Trying to reduce secret scan false positives - #2696
Conversation
| return false | ||
| } | ||
|
|
||
| expectedKeys := []string{"cty", "data", "enc", "iv", "kid"} |
There was a problem hiding this comment.
I think these are all part of the JWE standard -- do we have anything outside of the standard to match against? I am wondering if this would match other items we aren't expecting.
There was a problem hiding this comment.
(i.e., all JWEs can't be false positives, right?)
If JWEs are all false positives, since they are not plaintext, then we can maybe use the standard to detect them. I took a look and there's a library golang-jwt/jwe similar to golang-jwt/jwt that we already use, but I'm not sure it's stable. But looking at the RFC, I think there are two different ways to serialize JWEs (JWE Compact and JWE JSON) and maybe we could use those for stricter detection rules here, to make sure we capture both types?
There was a problem hiding this comment.
Just to answer -- Yes, I think all JWEs are false positives
2 participants
This is a bit if a heavy handed approach to reducing false positives -- it actually parses the file and tosses it. In contrast, the gitleaks developers might suggest being clever with allow regexps. gitleaks/gitleaks#1728