Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Adding a rule for Databricks Personal Access Token detection #187

Merged
merged 5 commits into from
May 17, 2024

Conversation

tobiasgyoerfi
Copy link
Contributor

Adding a rule for Databricks Personal Access Token detection and enabling it in the default ruleset.

@bradlarsen
Copy link
Collaborator

@tobiasgyoerfi thanks, this looks good!

P.S. I retrained the failing tests with cargo insta test --review.

@bradlarsen bradlarsen added enhancement New feature or request detection Related to rules or detection of sensitive information labels May 17, 2024
@bradlarsen
Copy link
Collaborator

I also updated the CHANGELOG. Thank you for allowing maintainers to edit this pull request!

Thanks for the contribution 🍻

@bradlarsen
Copy link
Collaborator

Okay, I also used GitHub Code search to investigate the signal to noise of this new rule.

What you had originally written turns up many false positives. For example, searching for that pattern gives this result:

    dapiDataGetTopLongShortPositionRatio (params?: {}): Promise<implicitReturnType>;

I looked at some examples that appear to be real and noticed a couple things:

  • The token payload seems to be lowercase hexadecimal, not arbitrary alphabet characters
  • The dash only seems to appear as a -NUMBER suffix after the 32 payload characters

Making those changes produces far fewer false positives.

Thank you again!

@bradlarsen bradlarsen merged commit ba0fee6 into praetorian-inc:main May 17, 2024
10 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
detection Related to rules or detection of sensitive information enhancement New feature or request
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants