Skip to content

Commit

Permalink
fix(secret): trim excessively long lines (#7192)
Browse files Browse the repository at this point in the history
  • Loading branch information
@afdesk
afdesk authored Jul 23, 2024
1 parent 9269563 commit 92b13be
Show file tree
Hide file tree
Showing 3 changed files with 51 additions and 10 deletions.
14 changes: 12 additions & 2 deletions pkg/fanal/secret/scanner.go
View file
Original file line number Diff line number Diff line change
Expand Up @@ -476,7 +476,10 @@ func toFinding(rule Rule, loc Location, content []byte) types.SecretFinding {
}
}

const secretHighlightRadius = 2 // number of lines above + below each secret to include in code output
const (
secretHighlightRadius = 2 // number of lines above + below each secret to include in code output
maxLineLength = 100 // all lines longer will be cut off
)

func findLocation(start, end int, content []byte) (int, int, types.Code, string) {
startLineNum := bytes.Count(content[:start], lineSep)
Expand Down Expand Up @@ -511,9 +514,16 @@ func findLocation(start, end int, content []byte) (int, int, types.Code, string)
rawLines := lines[codeStart:codeEnd]
var foundFirst bool
for i, rawLine := range rawLines {
strRawLine := string(rawLine)
realLine := codeStart + i
inCause := realLine >= startLineNum && realLine <= endLineNum

var strRawLine string
if len(rawLine) > maxLineLength {
strRawLine = lo.Ternary(inCause, matchLine, string(rawLine[:maxLineLength]))
} else {
strRawLine = string(rawLine)
}

code.Lines = append(code.Lines, types.Line{
Number: codeStart + i + 1,
Content: strRawLine,
Expand Down
46 changes: 38 additions & 8 deletions pkg/fanal/secret/scanner_test.go
View file
Original file line number Diff line number Diff line change
Expand Up @@ -353,8 +353,8 @@ func TestSecretScanner(t *testing.T) {
Lines: []types.Line{
{
Number: 1,
Content: "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa GITHUB_PAT=**************************************** bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb",
Highlighted: "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa GITHUB_PAT=**************************************** bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb",
Content: "aaaaaaaaaaaaaaaaaa GITHUB_PAT=**************************************** bbbbbbbbbbbbbbbbbbb",
Highlighted: "aaaaaaaaaaaaaaaaaa GITHUB_PAT=**************************************** bbbbbbbbbbbbbbbbbbb",
IsCause: true,
FirstCause: true,
LastCause: true,
Expand Down Expand Up @@ -462,8 +462,8 @@ func TestSecretScanner(t *testing.T) {
Lines: []types.Line{
{
Number: 1,
Content: "{\"key\": \"-----BEGIN RSA PRIVATE KEY-----**************************************************************************************************************************-----END RSA PRIVATE KEY-----\\n\"}",
Highlighted: "{\"key\": \"-----BEGIN RSA PRIVATE KEY-----**************************************************************************************************************************-----END RSA PRIVATE KEY-----\\n\"}",
Content: "----BEGIN RSA PRIVATE KEY-----**************************************************************************************************************************-----END RSA PRIVATE",
Highlighted: "----BEGIN RSA PRIVATE KEY-----**************************************************************************************************************************-----END RSA PRIVATE",
IsCause: true,
FirstCause: true,
LastCause: true,
Expand All @@ -483,8 +483,8 @@ func TestSecretScanner(t *testing.T) {
Lines: []types.Line{
{
Number: 1,
Content: "-----BEGIN RSA PRIVATE KEY-----****************************************************************************************************************************************************************************************-----END RSA PRIVATE KEY-----",
Highlighted: "-----BEGIN RSA PRIVATE KEY-----****************************************************************************************************************************************************************************************-----END RSA PRIVATE KEY-----",
Content: "----BEGIN RSA PRIVATE KEY-----****************************************************************************************************************************************************************************************-----END RSA PRIVATE",
Highlighted: "----BEGIN RSA PRIVATE KEY-----****************************************************************************************************************************************************************************************-----END RSA PRIVATE",
IsCause: true,
FirstCause: true,
LastCause: true,
Expand All @@ -504,8 +504,8 @@ func TestSecretScanner(t *testing.T) {
Lines: []types.Line{
{
Number: 1,
Content: "-----BEGIN RSA PRIVATE KEY-----**************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************-----END RSA PRIVATE KEY-----",
Highlighted: "-----BEGIN RSA PRIVATE KEY-----**************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************-----END RSA PRIVATE KEY-----",
Content: "----BEGIN RSA PRIVATE KEY-----**************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************-----END RSA PRIVATE",
Highlighted: "----BEGIN RSA PRIVATE KEY-----**************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************-----END RSA PRIVATE",
IsCause: true,
FirstCause: true,
LastCause: true,
Expand Down Expand Up @@ -667,6 +667,27 @@ func TestSecretScanner(t *testing.T) {
},
},
}
wantFindingTokenInsideJs := types.SecretFinding{
RuleID: "stripe-publishable-token",
Category: "Stripe",
Title: "Stripe Publishable Key",
Severity: "LOW",
StartLine: 1,
EndLine: 1,
Match: "){case a.ez.PRODUCTION:return\"********************************\";case a.ez.TEST:cas",
Code: types.Code{
Lines: []types.Line{
{
Number: 1,
Content: "){case a.ez.PRODUCTION:return\"********************************\";case a.ez.TEST:cas",
Highlighted: "){case a.ez.PRODUCTION:return\"********************************\";case a.ez.TEST:cas",
IsCause: true,
FirstCause: true,
LastCause: true,
},
},
},
}

tests := []struct {
name string
Expand Down Expand Up @@ -982,6 +1003,15 @@ func TestSecretScanner(t *testing.T) {
Findings: []types.SecretFinding{wantMultiLine},
},
},
{
name: "long obfuscated js code with secrets",
configPath: filepath.Join("testdata", "skip-test.yaml"),
inputFilePath: filepath.Join("testdata", "obfuscated.js"),
want: types.Secret{
FilePath: filepath.Join("testdata", "obfuscated.js"),
Findings: []types.SecretFinding{wantFindingTokenInsideJs},
},
},
}

for _, tt := range tests {
Expand Down
1 change: 1 addition & 0 deletions pkg/fanal/secret/testdata/obfuscated.js
View file

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

0 comments on commit 92b13be

Please sign in to comment.