Module: RailVerdict::Intelligence::SecretDetector

Defined in:
lib/rail_verdict/intelligence/secret_detector.rb

Constant Summary collapse

FILENAME_PATTERNS = 
[
  /\.env(\.|$)/,
  /master\.key$/,
  /credentials.*\.key$/,
  /\.pem$/,
  /\.key$/,
  /id_rsa/,
  /\.p12$/,
  %r{(^|/)tmp/},
  %r{(^|/)log/.*\.log$}
].freeze
CONTENT_PATTERNS = 
[
  /AKIA[0-9A-Z]{16}/,
  /BEGIN (?:RSA |EC |OPENSSH )?PRIVATE KEY/,
  /(?:api[_-]?key|secret|token|password)\s*[:=]\s*['"]?[^'"\s]{8,}/i,
  /gh[pousr]_[A-Za-z0-9_]{20,}/,
  /eyJ[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}/,
  /[A-Za-z0-9_\-]{32,}/
].freeze

Class Method Summary collapse

Class Method Details

.content_secret?(text) ⇒ Boolean

Returns:

  • (Boolean) 


32
33
34
35
 
# File 'lib/rail_verdict/intelligence/secret_detector.rb', line 32

def self.content_secret?(text)
  t = text.to_s
  CONTENT_PATTERNS.any? { |re| t.match?(re) }
end

.filename_secret?(path) ⇒ Boolean

Returns:

  • (Boolean) 


27
28
29
30
 
# File 'lib/rail_verdict/intelligence/secret_detector.rb', line 27

def self.filename_secret?(path)
  p = path.to_s
  FILENAME_PATTERNS.any? { |re| p.match?(re) }
end

.probable_secret?(path: nil, content: nil) ⇒ Boolean

Returns:

  • (Boolean) 


37
38
39
40
41
42
 
# File 'lib/rail_verdict/intelligence/secret_detector.rb', line 37

def self.probable_secret?(path: nil, content: nil)
  return true if path && filename_secret?(path)
  return true if content && content_secret?(content)

  false
end