diff --git a/detect_secrets/plugins/sendgrid.py b/detect_secrets/plugins/sendgrid.py new file mode 100644 index 000000000..e3a1c5960 --- /dev/null +++ b/detect_secrets/plugins/sendgrid.py @@ -0,0 +1,17 @@ +""" +This plugin searches for SendGrid API keys +""" +import re + +from detect_secrets.plugins.base import RegexBasedDetector + + +class SendGridDetector(RegexBasedDetector): + """Scans for SendGrid API keys.""" + secret_type = 'SendGrid API key' + + denylist = [ + # SendGrid API key + # ref. https://d2w67tjf43xwdp.cloudfront.net/Classroom/Basics/API/what_is_my_api_key.html + re.compile(r'SG\.[a-zA-Z0-9_-]{22}\.[a-zA-Z0-9_-]{43}'), + ] diff --git a/tests/plugins/sendgrid_test.py b/tests/plugins/sendgrid_test.py new file mode 100644 index 000000000..32909d927 --- /dev/null +++ b/tests/plugins/sendgrid_test.py @@ -0,0 +1,20 @@ +import pytest + +from detect_secrets.plugins.sendgrid import SendGridDetector + + +class TestSendGridDetector: + + @pytest.mark.parametrize( + 'payload, should_flag', + [ + ('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', True), + ('SG.ngeVfQFYQlKU0ufo8x5d1A..TwL2iGABf9DHoTf-09kqeF8tAmbihYzrnopKc-1s5cr', False), + ('AG.ngeVfQFYQlKU0ufo8x5d1A.TwL2iGABf9DHoTf-09kqeF8tAmbihYzrnopKc-1s5cr', False), + ('foo', False), + ], + ) + def test_analyze(self, payload, should_flag): + logic = SendGridDetector() + output = logic.analyze_line(filename='mock_filename', line=payload) + assert len(output) == int(should_flag)