Asymmetric Private Key secret rule triggers on empty secret

[paul-gould]

Description

Since 0.29.2, the asymmetric private key rule is triggering on python3.9/site-packages/googleapiclient/discovery_cache/documents/appengine.v1.json. This is a schema definition and contains the text

Must include the header and footer. Example: -----BEGIN RSA PRIVATE KEY----- -----END RSA PRIVATE KEY-----

This is using the GitHub trivy-action, which looks to have been updated to use trivy v 0.29.2 last night.

What did you expect to happen?

Detection not triggered as the keyblock only contains whitespace.

What happened instead?

Detection triggered.

Additional details (base image name, container registry info...):

Culprit looks to be the change made in aquasecurity/fanal@e8bca31. Adding the extra - now means that the regex will match a whitespace-only keyblock, which didn't happen previously. However, I think the regex needs to be updated so that a keyblock that contains only whitespace is not a match.

[DmitriyLewen]

Hello @paul-gould
Thank a lot for your report!

I will check this case and write to you

Regards, Dmitriy

[DmitriyLewen]

Hello @paul-gould

Thanks for your report!
We fixed your bug.

Fix will be contain in next release.
You can skip this file.

Best Regards, Dmitriy