azure_storage_key_test.py

import pytest

from detect_secrets.plugins.azure_storage_key import AzureStorageKeyDetector


class TestAzureStorageKeyDetector:

    @pytest.mark.parametrize(
        'payload, should_flag',
        [
            (
                'AccountKey=lJzRc1YdHaAA2KCNJJ1tkYwF/+mKK6Ygw0NGe170Xu592euJv2wYUtBlV8z+qnlcNQSnIYVTkLWntUO1F8j8rQ==',  # noqa: E501
                True,
            ),
            (
                'AccountKey="lJzRc1YdHaAA2KCNJJ1tkYwF/+mKK6Ygw0NGe170Xu592euJv2wYUtBlV8z+qnlcNQSnIYVTkLWntUO1F8j8rQ=="',  # noqa: E501
                True,
            ),
            (
                "AccountKey='lJzRc1YdHaAA2KCNJJ1tkYwF/+mKK6Ygw0NGe170Xu592euJv2wYUtBlV8z+qnlcNQSnIYVTkLWntUO1F8j8rQ=='",  # noqa: E501
                True,
            ),
            (
                'lJzRc1YdHaAA2KCNJJ1tkYwF/+mKK6Ygw0NGe170Xu592euJv2wYUtBlV8z+qnlcNQSnIYVTkLWntUO1F8j8rQ==',  # noqa: E501
                False,
            ),
            (
                'learS3Bucket',
                False,
            ),
            (
                'anupRole',
                False,
            ),
            (
                'cret',
                False,
            ),

            # Test skip only public keys
            (
                'PublicKey: lJzRc1YdHaAA2KCNJJ1tkYwF/+mKK6Ygw0NGe170Xu592euJv2wYUtBlV8z+qnlcNQSnIYVTkLWntUO1F8j8rQ==',
                False,
            ),
            (
                'PublicKey: ssh-rsa lJzRc1YdHaAA2KCNJJ1tkYwF/+mKK6Ygw0NGe170Xu592euJv2wYUtBlV8z+qnlcNQSnIYVTkLWntUO1F8j8rQ==',
                False,
            ),
            (
                'SshPublicKey: ssh-rsa lJzRc1YdHaAA2KCNJJ1tkYwF/+mKK6Ygw0NGe170Xu592euJv2wYUtBlV8z+qnlcNQSnIYVTkLWntUO1F8j8rQ==',
                False,
            ),
            (
                'PublicKeys: lJzRc1YdHaAA2KCNJJ1tkYwF/+mKK6Ygw0NGe170Xu592euJv2wYUtBlV8z+qnlcNQSnIYVTkLWntUO1F8j8rQ==',
                False,
            ),
            (
                'SshPublicKeys: lJzRc1YdHaAA2KCNJJ1tkYwF/+mKK6Ygw0NGe170Xu592euJv2wYUtBlV8z+qnlcNQSnIYVTkLWntUO1F8j8rQ==',
                False,
            ),
            (
                '(https://portal.azure.com/). +CREATE DATABASE SCOPED CREDENTIAL AzureStorageCredential +WITH IDENTITY = \'IDENTITY\', lJzRc1YdHaAA2KCNJJ1tkYwF/+mKK6Ygw0NGe170Xu592euJv2wYUtBlV8z+qnlcNQSnIYVTkLWntUO1F8j8rQ==',
                True,
            ),

            # Test multilines

            # azure is mentioned within the 1 line above
            (
                """(https://portal.azure.com/). +CREATE DATABASE SCOPED CREDENTIAL AzureStorageCredential +WITH IDENTITY = 'IDENTITY',
                lJzRc1YdHaAA2KCNJJ1tkYwF/+mKK6Ygw0NGe170Xu592euJv2wYUtBlV8z+qnlcNQSnIYVTkLWntUO1F8j8rQ==""",
                True,
            ),
            # azure is mentioned within the 2 lines above
            (
                """(https://portal.azure.com/). +CREATE DATABASE SCOPED CREDENTIAL AzureStorageCredential +WITH IDENTITY = 'IDENTITY',
                some data here
                lJzRc1YdHaAA2KCNJJ1tkYwF/+mKK6Ygw0NGe170Xu592euJv2wYUtBlV8z+qnlcNQSnIYVTkLWntUO1F8j8rQ==""",
                True,
            ),
            # azure is mentioned within the 2 lines above
            (
                """(https://portal.azure.com/). +CREATE DATABASE SCOPED CREDENTIAL AzureStorageCredential +WITH IDENTITY = 'IDENTITY',

                lJzRc1YdHaAA2KCNJJ1tkYwF/+mKK6Ygw0NGe170Xu592euJv2wYUtBlV8z+qnlcNQSnIYVTkLWntUO1F8j8rQ==""",
                True,
            ),
            # azure is mentioned within the 3 lines above
            (
                """(https://portal.azure.com/). +CREATE DATABASE SCOPED CREDENTIAL AzureStorageCredential +WITH IDENTITY = 'IDENTITY',
                some data 1
                some data 2
                lJzRc1YdHaAA2KCNJJ1tkYwF/+mKK6Ygw0NGe170Xu592euJv2wYUtBlV8z+qnlcNQSnIYVTkLWntUO1F8j8rQ==""",
                False,
            ),
            # azure lowercase
            (
                """azure.com +WITH IDENTITY = 'IDENTITY',
                lJzRc1YdHaAA2KCNJJ1tkYwF/+mKK6Ygw0NGe170Xu592euJv2wYUtBlV8z+qnlcNQSnIYVTkLWntUO1F8j8rQ==""",
                True,
            ),
            # azure uppercase
            (
                """AZURE.com +WITH IDENTITY = 'IDENTITY',
                lJzRc1YdHaAA2KCNJJ1tkYwF/+mKK6Ygw0NGe170Xu592euJv2wYUtBlV8z+qnlcNQSnIYVTkLWntUO1F8j8rQ==""",
                True,
            ),
            # azure capitalize
            (
                """Azure.com +WITH IDENTITY = 'IDENTITY',
                lJzRc1YdHaAA2KCNJJ1tkYwF/+mKK6Ygw0NGe170Xu592euJv2wYUtBlV8z+qnlcNQSnIYVTkLWntUO1F8j8rQ==""",
                True,
            ),
            # no azure mention
            (
                """
                nomention.com +WITH IDENTITY = 'IDENTITY'
                lJzRc1YdHaAA2KCNJJ1tkYwF/+mKK6Ygw0NGe170Xu592euJv2wYUtBlV8z+qnlcNQSnIYVTkLWntUO1F8j8rQ==
                """,
                False,
            ),
            # azure is mentioned within the 1 line below
            (
                """lJzRc1YdHaAA2KCNJJ1tkYwF/+mKK6Ygw0NGe170Xu592euJv2wYUtBlV8z+qnlcNQSnIYVTkLWntUO1F8j8rQ==
                (https://portal.azure.com/). +CREATE DATABASE SCOPED CREDENTIAL AzureStorageCredential +WITH IDENTITY = 'IDENTITY'
                """,
                True,
            ),
            # azure is mentioned within the 2 lines below
            (
                """
                lJzRc1YdHaAA2KCNJJ1tkYwF/+mKK6Ygw0NGe170Xu592euJv2wYUtBlV8z+qnlcNQSnIYVTkLWntUO1F8j8rQ==
                some data 1
                (https://portal.azure.com/). +CREATE DATABASE SCOPED CREDENTIAL AzureStorageCredential +WITH IDENTITY = 'IDENTITY'
                """,
                True,
            ),
            # azure is mentioned within the 3 lines below
            (
                """
                lJzRc1YdHaAA2KCNJJ1tkYwF/+mKK6Ygw0NGe170Xu592euJv2wYUtBlV8z+qnlcNQSnIYVTkLWntUO1F8j8rQ==
                some data 1
                some data 2
                (https://portal.azure.com/). +CREATE DATABASE SCOPED CREDENTIAL AzureStorageCredential +WITH IDENTITY = 'IDENTITY'
                """,
                False,
            ),
            # azure lowercase
            (
                """
                lJzRc1YdHaAA2KCNJJ1tkYwF/+mKK6Ygw0NGe170Xu592euJv2wYUtBlV8z+qnlcNQSnIYVTkLWntUO1F8j8rQ==
                azure.com +WITH IDENTITY = 'IDENTITY',
                """,
                True,
            ),
            # azure uppercase
            (
                """
                lJzRc1YdHaAA2KCNJJ1tkYwF/+mKK6Ygw0NGe170Xu592euJv2wYUtBlV8z+qnlcNQSnIYVTkLWntUO1F8j8rQ==
                AZURE.com +WITH IDENTITY = 'IDENTITY'""",
                True,
            ),
            # azure capitalize
            (
                """
                lJzRc1YdHaAA2KCNJJ1tkYwF/+mKK6Ygw0NGe170Xu592euJv2wYUtBlV8z+qnlcNQSnIYVTkLWntUO1F8j8rQ==
                Azure.com +WITH IDENTITY = 'IDENTITY'
                """,
                True,
            ),
            # no azure mention
            (
                """
                lJzRc1YdHaAA2KCNJJ1tkYwF/+mKK6Ygw0NGe170Xu592euJv2wYUtBlV8z+qnlcNQSnIYVTkLWntUO1F8j8rQ==
                nomention.com +WITH IDENTITY = 'IDENTITY'
                """,
                False,
            ),
            (
                """SshPublicKeys:
                - lJzRc1YdHaAA2KCNJJ1tkYwF/+mKK6Ygw0NGe170Xu592euJv2wYUtBlV8z+qnlcNQSnIYVTkLWntUO1F8j8rQ==""",
                False,
            ),
            (
                """SshPublicKeys:
                - >-
                lJzRc1YdHaAA2KCNJJ1tkYwF/+mKK6Ygw0NGe170Xu592euJv2wYUtBlV8z+qnlcNQSnIYVTkLWntUO1F8j8rQ==""",
                False,
            ),
            (
                """
                resolution: {integrity: sha512-/AazAV/F+HK4LIywF9C+NYHcJo038zEnWkteilcxC1FM/uK/4NVGDKGrxx7nNq1ybspAroRKT4I1FHfxQzxkUw==}
                engines: {node: '>=12.0.0'}
                peerDependencies:
                    '@azure/identity': '*'
                    '@azure/msal-browser': '*'
                    buffer: '*'
                    stream-browserify: '*'
                """,
                False,
            ),
            (
                    """
                    "Microsoft.AspNetCore.AzureAppServices.HostingStartup/2.0.1": {
                        "sha512": "hdneJMBdHdrlMc/NYaNS8GFWlR/3tN7TsV/jOSBuc61+gWULwu45t+I7g5IF/iCHWI9PLMLNP5VOj+d1Tv1zUA=="
                    }
                    """,
                    False,
            ),
            (
                    """
                    "Microsoft.AspNetCore.AzureAppServicesIntegration/2.0": {
                        "sha512": "r2JMiK8RB2mHGKWIc+NVViT++2ZxCAGJBbLtptINB32F/c3DrNEtKWVNs2MEldEb822llBjrRmsJ7cScCW+P7g=="
                    }
                    """,
                    False,
            ),
            # Flexible account key variable names
            (
                'STORAGE_ACCOUNT_K=X1y2Z3w4V5u6T7s8R9q0P1o2N3m4L5k6J7h8G9f0E1d2C3b4A5B6C7D8E9F0G1H2I3J4K5L6M7N8O9P0Q1R2S3==',  # noqa: E501
                True,
            ),
            (
                    'CosmosKey=lJzRc1YdHaAA2KCNJJ1tkYwF/+mKK6Ygw0NGe170Xu592euJv2wYUtBlV8z+qnlcNQSnIYVTkLWntUO1F8j8rQ==',
                    False,
            ),
            (
                    """
                    cosmos = lJzRc1YdHaAA2KCNJJ1tkYwF/+mKK6Ygw0NGe170Xu592euJv2wYUtBlV8z+qnlcNQSnIYVTkLWntUO1F8j8rQ==
                    Azure.com +WITH IDENTITY = 'IDENTITY'
                    """,
                    False,
            ),
            (
                    """
                    settings = {
                        'host': os.environ.get('ACCOUNT_HOST', 'https://cosmosdb-account-r4b3whg3f2qw4.documents.azure.com:443/'),
                        'master_key': os.environ.get('ACCOUNT_KEY', 'H0maE9FWji2oHBsj9tuj5FREJRQGXRTIAJ3fA3CS46IGK3UcjeKy1DCFHNDt4oj4nq4Bh8YYujpuAFDddR5atw=='),
                    }
                    """,
                    False,
            ),
        ],
    )
    def test_analyze(self, payload, should_flag):
        logic = AzureStorageKeyDetector()
        assert bool(logic.analyze_line(filename='mock_filename', line=payload)) == should_flag

    def test_analyze_tfplan_json(self):
        logic = AzureStorageKeyDetector()
        payload = 'AccountKey=lJzRc1YdHaAA2KCNJJ1tkYwF/+mKK6Ygw0NGe170Xu592euJv2wYUtBlV8z+qnlcNQSnIYVTkLWntUO1F8j8rQ=='
        # Flag if not planfile, don't if it is
        assert logic.analyze_line(filename='mock_filename', line=payload)
        assert not logic.analyze_line(filename='tfplan.json', line=payload)