feat(secret): enhance secret scanning for python binary files

docs/docs/scanner/secret.md

@@ -3,7 +3,9 @@
 Trivy scans any container image, filesystem and git repository to detect exposed secrets like passwords, api keys, and tokens.
 Secret scanning is enabled by default.
 
-Trivy will scan every plaintext file, according to builtin rules or configuration. There are plenty of builtin rules:
+Trivy will scan every plaintext file, according to builtin rules or configuration. Also, Trivy can detect secrets in compiled Python files (`.pyc`).
+
+There are plenty of builtin rules:
 
 - AWS access key
 - GCP service account

pkg/fanal/analyzer/secret/secret.go

@@ -54,6 +54,9 @@ var (
 		".gz",
 		".gzip",
 		".tar",
+	}
+
+	allowedBinaries = []string{
 		".pyc",
 	}
 )
@@ -63,6 +66,10 @@ func init() {
 	analyzer.RegisterAnalyzer(NewSecretAnalyzer(secret.Scanner{}, ""))
 }
 
+func isAllowedBinary(filename string) bool {
+	return slices.Contains(allowedBinaries, filepath.Ext(filename))
+}
+
 // SecretAnalyzer is an analyzer for secrets
 type SecretAnalyzer struct {
 	scanner    secret.Scanner
@@ -96,20 +103,28 @@ func (a *SecretAnalyzer) Init(opt analyzer.AnalyzerOptions) error {
 func (a *SecretAnalyzer) Analyze(_ context.Context, input analyzer.AnalysisInput) (*analyzer.AnalysisResult, error) {
 	// Do not scan binaries
 	binary, err := utils.IsBinary(input.Content, input.Info.Size())
-	if binary || err != nil {
+	if err != nil || (binary && !isAllowedBinary(input.FilePath)) {
 		return nil, nil
 	}
 
 	if size := input.Info.Size(); size > 10485760 { // 10MB
 		log.WithPrefix("secret").Warn("The size of the scanned file is too large. It is recommended to use `--skip-files` for this file to avoid high memory consumption.", log.FilePath(input.FilePath), log.Int64("size (MB)", size/1048576))
 	}
 
-	content, err := io.ReadAll(input.Content)
-	if err != nil {
-		return nil, xerrors.Errorf("read error %s: %w", input.FilePath, err)
-	}
+	var content []byte
 
-	content = bytes.ReplaceAll(content, []byte("\r"), []byte(""))
+	if !binary {
+		content, err = io.ReadAll(input.Content)
+		if err != nil {
+			return nil, xerrors.Errorf("read error %s: %w", input.FilePath, err)
+		}
+		content = bytes.ReplaceAll(content, []byte("\r"), []byte(""))
+	} else {
+		content, err = utils.ExtractPrintableBytes(input.Content)
+		if err != nil {
+			return nil, xerrors.Errorf("binary read error %s: %w", input.FilePath, err)
+		}
+	}
 
 	filePath := input.FilePath
 	// Files extracted from the image have an empty input.Dir.

pkg/fanal/analyzer/secret/secret_test.go

@@ -95,6 +95,30 @@ func TestSecretAnalyzer(t *testing.T) {
 			},
 		},
 	}
+	wantFindingGH_PAT := types.SecretFinding{
+		RuleID:    "github-fine-grained-pat",
+		Category:  "GitHub",
+		Title:     "GitHub Fine-grained personal access tokens",
+		Severity:  "CRITICAL",
+		StartLine: 1,
+		EndLine:   1,
+		Match:     " o e\xabfx \xe3 @ s d Z e e d S ) \xda]*********************************************************************************************N) \xda secret1\xda print\xa9",
+		Code: types.Code{
+			Lines: []types.Line{
+				{
+					Number:      1,
+					Content:     " o e\xabfx \xe3 @ s d Z e e d S ) \xda]*********************************************************************************************N) \xda secret1\xda print\xa9",
+					IsCause:     true,
+					Annotation:  "",
+					Truncated:   false,
+					Highlighted: " o e\xabfx \xe3 @ s d Z e e d S ) \xda]*********************************************************************************************N) \xda secret1\xda print\xa9",
+					FirstCause:  true,
+					LastCause:   true,
+				},
+			},
+		},
+	}
+
 	tests := []struct {
 		name       string
 		configPath string
@@ -153,6 +177,21 @@ func TestSecretAnalyzer(t *testing.T) {
 			filePath:   "testdata/binaryfile",
 			want:       nil,
 		},
+		{
+			name:       "python binary file",
+			configPath: "testdata/skip-tests-config.yaml",
+			filePath:   "testdata/secret.cpython-310.pyc",
+			want: &analyzer.AnalysisResult{
+				Secrets: []types.Secret{
+					{
+						FilePath: "/testdata/secret.cpython-310.pyc",
+						Findings: []types.SecretFinding{
+							wantFindingGH_PAT,
+						},
+					},
+				},
+			},
+		},
 	}
 
 	for _, tt := range tests {

pkg/fanal/utils/utils.go

@@ -8,6 +8,7 @@ import (
 	"os"
 	"os/exec"
 	"path/filepath"
+	"unicode"
 
 	xio "github.com/aquasecurity/trivy/pkg/x/io"
 )
@@ -93,3 +94,31 @@ func IsBinary(content xio.ReadSeekerAt, fileSize int64) (bool, error) {
 
 	return false, nil
 }
+
+func ExtractPrintableBytes(content xio.ReadSeekerAt) ([]byte, error) {
+	var printalbe []byte
+	current := make([]byte, 1)
+
+	wasReadable := false
+
+	for {
+		_, err := content.Read(current)
+		if err == io.EOF {
+			break
+		} else if err != nil {
+			return nil, err
+		}
+		if unicode.IsPrint(rune(current[0])) {
+			if !wasReadable {
+				printalbe = append(printalbe, byte(' '))
+				wasReadable = true
+			}
+			printalbe = append(printalbe, current[0])
+		} else {
+			wasReadable = false
+		}
+
+	}
+
+	return printalbe, nil
+}