26 lines
No EOL
4.5 KiB
JSON
26 lines
No EOL
4.5 KiB
JSON
[
|
|
{
|
|
"target": "/home/worsch/repo-manager/src/repo_manager/secret_scan.py",
|
|
"original_sha256": "12d0e1b10c4d613401e33bfdb4012c6cb3e3719b6b1480f8d3ae2f7a27aeb73f",
|
|
"candidate_sha256": "740f64dc1e8421669e6f84fccadef50fcd3d9a802df07f62c6718f917ba55fa9",
|
|
"patch": "--- /home/worsch/repo-manager/src/repo_manager/secret_scan.py\n+++ /home/worsch/repo-manager/src/repo_manager/secret_scan.py\n@@ -55,7 +55,7 @@\n description = \"Filename key whose value is a lowercase 64-hex content digest\"\n targetRules = [\"generic-api-key\"]\n regexTarget = \"match\"\n-regexes = ['^[\\w.-]+\\.(?:md|markdown|txt|yaml|yml|json|py|toml):[ \\t]+[a-f0-9]{64}$']\n+regexes = ['^[\\w.-]+\\.(?:md|markdown|txt|yaml|yml|json|py|toml)(?::[ \\t]+[a-f0-9]{64}|\":[ \\t]+\"[a-f0-9]{64}\")$']\n \"\"\"\n \n \n"
|
|
},
|
|
{
|
|
"target": "/home/worsch/repo-manager/tests/test_secret_scan.py",
|
|
"original_sha256": "5560f57163dc2189d189cce1c7b772ebf1adc8f8a84d388b2b42b546c10cc1c8",
|
|
"candidate_sha256": "2e6d53651ca18e787487cd961efcddc7f483637c63e6e10df399a6d4fcdae962",
|
|
"patch": "--- /home/worsch/repo-manager/tests/test_secret_scan.py\n+++ /home/worsch/repo-manager/tests/test_secret_scan.py\n@@ -479,3 +479,21 @@\n if process.poll() is None:\n process.kill(); process.wait(timeout=5)\n process.stdout.close()\n+\n+\n+@pytest.mark.parametrize(\"key\", [\"values/secrets-engine.yaml\", \"docs/runtime-externalsecret.r1.yaml\"])\n+def test_json_filename_digest_is_allowed(binary, repo, key):\n+ digest = os.urandom(32).hex()\n+ stage(repo, json.dumps({key: digest}).encode(), \"source-pin.json\")\n+ assert secret_scan.scan_staged(repo, binary)[\"status\"] == \"clean\"\n+\n+\n+@pytest.mark.parametrize(\"content\", [\n+ lambda digest: json.dumps({\"secret\": digest}),\n+ lambda digest: json.dumps({\"values/secrets-engine.yaml\": \"glpat-\" + digest}),\n+ lambda digest: json.dumps({\"values/secrets-engine.yaml\": digest + \"a\"}),\n+ lambda digest: json.dumps({\"values/secrets-engine.yaml\": digest.upper()}),\n+])\n+def test_json_digest_exception_does_not_allow_secret_shapes(binary, repo, content):\n+ stage(repo, content(os.urandom(32).hex()).encode(), \"manifest.json\")\n+ assert secret_scan.scan_staged(repo, binary)[\"status\"] == \"blocked\"\n"
|
|
},
|
|
{
|
|
"target": "/home/worsch/railiance-forge/tools/receive-secret-scan/main.go",
|
|
"original_sha256": "a9835dfc830bde5091354debf26ae40c37fab5fdc2c1b0e483774dda0b93521a",
|
|
"candidate_sha256": "4eb494b30b845e090332d3c20070ff417c2114a479823a6097cfe0292ee18aac",
|
|
"patch": "--- /home/worsch/railiance-forge/tools/receive-secret-scan/main.go\n+++ /home/worsch/railiance-forge/tools/receive-secret-scan/main.go\n@@ -36,7 +36,7 @@\n description = \"Filename key whose value is a lowercase 64-hex content digest\"\n targetRules = [\"generic-api-key\"]\n regexTarget = \"match\"\n-regexes = ['^[\\w.-]+\\.(?:md|markdown|txt|yaml|yml|json|py|toml):[ \\t]+[a-f0-9]{64}$']\n+regexes = ['^[\\w.-]+\\.(?:md|markdown|txt|yaml|yml|json|py|toml)(?::[ \\t]+[a-f0-9]{64}|\":[ \\t]+\"[a-f0-9]{64}\")$']\n `\n const maxInput = 512 * 1024\n const maxObject = 8 * 1024 * 1024\n"
|
|
},
|
|
{
|
|
"target": "/home/worsch/railiance-forge/tools/receive-secret-scan/batch_test.go",
|
|
"original_sha256": "4ef5669786c49cadc9e8985d77c215e34effd3e4aabeb5387cafbe51e5e89e17",
|
|
"candidate_sha256": "d94d7812a74b1cb7ff53ee9a3e137d8b524d96f4dca813ca52a9f84f800323b9",
|
|
"patch": "--- /home/worsch/railiance-forge/tools/receive-secret-scan/batch_test.go\n+++ /home/worsch/railiance-forge/tools/receive-secret-scan/batch_test.go\n@@ -188,6 +188,11 @@\n \t\t{\"inline-suppression\", append([]byte(\"# gitleaks:allow\\n\"), privateKey...), true},\n \t\t{\"filename-digest\", []byte(\" cards/access.md: \" + digest + \"\\n\"), false},\n \t\t{\"bare-keyword-digest\", []byte(\"access: \" + digest + \"\\n\"), true},\n+\t\t{\"json-filename-digest\", []byte(\"{\\\"values/secrets-engine.yaml\\\": \\\"\" + digest + \"\\\"}\\n\"), false},\n+\t\t{\"json-bare-secret-digest\", []byte(\"{\\\"secret\\\": \\\"\" + digest + \"\\\"}\\n\"), true},\n+\t\t{\"json-filename-token\", []byte(\"{\\\"values/secrets-engine.yaml\\\": \\\"\" + string(canary) + \"\\\"}\\n\"), true},\n+\t\t{\"json-filename-long-digest\", []byte(\"{\\\"values/secrets-engine.yaml\\\": \\\"\" + digest + \"a\\\"}\\n\"), true},\n+\t\t{\"json-filename-uppercase-digest\", []byte(\"{\\\"values/secrets-engine.yaml\\\": \\\"\" + strings.ToUpper(digest) + \"\\\"}\\n\"), true},\n \t} {\n \t\tt.Run(tc.name, func(t *testing.T) {\n \t\t\tstdin, e := scan(context.Background(), f, config, tc.input)\n"
|
|
}
|
|
] |