mirror of
https://github.com/awatertrevi/infisical.git
synced 2026-09-22 13:39:35 +00:00
115 lines
3.6 KiB
Go
115 lines
3.6 KiB
Go
// MIT License
|
|
|
|
// Copyright (c) 2019 Zachary Rice
|
|
|
|
// Permission is hereby granted, free of charge, to any person obtaining a copy
|
|
// of this software and associated documentation files (the "Software"), to deal
|
|
// in the Software without restriction, including without limitation the rights
|
|
// to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
|
|
// copies of the Software, and to permit persons to whom the Software is
|
|
// furnished to do so, subject to the following conditions:
|
|
|
|
// The above copyright notice and this permission notice shall be included in all
|
|
// copies or substantial portions of the Software.
|
|
|
|
// THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
|
|
// IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
|
|
// FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
|
|
// AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
|
|
// LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
|
|
// OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
|
|
// SOFTWARE.
|
|
|
|
package config
|
|
|
|
import (
|
|
"fmt"
|
|
"strings"
|
|
|
|
"github.com/Infisical/infisical-merge/detect/regexp"
|
|
)
|
|
|
|
// Rules contain information that define details on how to detect secrets
|
|
type Rule struct {
|
|
// RuleID is a unique identifier for this rule
|
|
RuleID string
|
|
|
|
// Description is the description of the rule.
|
|
Description string
|
|
|
|
// Entropy is a float representing the minimum shannon
|
|
// entropy a regex group must have to be considered a secret.
|
|
Entropy float64
|
|
|
|
// SecretGroup is an int used to extract secret from regex
|
|
// match and used as the group that will have its entropy
|
|
// checked if `entropy` is set.
|
|
SecretGroup int
|
|
|
|
// Regex is a golang regular expression used to detect secrets.
|
|
Regex *regexp.Regexp
|
|
|
|
// Path is a golang regular expression used to
|
|
// filter secrets by path
|
|
Path *regexp.Regexp
|
|
|
|
// Tags is an array of strings used for metadata
|
|
// and reporting purposes.
|
|
Tags []string
|
|
|
|
// Keywords are used for pre-regex check filtering. Rules that contain
|
|
// keywords will perform a quick string compare check to make sure the
|
|
// keyword(s) are in the content being scanned.
|
|
Keywords []string
|
|
|
|
// Allowlists allows a rule to be ignored for specific commits, paths, regexes, and/or stopwords.
|
|
Allowlists []*Allowlist
|
|
|
|
// validated is an internal flag to track whether `Validate()` has been called.
|
|
validated bool
|
|
}
|
|
|
|
// Validate guards against common misconfigurations.
|
|
func (r *Rule) Validate() error {
|
|
if r.validated {
|
|
return nil
|
|
}
|
|
|
|
// Ensure |id| is present.
|
|
if strings.TrimSpace(r.RuleID) == "" {
|
|
// Try to provide helpful context, since |id| is empty.
|
|
var context string
|
|
if r.Regex != nil {
|
|
context = ", regex: " + r.Regex.String()
|
|
} else if r.Path != nil {
|
|
context = ", path: " + r.Path.String()
|
|
} else if r.Description != "" {
|
|
context = ", description: " + r.Description
|
|
}
|
|
return fmt.Errorf("rule |id| is missing or empty" + context)
|
|
}
|
|
|
|
// Ensure the rule actually matches something.
|
|
if r.Regex == nil && r.Path == nil {
|
|
return fmt.Errorf("%s: both |regex| and |path| are empty, this rule will have no effect", r.RuleID)
|
|
}
|
|
|
|
// Ensure |secretGroup| works.
|
|
if r.Regex != nil && r.SecretGroup > r.Regex.NumSubexp() {
|
|
return fmt.Errorf("%s: invalid regex secret group %d, max regex secret group %d", r.RuleID, r.SecretGroup, r.Regex.NumSubexp())
|
|
}
|
|
|
|
for _, allowlist := range r.Allowlists {
|
|
// This will probably never happen.
|
|
if allowlist == nil {
|
|
continue
|
|
}
|
|
if err := allowlist.Validate(); err != nil {
|
|
return fmt.Errorf("%s: %w", r.RuleID, err)
|
|
}
|
|
}
|
|
|
|
r.validated = true
|
|
return nil
|
|
}
|