Support negative lookahead assertions

[mtcolman]

Description

Apologies if this should be raised somewhere else - happy to move it if required.

I've tried creating a config file with the following regex within it:

\b.*?(?i:password|pass|pwd|secret)\b['"]?\s*[=:]?\s?['"]?(?!.*null)[\w!@#$%^&.*()-+=<>?\/\\]{1,}['"]?

I am trying to perform a negative lookahead assertion (?!.*null) so that:

String certificatePassword = "abc123def"; # would be a finding
String certificatePassword = null; # won't be a finding

However when I've tried using it in the config yaml I get this message:

trufflehog --config /config/trufflehog-rules.yaml filesystem /input/file.txt

2023-08-16T14:07:12Z    error   trufflehog      error parsing the provided configuration file   {"error": "regex 'adjective': error parsing regexp: invalid or unsupported Perl syntax: `(?!`"}

This is the yaml file:

cat /config/trufflehog-rules.yaml
# config.yaml
detectors:
- name: password detector
  keywords:
    - password
  regex:
    adjective: "\\b.*(?i:password|pass|pwd|secret)\\b[\'\"]?\\s*[=:]?\\s*[\'\"]?(?!.*null)[\\w!@#$%^&.*()-+=<>?/\\\\]{4,}[\'\"]?"

Without the code for negative lookahead, trufflehog will perform a scan without error (however it will report both lines as findings)

Preferred Solution

I would like to be able to include negative lookahead assertions in the regex I supply.

Additional Context

I believe the regex to be syntactically correct, as I have tested it on regex101:

Thanks!

[mtcolman]

Just found this: https://github.com/google/re2/wiki/Syntax and wondering if this is not possible.

[zricethezav]

Hi @mtcolman, negative lookahead isn't supported by the default golang regexp package which is what we use for detection. We do have a WIP branch exploring using a different regex library. I'll leave this issue open for further discussion as this is something we could introduce since there are a few libraries that do support negative lookahead assertions.

[calto001]

I would love to have this ability added too.

[TrueBurn]

go-re2 still does not support negative lookahead assertion. Best work around I can find is:

https://regex101.com/library/7lMqca