Custom secrets not detected in repo #6454
-
QuestionStarted with Gitleaks and was able to get it to detect some fake secrets in a repository containing only two files, I run and then no reports of secrets. It took a bit of fiddling with a YAML linter to get the regexes properly formatted, but they differ from what was working with Gitleaks by only some escape characters and only three of the seven rules needed editing anyway. I have tried disabling the examples allow-rule and scanning the repo as a file system. TargetGit Repository ScannerSecret Output FormatTable ModeStandalone Operating SystemWindows 10 VersionVersion: 0.50.0
Vulnerability DB:
Version: 2
UpdatedAt: 2024-04-03 18:12:10.546555408 +0000 UTC
NextUpdate: 2024-04-04 00:12:10.546554706 +0000 UTC
DownloadedAt: 2024-04-03 21:45:48.6022329 +0000 UTC
Policy Bundle:
Digest: sha256:cdff1bc8c97e4f5cd04782b057c00f5ea8cd81147a506ac4be76bef13710f2d3
DownloadedAt: 2024-03-05 21:48:23.0160194 +0000 UTC |
Beta Was this translation helpful? Give feedback.
Replies: 1 comment 6 replies
-
|
Hi there, what content is in the file? e.g. trivy-secret.yaml? Trivy will look for particular keywords/patterns that suggest there is a secret in the file, it does not understand the naming of the files itself Here is the entire docs on secret scanning https://aquasecurity.github.io/trivy/v0.50/docs/scanner/secret/ |
Beta Was this translation helpful? Give feedback.
-
|
So the only issue I can see why it is not being used is that for secret scanning focused rules, you have to use the following flag |
Beta Was this translation helpful? Give feedback.
-
|
Looks like the config file is loaded properly. |
Beta Was this translation helpful? Give feedback.
-
|
I tried different examples, not sure if my regex was wrong each time but I could not get Trivy to find any of the values in the above secrets file content |
Beta Was this translation helpful? Give feedback.
-
|
Hello @ethoms-usgs I checked your config file.
example: |
Beta Was this translation helpful? Give feedback.
-
|
Thanks so much Anais, Dmitriy! |
Beta Was this translation helpful? Give feedback.
Hello @ethoms-usgs
I checked your config file.
there are some points:
\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}$: To use ^ and $ as symbols of begin and end of line you need to use multi-line mode -(?m).- see https://aquasecurity.github.io/trivy/v0.50/docs/scanner/secret/#configuration'''"?[a-zA-Z]:[^/]\\?\\?(?:[^\\/:*?"<>|\r\n]+?\\?\\)*[^\\/:*?"<>|\r\n]*"?''': remove extra quotes.severity: low: severity should be in upper case ( i created #6500 to fix this).example: