APPSEC-2295 Refine post filter for variables (#468)

Author: hendrik-buchwald-sonarsource

sonar-text-plugin/src/main/resources/org/sonar/plugins/secrets/configuration/mongodb.yaml

@@ -27,7 +27,7 @@ provider:
       patternNot:
         - "^([\\w\\.\\*])\\1{2,}$"
         - "(?i)^(db|my)?_?pass(word|wd)?$"
-        - "^\\${1,2}[A-Z_]+$"
+        - "^\\${1,2}\\w+$"
         - "^\\${1,2}[{(]"
         - "^\\{{2,}"
         - "^<[a-z \\-]+>$"

sonar-text-plugin/src/main/resources/org/sonar/plugins/secrets/configuration/mysql.yaml

@@ -44,7 +44,8 @@ provider:
             - "^.$"
             - "^(?i)pass(word|wd)?$"
             - "^%[sv]$"
-            - "^\\${1,2}[A-Z_]+$"
+            - "^\\*{3,}$"
+            - "^\\${1,2}\\w+$"
             - "^\\{.*\\}$"
             - "^'\\{.*\\}'$"
             - "^\\${1,2}[{(]"
@@ -99,6 +100,9 @@ provider:
               port=instance_info.port,
               database=db_name),
           containsSecret: false
+        - text: |
+            DBG1(DBG_LIB, "connecting to mysql://%s:***@%s:%d/%s failed: %s",
+          containsSecret: false
 
     - id: mysql-env-mysql_password-unquoted
       rspecKey: S6697
@@ -284,7 +288,7 @@ provider:
             - "^(db|my)?_?pass(word|wd)?$"
             - "^(assword|ort)$"
             - "^\\*{3,}$"
-            - "^\\${1,2}[A-Z_]+$"
+            - "^\\${1,2}\\w+$"
             - "^\\${1,2}[{(]"
             - "^\\{{2,}"
       examples:
@@ -326,6 +330,15 @@ provider:
         - text: |
             mysqladmin ping --user=mysqluser --password=$${MYSQL_USER_PASSWORD}
           containsSecret: false
+        - text: |
+            command: mysql -h $db_host -P $db_port -u $db_user --password=$db_password  $db_database < /opt/operator-settlement/init.sql
+          containsSecret: false
+        - text: |
+            mysql -h$archery_host -P$archery_port -u$archery_user -p$archery_pw $archery_db -N -e "select
+          containsSecret: false
+        - text: |
+            test: mysqladmin ping -h localhost -u $$MYSQL_USER --password=$$MYSQL_PASSWORD
+          containsSecret: false
 
     - id: mysql-cli-quoted-outer
       rspecKey: S6697
@@ -354,7 +367,7 @@ provider:
           patternNot:
             - "(db|my)?_?pass(word|wd)?"
             - "^\\*{3,}$"
-            - "^\\${1,2}[A-Z_]+$"
+            - "^\\${1,2}\\w+$"
             - "^\\${1,2}[{(]"
             - "^\\{{2,}"
       examples:
@@ -414,7 +427,7 @@ provider:
           patternNot:
             - "(?:db|my)?_?pass(?:word|wd)?"
             - "^\\*{3,}$"
-            - "^\\${1,2}[\\w]+$"
+            - "^\\${1,2}\\w+$"
             - "^\\${1,2}[{(]"
             - "^\\{{2,}"
       examples:

sonar-text-plugin/src/main/resources/org/sonar/plugins/secrets/configuration/odbc.yaml

@@ -39,7 +39,7 @@ provider:
             - "^(?i)pass(word|wd)?$"
             - "^[Xx]{3,}$"
             - "^%[sv]$"
-            - "^\\${1,2}[A-Z_]+$"
+            - "^\\${1,2}\\w+$"
             - "^\\${1,2}[{(]"
       examples:
         - text: |
@@ -119,7 +119,7 @@ provider:
             - "^(?i)pass(word|wd)?$"
             - "^[Xx]{3,}$"
             - "^%[sv]$"
-            - "^\\${1,2}[A-Z_]+$"
+            - "^\\${1,2}\\w+$"
             - "^\\${1,2}[{(]"
       examples:
         - text: |
@@ -198,7 +198,7 @@ provider:
             - "^\\[[\\w\\t \\-]+\\]$"
             - "^<[\\w\\t -]{1,10}>?"
             - "^\\${1,2}[{(]"
-            - "^\\${1,2}[A-Z_]+$"
+            - "^\\${1,2}\\w+$"
             - "\\$\\{\\w+(:-\\w+)?\\}"
             - "^\\{+[^}]*\\}+$"
             - "^`[a-z]+"
@@ -310,7 +310,7 @@ provider:
             - "^\\[[\\w\\t \\-]+\\]$"
             - "^<[\\w\\t -]{1,10}>?"
             - "^\\${1,2}[{(]"
-            - "^\\${1,2}[A-Z_]+$"
+            - "^\\${1,2}\\w+$"
             - "\\$\\{\\w+(:-\\w+)?\\}"
             - "^\\{+[^}]*\\}+$"
             - "^`[a-z]+"

sonar-text-plugin/src/main/resources/org/sonar/plugins/secrets/configuration/postgresql.yaml

@@ -23,7 +23,7 @@ provider:
         - "^<[\\w\\t -]{1,10}>?"
         - "^%[sv]$"
         - "^\\${1,2}[{(]"
-        - "^\\${1,2}[A-Z_]+$"
+        - "^\\${1,2}\\w+$"
         - "\\$\\{\\w+(:-\\w+)?\\}"
         - "^\\{+[^}]*\\}+$"
         - "^\\*{3,}$"