errors were encountered: