search

auth0 / repo-supervisor

Scan your code for security misconfiguration, search for passwords and secrets. :mag:
MIT License
637 stars 88 forks source link

JSON files not parsed properly when containing nested properties #64

Closed radekk closed 4 years ago

radekk commented 4 years ago

Description

It occurred that some of the JSON values were merged into a single string instead of multiple values. As a result it wasn't properly calculating the entropy level as well as reporting findings back to the user.

Reproduction

SHOULD NOT return all emails and selectors in a single line. Therefore, it should not be detected as secrets, but it is.

node src/cli.js test/fixtures/

[test/fixtures//unit/src/filters/entropy.meter/pre.filters/css.selectors.json]
>> #foo-bar,#foo.bar,#foo_bar,.foo-bar,.foo_bar,.foo.bar,#foo[value='bar'],#foo[value="bar"],#foo[value^='bar'],#foo[value^="bar"],.foo[value='bar'],.foo[value="bar"],.foo[value^='bar'],.foo[value^="bar"],input[value='bar'],input[value="bar"],button[value^='bar'],button[value^="bar"],[value='bar'],[value="bar"],[value^='bar'],[value^="bar"],foo>bar,#foo>bar,#foo>.bar,#foo>#bar,.foo>bar,.foo>#bar,.foo>.bar

[test/fixtures//unit/src/filters/entropy.meter/pre.filters/email.addresses.json]
>> john.doe@example.com,john.doe+test@example.com,john+doe@example.com,john.doe@example.museum,john.doe+test@example.museum,john.doe_test+foobar@example.com,john@example.museum,john@doe.example.com,no-reply@example0.com,test1@example2.com,test2@example-1-2.com,test@example.1.2.com

Expected output

Nested JSON objects should be parsed properly, and not concatenated Object values should be returned. Each object key and value should be a separate string.

References

image

https://gitter.im/repo-supervisor/Lobby

Environment