gitea-mirror/trivy
1
0
Fork 0
mirror of https://github.com/aquasecurity/trivy.git synced 2025-12-05 20:40:16 -08:00
Code Issues Packages Projects Releases Wiki Activity

fix(secret): change grafana token regex to find them without unquoted (#7627)

Browse Source
This commit is contained in:
Samuel Gaist
2024-10-02 12:06:14 +02:00
committed by GitHub
parent 8735242b8f
commit 3e1fa21000
3 changed files with 77 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
pkg/fanal/secret/builtin-rules.go
View File

@@ -553,7 +553,7 @@ var builtinRules = []Rule{
Category: CategoryGrafana,
Title: "Grafana API token",
Severity: "MEDIUM",
Regex: MustCompile(`['\"]eyJrIjoi(?i)[a-z0-9\-_=]{72,92}['\"]`),
Regex: MustCompile(`['\"]?eyJrIjoi(?i)[a-z0-9\-_=]{72,92}['\"]?`),
Keywords: []string{"eyJrIjoi"},
},
{

74
pkg/fanal/secret/scanner_test.go
View File

@@ -690,6 +690,71 @@ func TestSecretScanner(t *testing.T) {
},
}
wantFindingGrafanaQuoted := types.SecretFinding{
RuleID: "grafana-api-token",
Category: secret.CategoryGrafana,
Title: "Grafana API token",
Severity: "MEDIUM",
StartLine: 1,
EndLine: 1,
Match: "GRAFANA_TOKEN=**********************************************************************************************",
Code: types.Code{
Lines: []types.Line{
{
Number: 1,
Content: "GRAFANA_TOKEN=**********************************************************************************************",
Highlighted: "GRAFANA_TOKEN=**********************************************************************************************",
IsCause: true,
FirstCause: true,
LastCause: true,
},
{
Number: 2,
Content: "GRAFANA_TOKEN=**************************************************************************************",
Highlighted: "GRAFANA_TOKEN=**************************************************************************************",
IsCause: false,
FirstCause: false,
LastCause: false,
},
},
},
}
wantFindingGrafanaUnquoted := types.SecretFinding{
RuleID: "grafana-api-token",
Category: secret.CategoryGrafana,
Title: "Grafana API token",
Severity: "MEDIUM",
StartLine: 2,
EndLine: 2,
Match: "GRAFANA_TOKEN=********************************************************************************************",
Code: types.Code{
Lines: []types.Line{
{
Number: 1,
Content: "GRAFANA_TOKEN=**************************************************************************************",
Highlighted: "GRAFANA_TOKEN=**************************************************************************************",
IsCause: false,
FirstCause: false,
LastCause: false,
},
{
Number: 2,
Content: "GRAFANA_TOKEN=********************************************************************************************",
Highlighted: "GRAFANA_TOKEN=********************************************************************************************",
IsCause: true,
FirstCause: true,
LastCause: true,
},
{
Number: 3,
Content: "",
Highlighted: "",
},
},
},
}
wantMultiLine := types.SecretFinding{
RuleID: "multi-line-secret",
Category: "general",
@@ -858,6 +923,15 @@ func TestSecretScanner(t *testing.T) {
Findings: []types.SecretFinding{wantFindingHuggingFace},
},
},
{
name: "find grafana secret",
configPath: filepath.Join("testdata", "config.yaml"),
inputFilePath: filepath.Join("testdata", "grafana-env.txt"),
want: types.Secret{
FilePath: filepath.Join("testdata", "grafana-env.txt"),
Findings: []types.SecretFinding{wantFindingGrafanaUnquoted, wantFindingGrafanaQuoted},
},
},
{
name: "find JWT token",
configPath: filepath.Join("testdata", "config.yaml"),

2
pkg/fanal/secret/testdata/grafana-env.txt vendored Normal file
View File

@@ -0,0 +1,2 @@
GRAFANA_TOKEN="eyJrIjoiT0tTcG1pUlY2RnVKZTFVaDFsNFZXdE9ZWmNrMkZYbkT0tTcG1pUlY2RnVKZTFVaDFsNFZXdE9ZWmNrMkZYbk"
GRAFANA_TOKEN=eyJrIjoiT0tTcG1pUlY2RnVKZTFVaDFsNFZXdE9ZWmNrMkZYbkT0tTcG1pUlY2RnVKZTFVaDFsNFZXdE9ZWmNrMkZYbk