Skip to content

Commit 472ba63

Browse files
gaetan-ferry-sonarsourcegaetan-ferry-sonarsource
authored
(APPSEC-1162) Reduce amount of FPs in test files with filename exclusions (#308)
1 parent 8b46b7c commit 472ba63

File tree

8 files changed

+472
-5
lines changed

8 files changed

+472
-5
lines changed

‎sonar-text-plugin/src/main/resources/org/sonar/plugins/secrets/configuration/aws.yaml

Lines changed: 17 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -4,6 +4,19 @@ provider:
44
category: Cloud provider
55
detection:
66
pre:
7+
reject:
8+
paths:
9+
- "**/test/**"
10+
- "**/tests/**"
11+
- "**/Test/**"
12+
- "**/Tests/**"
13+
- "**/*Test*"
14+
- "**/*test*"
15+
- "**/*.Development*"
16+
- "**/*.development*"
17+
- "**/*.integration.*"
18+
- "**/*.Integration.*"
19+
- "**/*.QA.*"
720
include:
821
content:
922
- aws
@@ -48,6 +61,10 @@ provider:
4861
aws_secret_access_key=kHeUAwnSUizTWpSbyGAz4f+As5LshPIjvtpswqGb
4962
containsSecret: true
5063
match: kHeUAwnSUizTWpSbyGAz4f+As5LshPIjvtpswqGb
64+
- text: |
65+
aws_secret_access_key=kHeUAwnSUizTWpSbyGAz4f+As5LshPIjvtpswqGb
66+
fileName: awsTest.java
67+
containsSecret: false
5168
- text: |
5269
AWS_FECRET_KEY=kHeUAwnSUizTWpSbyGAz4f+As5LshPIjvtpswqGb'
5370
AWS_SECRET_KEY=EXAMPLEKEYCXCgDCUbJq1h7CKwNqnpA1il4MXL+y

‎sonar-text-plugin/src/main/resources/org/sonar/plugins/secrets/configuration/azure.yaml

Lines changed: 83 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -4,6 +4,20 @@ provider:
44
category: Cloud provider
55
message: Make sure this Azure Storage Account Key gets revoked, changed, and removed from the code.
66
detection:
7+
pre:
8+
reject:
9+
paths:
10+
- "**/test/**"
11+
- "**/tests/**"
12+
- "**/Test/**"
13+
- "**/Tests/**"
14+
- "**/*Test*"
15+
- "**/*test*"
16+
- "**/*.Development*"
17+
- "**/*.development*"
18+
- "**/*.integration.*"
19+
- "**/*.Integration.*"
20+
- "**/*.QA.*"
721
post:
822
patternNot:
923
# Character repeated at least 4 times
@@ -26,6 +40,19 @@ provider:
2640
include:
2741
content:
2842
- "core.windows.net"
43+
reject:
44+
paths:
45+
- "**/test/**"
46+
- "**/tests/**"
47+
- "**/Test/**"
48+
- "**/Tests/**"
49+
- "**/*Test*"
50+
- "**/*test*"
51+
- "**/*.Development*"
52+
- "**/*.development*"
53+
- "**/*.integration.*"
54+
- "**/*.Integration.*"
55+
- "**/*.QA.*"
2956
matching:
3057
pattern: "['\"`]([a-zA-Z0-9/\\+]{86}==)['\"`]"
3158
examples:
@@ -115,6 +142,19 @@ provider:
115142
include:
116143
content:
117144
- "AccountKey="
145+
reject:
146+
paths:
147+
- "**/test/**"
148+
- "**/tests/**"
149+
- "**/Test/**"
150+
- "**/Tests/**"
151+
- "**/*Test*"
152+
- "**/*test*"
153+
- "**/*.Development*"
154+
- "**/*.development*"
155+
- "**/*.integration.*"
156+
- "**/*.Integration.*"
157+
- "**/*.QA.*"
118158
matching:
119159
pattern: "AccountKey=([a-zA-Z0-9/\\+]{86}==)"
120160
examples:
@@ -134,6 +174,10 @@ provider:
134174
const connStr = "DefaultEndpointsProtocol=https;AccountName=testaccountname;AccountKey=4dVw+l0W8My+FwuZ08dWXn+gHxcmBtS7esLAQSrm6/Om3jeyUKKGMkfAh38kWZlItThQYsg31v23A0w/uVP4pg==;EndpointSuffix=core.windows.net";
135175
containsSecret: true
136176
match: 4dVw+l0W8My+FwuZ08dWXn+gHxcmBtS7esLAQSrm6/Om3jeyUKKGMkfAh38kWZlItThQYsg31v23A0w/uVP4pg==
177+
- text: |
178+
const connStr = "DefaultEndpointsProtocol=https;AccountName=testaccountname;AccountKey=4dVw+l0W8My+FwuZ08dWXn+gHxcmBtS7esLAQSrm6/Om3jeyUKKGMkfAh38kWZlItThQYsg31v23A0w/uVP4pg==;EndpointSuffix=core.windows.net";
179+
fileName: azureTest.java
180+
containsSecret: false
137181
- text: |
138182
const connStr = "DefaultEndpointsProtocol=https;AccountName=testaccountname;AccountKey=Eby8vdM02xNOcqFlqUwJPLlmEtlCDXJ1OUzFT50uSRZ6IFsuFq2UVErCz4I6tq/K1SZFPTOtr/KBHBeksoGMGw==";
139183
const connStr = "DefaultEndpointsProtocol=https;AccountName=testaccountname;AccountKey=C2y6yDjf5/R+ob0N8A7Cgv30VRDJIWEHLM+4QDU5DE2nQ9nDuVTqobD4b8mGGyPMbIZnqyMsEcaGQy67XIw/Jw==";
@@ -149,6 +193,19 @@ provider:
149193
include:
150194
content:
151195
- "Subscription"
196+
reject:
197+
paths:
198+
- "**/test/**"
199+
- "**/tests/**"
200+
- "**/Test/**"
201+
- "**/Tests/**"
202+
- "**/*Test*"
203+
- "**/*test*"
204+
- "**/*.Development*"
205+
- "**/*.development*"
206+
- "**/*.integration.*"
207+
- "**/*.Integration.*"
208+
- "**/*.QA.*"
152209

153210
matching:
154211
# While pretty generic, looking for this pattern in the wild lands a majority of actual Azure keys.
@@ -199,6 +256,19 @@ provider:
199256
include:
200257
content:
201258
- "microsoft.com"
259+
reject:
260+
paths:
261+
- "**/test/**"
262+
- "**/tests/**"
263+
- "**/Test/**"
264+
- "**/Tests/**"
265+
- "**/*Test*"
266+
- "**/*test*"
267+
- "**/*.Development*"
268+
- "**/*.development*"
269+
- "**/*.integration.*"
270+
- "**/*.Integration.*"
271+
- "**/*.QA.*"
202272
matching:
203273
# Matches a 32 chars hexadecimal string located at most 3 lines under a microsoft API URL.
204274
pattern: "(?is)api\\.[a-z0-9.]*microsoft.com(?:[^\\r\\n]*+\\r?\\n){1,3}?(?:[^\\r\\n]*)(?:secret|key).{1,15}\\b([a-f0-9]{32})\\b"
@@ -221,6 +291,19 @@ provider:
221291
include:
222292
content:
223293
- "microsoft.com"
294+
reject:
295+
paths:
296+
- "**/test/**"
297+
- "**/tests/**"
298+
- "**/Test/**"
299+
- "**/Tests/**"
300+
- "**/*Test*"
301+
- "**/*test*"
302+
- "**/*.Development*"
303+
- "**/*.development*"
304+
- "**/*.integration.*"
305+
- "**/*.Integration.*"
306+
- "**/*.QA.*"
224307
matching:
225308
# Matches a 32 chars hexadecimal string located at most 3 lines above a microsoft API URL.
226309
pattern: "(?is)(?:secret|key).{1,15}\\b([a-f0-9]{32})\\b(?:[^\\r\\n]*+\\r?\n){1,3}?(?:[^\\r\\n]*)api\\.[a-z0-9.]*microsoft.com"

‎sonar-text-plugin/src/main/resources/org/sonar/plugins/secrets/configuration/firebase.yaml

Lines changed: 18 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -5,6 +5,19 @@ provider:
55
message: Make sure this FCM key gets revoked, changed, and removed from the code.
66
detection:
77
pre:
8+
reject:
9+
paths:
10+
- "**/test/**"
11+
- "**/tests/**"
12+
- "**/Test/**"
13+
- "**/Tests/**"
14+
- "**/*Test*"
15+
- "**/*test*"
16+
- "**/*.Development*"
17+
- "**/*.development*"
18+
- "**/*.integration.*"
19+
- "**/*.Integration.*"
20+
- "**/*.QA.*"
821
include:
922
content:
1023
- firebase
@@ -26,6 +39,11 @@ provider:
2639
props.set("fcm_key", "cfUDlZL9YBQ:APA91bJxU9oMf3RbiyqnmUO60KU_JLawjf2yrTfSs3_ZAp3dxZS0J88G5P5AoKWoviAdUK5i-2SB7iHcb4Wd38EMsZXBAAb6GZMaSOeKfaI0DuLxAFTOgGNKRSmj2R9gIQyzpjoThmqe")
2740
containsSecret: true
2841
match: "cfUDlZL9YBQ:APA91bJxU9oMf3RbiyqnmUO60KU_JLawjf2yrTfSs3_ZAp3dxZS0J88G5P5AoKWoviAdUK5i-2SB7iHcb4Wd38EMsZXBAAb6GZMaSOeKfaI0DuLxAFTOgGNKRSmj2R9gIQyzpjoThmqe"
42+
- text: |
43+
# Noncompliant code example
44+
props.set("fcm_key", "cfUDlZL9YBQ:APA91bJxU9oMf3RbiyqnmUO60KU_JLawjf2yrTfSs3_ZAp3dxZS0J88G5P5AoKWoviAdUK5i-2SB7iHcb4Wd38EMsZXBAAb6GZMaSOeKfaI0DuLxAFTOgGNKRSmj2R9gIQyzpjoThmqe")
45+
containsSecret: false
46+
fileName: firebaseTest.java
2947
- text: |
3048
# Compliant solution
3149
props.set("fcm_key", System.getenv("FCM_KEY"))

‎sonar-text-plugin/src/main/resources/org/sonar/plugins/secrets/configuration/mongodb.yaml

Lines changed: 56 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -3,7 +3,21 @@ provider:
33
name: MongoDB
44
category: Data storage
55
message: Make sure this MongoDB database password gets changed and removed from the code.
6-
6+
detection:
7+
pre:
8+
reject:
9+
paths:
10+
- "**/test/**"
11+
- "**/tests/**"
12+
- "**/Test/**"
13+
- "**/Tests/**"
14+
- "**/*Test*"
15+
- "**/*test*"
16+
- "**/*.Development*"
17+
- "**/*.development*"
18+
- "**/*.integration.*"
19+
- "**/*.Integration.*"
20+
- "**/*.QA.*"
721
rules:
822
- id: mongo-url
923
rspecKey: S6694
@@ -15,6 +29,19 @@ provider:
1529
content:
1630
- mongo
1731
- mongodb
32+
reject:
33+
paths:
34+
- "**/test/**"
35+
- "**/tests/**"
36+
- "**/Test/**"
37+
- "**/Tests/**"
38+
- "**/*Test*"
39+
- "**/*test*"
40+
- "**/*.Development*"
41+
- "**/*.development*"
42+
- "**/*.integration.*"
43+
- "**/*.Integration.*"
44+
- "**/*.QA.*"
1845
matching:
1946
# Look for URIs in the format "protocol://username:password@server:port/..."
2047
# The protocol is "mongo" or "mongodb" but can also be followed by a subprotocol, e.g. "mongodb+srv".
@@ -101,6 +128,18 @@ provider:
101128
- .html
102129
- .example
103130
- .template
131+
paths:
132+
- "**/test/**"
133+
- "**/tests/**"
134+
- "**/Test/**"
135+
- "**/Tests/**"
136+
- "**/*Test*"
137+
- "**/*test*"
138+
- "**/*.Development*"
139+
- "**/*.development*"
140+
- "**/*.integration.*"
141+
- "**/*.Integration.*"
142+
- "**/*.QA.*"
104143
matching:
105144
pattern: "\\bmongo(?:dump|import|restore|sh)?(?=[ \\t]).{0,100}[ \\t](?:-p|--password)[ \\t]+([^\"'\\s]{3,})"
106145
post:
@@ -146,6 +185,18 @@ provider:
146185
- .html
147186
- .example
148187
- .template
188+
paths:
189+
- "**/test/**"
190+
- "**/tests/**"
191+
- "**/Test/**"
192+
- "**/Tests/**"
193+
- "**/*Test*"
194+
- "**/*test*"
195+
- "**/*.Development*"
196+
- "**/*.development*"
197+
- "**/*.integration.*"
198+
- "**/*.Integration.*"
199+
- "**/*.QA.*"
149200
matching:
150201
pattern: "\\bmongo(?:dump|import|restore|sh)?(?=[ \\t]).{0,100}[ \\t](?:-p|--password)[ \\t]+(?:\\\\?[\"'])([^\\r\\n\"']{3,})(?:\\\\?[\"'])"
151202
post:
@@ -172,6 +223,10 @@ provider:
172223
mongo --host "localhost" --username "root" --password "P@ssw0rd"
173224
containsSecret: true
174225
match: P@ssw0rd
226+
- text: |
227+
mongo --host "localhost" --username "root" --password "P@ssw0rd"
228+
containsSecret: false
229+
fileName: mongoTest.java
175230
- text: |
176231
mongo --host "localhost" --username "root" --password "..."
177232
containsSecret: false

0 commit comments

Comments
 (0)