IBM / detect-secrets

An enterprise friendly way of detecting and preventing secrets in code.
Apache License 2.0
73 stars 45 forks source link

detect-secrets does not detect secrets that are base64 encoded #155

Open leotizzei opened 2 months ago

leotizzei commented 2 months ago

Describe the bug detect-secrets tool does not detect secrets that are base64 encoded

To Reproduce Steps to reproduce the behavior:

  1. create a simple module

def main(): print("Hello world")

if name == "main": main()

2. create a json file that contains cloud object storage secrets:
```json
{"my-bucket-name": {"access-key-id": "my-access-key", "secret-access-key": "my-secret"} }
  1. encode it with base64:
    base64 -i /path/to/json/file
  2. Assign the encoded credentials to a variable
    
    def main():
    s = "e215LWJ1Y2tldC1uYW1lOiB7YWNjZXNzLWtleS1pZDogbXktYWNjZXNzLWtleSwgc2VjcmV0LWFjY2Vzcy1rZXk6IG15LXNlY3JldH0gfQo="
    print(s)

if name == "main": main()

5. add to the repo and commit
```shell
git add hello.py
git commit -am "message"

Expected behavior I expected that detect-secrets tool would detect the hardcoded base64 secret

bigpick commented 3 weeks ago

hmmm, it seems to detect it for me for the example you've given?

detect-secrets --version
0.13.1+ibm.61.dss

Make the file:

cat << EOF > test-secret.py
def main():
    s = "e215LWJ1Y2tldC1uYW1lOiB7YWNjZXNzLWtleS1pZDogbXktYWNjZXNzLWtleSwgc2VjcmV0LWFjY2Vzcy1rZXk6IG15LXNlY3JldH0gfQo="
    print(s)

if __name__ == "__main__":
    main()
EOF

Generate baseline:

detect-secrets --verbose scan --update .secrets.baseline.test  test-secret.py
Checking file: test-secret.py

Caught secret shows up in to-be-audited baseline:

detect-secrets audit .secrets.baseline.test --report

1 potential secrets in .secrets.baseline.test were reviewed. Found 0 live secrets, 1 unaudited secret and 0 secrets that were audited as real.

Failed Condition    Secret Type                 Filename          Line
------------------  --------------------------  --------------  ------
Unaudited           Base64 High Entropy String  test-secret.py       2