Patience Mpofu
e12da3c72f
* docs: add generic config-secret custom detector example
Custom Detectors already support omitting the `verify` webhook, in
which case matches are simply reported as unverified. This makes them
usable for flagging generic hardcoded secrets (e.g. *.password=,
*.secret=) in config files like .properties, .env, and .yaml, which
the built-in verified detectors intentionally don't cover.
Adds examples/generic_config_secrets.yml, tuned for that use case
(looser than generic_with_filters.yml, which requires a digit and a
special char), with entropy filtering and exclude rules for common
placeholders (changeme, ${VAR}, {{ .template }}, etc.) to keep false
positives down. Also links to it from README.md and
CUSTOM_DETECTORS.md next to the existing `verify`-optional docs.
Addresses #4957.
* fix: scope placeholder excludes to captured value, not full match
exclude_regexes_match runs against the entire key=value match, so the
env/vault/kms exclude rules were dropping real hardcoded secrets
whenever the key path happened to contain a word like "env" (e.g.
env.password=..., app.env.secret=...) -- common in config files this
example targets. Switch to exclude_regexes_capture so these rules only
look at the value being reported.
Flagged by Cursor Bugbot on PR #5195.
48 lines
1.1 KiB
YAML
48 lines
1.1 KiB
YAML
detectors:
|
|
- name: generic-config-secret
|
|
keywords:
|
|
- secret
|
|
- password
|
|
- passwd
|
|
- pwd
|
|
- apikey
|
|
- api_key
|
|
- api-key
|
|
- token
|
|
- credential
|
|
- cred
|
|
- auth
|
|
regex:
|
|
secret: |-
|
|
(?i)[\w.-]{0,50}?(?:secret|passw(?:or)?d|pwd|api[_-]?key|token|credentials?|creds?|auth)[\w.-]{0,20}\s*[=:]\s*["'`]?([^\s"'`,;]{6,150})["'`]?\s*(?:$|[\r\n#;])
|
|
entropy: 2.5
|
|
# Applied to the captured value only (not the key), so a key path like
|
|
# `env.password` or `app.env.secret` doesn't cause a real hardcoded
|
|
# secret to be excluded just because "env" appears in the key.
|
|
exclude_regexes_capture:
|
|
- '(?i)^\$\{[^}]*\}$'
|
|
- '(?i)^\{\{[^}]*\}\}$'
|
|
- '(?i)^%[A-Z_]+%$'
|
|
- '(?i)^\$[A-Z_][A-Z0-9_]*$'
|
|
- '(?i)^(?:process\.env\.|os\.environ|getenv\(|System\.getenv\()'
|
|
- '(?i)^(?:vault|kms|secretsmanager|parameterstore)://'
|
|
exclude_words:
|
|
- "changeme"
|
|
- "change_me"
|
|
- "change-me"
|
|
- "changethis"
|
|
- "xxxxxx"
|
|
- "example"
|
|
- "placeholder"
|
|
- "dummy"
|
|
- "redacted"
|
|
- "your_api_key"
|
|
- "your-api-key"
|
|
- "yourapikey"
|
|
- "insert_secret_here"
|
|
- "todo"
|
|
- "fixme"
|
|
- "null"
|
|
- "none"
|
|
- "false"
|