[skip actions] [keyword] 2025-03-16T13:00:48+02:00

Author: babenek

credsweeper/common/keyword_pattern.py

@@ -40,7 +40,7 @@ class KeywordPattern:
             r"|" \
             r"(?(url_esc)[^\s`'\",;\\&]|[^\s`'\",;\\])" \
             r")){3,8000}" \
-            r"|(\{[^}]{3,8000}\})" \
+            r"|(\$?\{[^}]{3,8000}\})" \
             r"|(<[^>]{3,8000}>)" \
             r")"  # <value>
     right_quote = r"(?(value_leftquote)" \

credsweeper/filters/__init__.py

@@ -22,7 +22,6 @@
 from credsweeper.filters.value_entropy_base36_check import ValueEntropyBase36Check
 from credsweeper.filters.value_entropy_base64_check import ValueEntropyBase64Check
 from credsweeper.filters.value_file_path_check import ValueFilePathCheck
-from credsweeper.filters.value_first_word_check import ValueFirstWordCheck
 from credsweeper.filters.value_github_check import ValueGitHubCheck
 from credsweeper.filters.value_grafana_check import ValueGrafanaCheck
 from credsweeper.filters.value_grafana_service_check import ValueGrafanaServiceCheck

credsweeper/filters/group/group.py

@@ -4,7 +4,7 @@
 from credsweeper.common.constants import GroupType
 from credsweeper.config import Config
 from credsweeper.filters import (Filter, LineSpecificKeyCheck, ValueAllowlistCheck, ValueArrayDictionaryCheck,
-                                 ValueBlocklistCheck, ValueCamelCaseCheck, ValueFilePathCheck, ValueFirstWordCheck,
+                                 ValueBlocklistCheck, ValueCamelCaseCheck, ValueFilePathCheck,
                                  ValueLastWordCheck, ValueMethodCheck, ValueNotAllowedPatternCheck, ValuePatternCheck,
                                  ValueSimilarityCheck, ValueStringTypeCheck, ValueTokenCheck, ValueHexNumberCheck)
 
@@ -39,7 +39,6 @@ def get_keyword_base_filters(config: Config) -> List[Filter]:
             ValueBlocklistCheck(),
             ValueCamelCaseCheck(),
             ValueFilePathCheck(),
-            ValueFirstWordCheck(),
             ValueHexNumberCheck(),
             ValueLastWordCheck(),
             ValueMethodCheck(),

credsweeper/filters/group/url_credentials_group.py

@@ -2,7 +2,7 @@
 from credsweeper.config import Config
 from credsweeper.filters import (ValueAllowlistCheck, ValueArrayDictionaryCheck, ValueBlocklistCheck,
                                  ValueCamelCaseCheck, ValueDictionaryValueLengthCheck, ValueFilePathCheck,
-                                 ValueFirstWordCheck, ValueLastWordCheck, ValueMethodCheck, ValueNotAllowedPatternCheck,
+                                  ValueLastWordCheck, ValueMethodCheck, ValueNotAllowedPatternCheck,
                                  ValuePatternCheck, ValueStringTypeCheck, ValueTokenCheck)
 from credsweeper.filters.group import Group
 
@@ -23,7 +23,6 @@ def __init__(self, config: Config) -> None:
             ValueBlocklistCheck(),
             ValueCamelCaseCheck(),
             ValueFilePathCheck(),
-            ValueFirstWordCheck(),
             ValueLastWordCheck(),
             ValueMethodCheck(),
             ValueStringTypeCheck(config),

credsweeper/filters/value_allowlist_check.py

@@ -54,14 +54,11 @@ def run(self, line_data: LineData, target: AnalysisTarget) -> bool:
             True, if need to filter candidate and False if left
 
         """
-
-        if self.ALLOWED_PATTERN.match(line_data.value):
-            return True
-        elif line_data.is_well_quoted_value:
-            if self.ALLOWED_QUOTED_PATTERN.match(line_data.value):
+        if line_data.is_well_quoted_value:
+            if self.ALLOWED_PATTERN.match(line_data.value) or self.ALLOWED_QUOTED_PATTERN.match(line_data.value):
                 return True
         else:
-            if self.ALLOWED_UNQUOTED_PATTERN.match(line_data.value):
+            value = line_data.wrap + line_data.value if line_data.wrap else line_data.value
+            if self.ALLOWED_PATTERN.match(value) or self.ALLOWED_UNQUOTED_PATTERN.match(value):
                 return True
-
         return False

credsweeper/filters/value_first_word_check.py

@@ -890,7 +890,7 @@
   confidence: moderate
   type: keyword
   values:
-    - nonce
+    - (?<!\\)nonce
   filter_type: GeneralKeyword
   use_ml: true
   min_line_len: 13

credsweeper/rules/config.yaml

@@ -4,6 +4,7 @@
 from credsweeper.config import Config
 from credsweeper.credentials import LineData
 from credsweeper.utils import Util
+from tests.filters.conftest import KEYWORD_PASSWORD_PATTERN
 
 
 class TestKeywordPattern:
@@ -143,18 +144,19 @@ def test_separator_p(self, config: Config, file_path: pytest.fixture, line: str)
             ["password=${array[@]:7:2}", "${array[@]:7:2}"],
             ["password=${1#*=}", "${1#*=}"],
             ["A2 ID:master,PW:dipPr10Gg!","dipPr10Gg!"],
+            ["pass=get->pass(arg1='seCreT', arg2='secRet2'...","seCreT"]
         ])
     def test_keyword_pattern_p(self, config: Config, file_path: pytest.fixture, line: str, value: str) -> None:
-        pattern = KeywordPattern.get_keyword_pattern(r"(?<!by)pass(?!ed|ing|es|\s+[a-z]{3,80})|pw(d|\b)")
+
         line_data = LineData(config,
                              line,
                              0,
                              1,
                              file_path,
                              Util.get_extension(file_path),
                              info="dummy",
-                             pattern=pattern)
-        assert line_data.value == value, pattern.pattern
+                             pattern=KEYWORD_PASSWORD_PATTERN)
+        assert line_data.value == value, KEYWORD_PASSWORD_PATTERN.pattern
 
     @pytest.mark.parametrize("line", [
         "https://fonts.googleapis.com/css2?family=Montserrat:wght@500;700;900&family=Roboto:wght@300;400;500;700;900"