gitleaks icon indicating copy to clipboard operation
gitleaks copied to clipboard

AllowList entire line checking

Open AnthonyPoschen opened this issue 3 years ago • 0 comments

Is your feature request related to a problem? Please describe. when trying to whitelist / allow certain matches i would like to define regex's to be allowed that check the entire line and not just the match / secret to allow removal of false positives and would be the feature request from the outcome of #882

Describe the solution you'd like a way to have detector.config.allowlist.Regexes to scan the entire line for matches and not just the secret.

Describe alternatives you've considered whitelisting file paths but that can hide true positives

Additional context a use case i hit when scanning code within the company where i saw thousands of false positives when people were using vlocity https://github.com/vlocityinc/vlocity_build

the matches looked like the following within a json file

        "%vlocity_namespace%__GlobalKey__c": "58df4b82-a72c-2851-aacd-0a28e1b3e481",

i initially pressumed the regex section would be doing full lines and had to dig into the source code to realise it only compares the match, as i wanted to add the following rule ( as i am using this library directly i was writing it in go )

	AllowVelocityRegexp = regexp.MustCompile("^\\s*\\\"\\%vlocity_namespace\\%__GlobalKey__c\\\"\\:\\s*\\\".*\"\\s*,?\\s*$")

cc @zricethezav

AnthonyPoschen avatar Jul 05 '22 02:07 AnthonyPoschen