Skip to content

Commit bfe735b

Browse files
domanchidomanchi
authored
Merge pull request #289 from killuazhu/kyle-terminate-tokens
Terminate token matching
2 parents a3e7998 + 3eb6663 commit bfe735b

File tree

4 files changed

+68
-17
lines changed

4 files changed

+68
-17
lines changed

‎detect_secrets/plugins/ibm_cloud_iam.py

+1-1
Original file line numberDiff line numberDiff line change
@@ -17,7 +17,7 @@ class IbmCloudIamDetector(RegexBasedDetector):
1717
opt_dash_undrscr = r'(?:_|-|)'
1818
opt_api = r'(?:api|)'
1919
key_or_pass = r'(?:key|pwd|password|pass|token)'
20-
secret = r'([a-zA-Z0-9_\-]{44})'
20+
secret = r'([a-zA-Z0-9_\-]{44}(?![a-zA-Z0-9_\-]))'
2121
denylist = [
2222
RegexBasedDetector.assign_regex_generator(
2323
prefix_regex=opt_ibm_cloud_iam + opt_dash_undrscr + opt_api,

‎detect_secrets/plugins/ibm_cos_hmac.py

+1-1
Original file line numberDiff line numberDiff line change
@@ -22,7 +22,7 @@ class IbmCosHmacDetector(RegexBasedDetector):
2222

2323
token_prefix = r'(?:(?:ibm)?[-_]?cos[-_]?(?:hmac)?|)'
2424
password_keyword = r'(?:secret[-_]?(?:access)?[-_]?key)'
25-
password = r'([a-f0-9]{48})'
25+
password = r'([a-f0-9]{48}(?![a-f0-9]))'
2626
denylist = (
2727
RegexBasedDetector.assign_regex_generator(
2828
prefix_regex=token_prefix,

‎tests/plugins/ibm_cloud_iam_test.py

+5
Original file line numberDiff line numberDiff line change
@@ -44,9 +44,12 @@ class TestIBMCloudIamDetector(object):
4444
('ibm-cloud_api_key:={cloud_iam_key}'.format(cloud_iam_key=CLOUD_IAM_KEY), True),
4545
('"cloud_iam_api_key":="{cloud_iam_key}"'.format(cloud_iam_key=CLOUD_IAM_KEY), True),
4646
('ibm_iam_key:= "{cloud_iam_key}"'.format(cloud_iam_key=CLOUD_IAM_KEY), True),
47+
('ibm_iam_key:= "{cloud_iam_key}extra"'.format(cloud_iam_key=CLOUD_IAM_KEY), False),
4748
('ibm_api_key:="{cloud_iam_key}"'.format(cloud_iam_key=CLOUD_IAM_KEY), True),
4849
('ibm_password = "{cloud_iam_key}"'.format(cloud_iam_key=CLOUD_IAM_KEY), True),
4950
('ibm-cloud-pwd = {cloud_iam_key}'.format(cloud_iam_key=CLOUD_IAM_KEY), True),
51+
('ibm-cloud-pwd = {cloud_iam_key}extra'.format(cloud_iam_key=CLOUD_IAM_KEY), False),
52+
('ibm-cloud-pwd = shorter-version', False),
5053
('apikey:{cloud_iam_key}'.format(cloud_iam_key=CLOUD_IAM_KEY), True),
5154
('iam_api_key="%s" % IBM_IAM_API_KEY_ENV', False),
5255
('CLOUD_APIKEY: "insert_key_here"', False),
@@ -59,6 +62,8 @@ def test_analyze_string_content(self, payload, should_flag):
5962

6063
output = logic.analyze_string_content(payload, 1, 'mock_filename')
6164
assert len(output) == (1 if should_flag else 0)
65+
if should_flag:
66+
assert list(output.values())[0].secret_value == CLOUD_IAM_KEY
6267

6368
@responses.activate
6469
def test_verify_invalid_secret(self):

‎tests/plugins/ibm_cos_hmac_test.py

+61-15
Original file line numberDiff line numberDiff line change
@@ -22,30 +22,74 @@ class TestIbmCosHmacDetector(object):
2222
@pytest.mark.parametrize(
2323
'payload, should_flag',
2424
[
25-
('"secret_access_key": "1234567890abcdef1234567890abcdef1234567890abcdef"', True),
26-
('secret_access_key=1234567890abcdef1234567890abcdef1234567890abcdef', True),
27-
('secret_access_key="1234567890abcdef1234567890abcdef1234567890abcdef"', True),
28-
('secret_access_key=\'1234567890abcdef1234567890abcdef1234567890abcdef\'', True),
29-
('secret_access_key = "1234567890abcdef1234567890abcdef1234567890abcdef"', True),
3025
(
31-
'COS_HMAC_SECRET_ACCESS_KEY = "1234567890abcdef1234567890abcdef1234567890abcdef"',
26+
'"secret_access_key": "{secret}"'.format(secret=SECRET_ACCESS_KEY),
3227
True,
3328
),
3429
(
35-
'ibm_cos_SECRET_ACCESS_KEY = "1234567890abcdef1234567890abcdef1234567890abcdef"',
30+
'"secret_access_key": "{secret}extra"'.format(secret=SECRET_ACCESS_KEY),
31+
False,
32+
),
33+
(
34+
'secret_access_key={secret}'.format(secret=SECRET_ACCESS_KEY),
35+
True,
36+
),
37+
(
38+
'secret_access_key={secret}extra'.format(secret=SECRET_ACCESS_KEY),
39+
False,
40+
),
41+
(
42+
'secret_access_key="{secret}"'.format(secret=SECRET_ACCESS_KEY),
43+
True,
44+
),
45+
(
46+
'secret_access_key=\'{secret}\''.format(secret=SECRET_ACCESS_KEY),
47+
True,
48+
),
49+
(
50+
'secret_access_key = "{secret}"'.format(secret=SECRET_ACCESS_KEY),
51+
True,
52+
),
53+
(
54+
'COS_HMAC_SECRET_ACCESS_KEY = "{secret}"'.format(secret=SECRET_ACCESS_KEY),
55+
True,
56+
),
57+
(
58+
'ibm_cos_SECRET_ACCESS_KEY = "{secret}"'.format(secret=SECRET_ACCESS_KEY),
59+
True,
60+
),
61+
(
62+
'ibm_cos_secret_access_key = "{secret}"'.format(secret=SECRET_ACCESS_KEY),
63+
True,
64+
),
65+
(
66+
'ibm_cos_secret_key = "{secret}"'.format(secret=SECRET_ACCESS_KEY),
67+
True,
68+
),
69+
(
70+
'cos_secret_key = "{secret}"'.format(secret=SECRET_ACCESS_KEY),
71+
True,
72+
),
73+
(
74+
'ibm-cos_secret_key = "{secret}"'.format(secret=SECRET_ACCESS_KEY),
75+
True,
76+
),
77+
(
78+
'cos-hmac_secret_key = "{secret}"'.format(secret=SECRET_ACCESS_KEY),
79+
True,
80+
),
81+
(
82+
'coshmac_secret_key = "{secret}"'.format(secret=SECRET_ACCESS_KEY),
83+
True,
84+
),
85+
(
86+
'ibmcoshmac_secret_key = "{secret}"'.format(secret=SECRET_ACCESS_KEY),
3687
True,
3788
),
3889
(
39-
'ibm_cos_secret_access_key = "1234567890abcdef1234567890abcdef1234567890abcdef"',
90+
'ibmcos_secret_key = "{secret}"'.format(secret=SECRET_ACCESS_KEY),
4091
True,
4192
),
42-
('ibm_cos_secret_key = "1234567890abcdef1234567890abcdef1234567890abcdef"', True),
43-
('cos_secret_key = "1234567890abcdef1234567890abcdef1234567890abcdef"', True),
44-
('ibm-cos_secret_key = "1234567890abcdef1234567890abcdef1234567890abcdef"', True),
45-
('cos-hmac_secret_key = "1234567890abcdef1234567890abcdef1234567890abcdef"', True),
46-
('coshmac_secret_key = "1234567890abcdef1234567890abcdef1234567890abcdef"', True),
47-
('ibmcoshmac_secret_key = "1234567890abcdef1234567890abcdef1234567890abcdef"', True),
48-
('ibmcos_secret_key = "1234567890abcdef1234567890abcdef1234567890abcdef"', True),
4993
('not_secret = notapassword', False),
5094
('someotherpassword = "doesnt start right"', False),
5195
],
@@ -55,6 +99,8 @@ def test_analyze_string(self, payload, should_flag):
5599

56100
output = logic.analyze_line(payload, 1, 'mock_filename')
57101
assert len(output) == int(should_flag)
102+
if should_flag:
103+
assert list(output.values())[0].secret_value == SECRET_ACCESS_KEY
58104

59105
@patch('detect_secrets.plugins.ibm_cos_hmac.verify_ibm_cos_hmac_credentials')
60106
def test_verify_invalid_secret(self, mock_hmac_verify):

0 commit comments

Comments
 (0)