8000 feat(config): disable extended rule (#1535) · gitleaks/gitleaks@0e5f644 · GitHub
[go: up one dir, main page]
Skip to content

Commit 0e5f644

Browse files
rgmzrgmz
authored
feat(config): disable extended rule (#1535)
1 parent f320a60 commit 0e5f644

File tree

5 files changed

+82
-15
lines changed

5 files changed

+82
-15
lines changed

‎README.md‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -235,6 +235,8 @@ useDefault = true
235235
# or you can supply a path to a configuration. Path is relative to where gitleaks
236236
# was invoked, not the location of the base config.
237237
path = "common_config.toml"
238+
# If there are any rules you don't want to inherit, they can be specified here.
239+
disabledRules = [ "generic-api-key"]
238240

239241
# An array of tables that contain information that define instructions
240242
# on how to detect secrets

‎config/config.go‎

Lines changed: 33 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -77,9 +77,10 @@ type Config struct {
7777
// Extend is a struct that allows users to define how they want their
7878
// configuration extended by other configuration files.
7979
type Extend struct {
80-
Path string
81-
URL string
82-
UseDefault bool
80+
Path string
81+
URL string
82+
UseDefault bool
83+
DisabledRules []string
8384
}
8485

8586
func (vc *ViperConfig) Translate() (Config, error) {
@@ -216,7 +217,7 @@ func (vc *ViperConfig) Translate() (Config, error) {
216217

217218
// Validate the rules after everything has been assembled (including extended configs).
218219
if extendDepth == 0 {
219-
for _, rule := range rulesMap {
220+
for _, rule := range c.Rules {
220221
if err := rule.Validate(); err != nil {
221222
return Config{}, err
222223
}
@@ -284,7 +285,35 @@ func (c *Config) extendURL() {
284285
}
285286

286287
func (c *Config) extend(extensionConfig Config) {
288+
// Get config name for helpful log messages.
289+
var configName string
290+
if c.Extend.Path != "" {
291+
configName = c.Extend.Path
292+
} else {
293+
configName = "default"
294+
}
295+
// Convert |Config.DisabledRules| into a map for ease of access.
296+
disabledRuleIDs := map[string]struct{}{}
297+
for _, id := range c.Extend.DisabledRules {
298+
if _, ok := extensionConfig.Rules[id]; !ok {
299+
log.Warn().
300+
Str("rule-id", id).
301+
Str("config", configName).
302+
Msg("Disabled rule doesn't exist in extended config.")
303+
}
304+
disabledRuleIDs[id] = struct{}{}
305+
}
306+
287307
for ruleID, baseRule := range extensionConfig.Rules {
308+
// Skip the rule.
309+
if _, ok := disabledRuleIDs[ruleID]; ok {
310+
log.Debug().
311+
Str("rule-id", ruleID).
312+
Str("config", configName).
313+
Msg("Ignoring rule from extended config.")
314+
continue
315+
}
316+
288317
currentRule, ok := c.Rules[ruleID]
289318
if !ok {
290319
// Rule doesn't exist, add it to the config.

‎config/config_test.go‎

Lines changed: 25 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -39,8 +39,7 @@ func TestTranslate(t *testing.T) {
3939
Regexes: []*regexp.Regexp{regexp.MustCompile("123")},
4040
},
4141
},
42-
},
43-
},
42+
}},
4443
},
4544
},
4645
{
@@ -73,8 +72,7 @@ func TestTranslate(t *testing.T) {
7372
Regexes: []*regexp.Regexp{regexp.MustCompile("AKIALALEMEL33243OLIA")},
7473
},
7574
},
76-
},
77-
},
75+
}},
7876
},
7977
},
8078
{
@@ -92,8 +90,7 @@ func TestTranslate(t *testing.T) {
9290
Commits: []string{"allowthiscommit"},
9391
},
9492
},
95-
},
96-
},
93+
}},
9794
},
9895
},
9996
{
@@ -111,8 +108,7 @@ func TestTranslate(t *testing.T) {
111108
Paths: []*regexp.Regexp{regexp.MustCompile(".go")},
112109
},
113110
},
114-
},
115-
},
111+
}},
116112
},
117113
},
118114
{
@@ -122,12 +118,11 @@ func TestTranslate(t *testing.T) {
122118
RuleID: "discord-api-key",
123119
Description: "Discord API key",
124120
Regex: regexp.MustCompile(`(?i)(discord[a-z0-9_ .\-,]{0,25})(=|>|:=|\|\|:|<=|=>|:).{0,5}['\"]([a-h0-9]{64})['\"]`),
125-
Keywords: []string{},
126121
Entropy: 3.5,
127122
SecretGroup: 3,
123+
Keywords: []string{},
128124
Tags: []string{},
129-
},
130-
},
125+
}},
131126
},
132127
},
133128
{
@@ -350,6 +345,25 @@ func TestTranslate(t *testing.T) {
350345
},
351346
},
352347
},
348+
{
349+
cfgName: "extend_disabled",
350+
cfg: Config{
351+
Rules: map[string]Rule{
352+
"aws-secret-key": {
353+
RuleID: "aws-secret-key",
354+
Regex: regexp.MustCompile(`(?i)aws_(.{0,20})?=?.[\'\"0-9a-zA-Z\/+]{40}`),
355+
Tags: []string{"key", "AWS"},
356+
Keywords: []string{},
357+
},
358+
"pypi-upload-token": {
359+
RuleID: "pypi-upload-token",
360+
Regex: regexp.MustCompile(`pypi-AgEIcHlwaS5vcmc[A-Za-z0-9\-_]{50,1000}`),
361+
Tags: []string{},
362+
Keywords: []string{},
363+
},
364+
},
365+
},
366+
},
353367
}
354368

355369
for _, tt := range tests {

‎testdata/config/extend_disabled.toml‎

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,11 @@
1+
title = "gitleaks extend disable"
2+
3+
[extend]
4+
path = "../testdata/config/extend_disabled_base.toml"
5+
disabledRules = [
6+
'custom-rule1'
7+
]
8+
9+
[[rules]]
10+
id = "pypi-upload-token"
11+
regex = '''pypi-AgEIcHlwaS5vcmc[A-Za-z0-9\-_]{50,1000}'''

‎testdata/config/extend_disabled_base.toml‎

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,11 @@
1+
title = "gitleaks extended 3"
2+
3+
4+
[[rules]]
5+
id = "aws-secret-key"
6+
regex = '''(?i)aws_(.{0,20})?=?.[\'\"0-9a-zA-Z\/+]{40}'''
7+
tags = ["key", "AWS"]
8+
9+
[[rules]]
10+
id = "custom-rule1"
11+
regex = '''[Cc]ustom!'''

0 commit comments

Comments
 (0)
0