cloud-gov / caulking

Prevent leaks with gitleaks, and use tests to validate
Other
32 stars 11 forks source link

Bug: False positive when leak is in file that's not staged for commit #11

Closed tammersaleh closed 4 years ago

tammersaleh commented 4 years ago
$ echo 127.0.0.1 >> README.md 

$ git status
On branch master
Your branch is up to date with 'origin/master'.

Changes not staged for commit:
  (use "git add <file>..." to update what will be committed)
  (use "git restore <file>..." to discard changes in working directory)
    modified:   README.md

no changes added to commit (use "git add" and/or "git commit -a")

Note that README.md has a "secret", but isn't staged for commit, so this shouldn't happen:

$ git commit -m "wat"
caulking: {
caulking:   "line": "127.0.0.1\n",
caulking:   "offender": "127.0.0.1\n",
caulking:   "commit": "0000000000000000000000000000000000000000",
caulking:   "repo": "REDACTED",
caulking:   "rule": "IPv4 addresses",
caulking:   "commitMessage": "***STAGED CHANGES***",
caulking:   "author": "",
caulking:   "email": "",
caulking:   "file": "README.md",
caulking:   "date": "1970-01-01T00:00:00Z",
caulking:   "tags": "IPv4, IP, addresses"
caulking: }
caulking: WARN[2020-04-10T08:25:56-07:00] 1 leaks detected in staged changes           
caulking:
caulking: If you know what you are doing you can disable this check using:
caulking:   git config --local hooks.gitleaks false
caulking:   git commit ....
caulking:   git config --local hooks.gitleaks true
pburkholder commented 4 years ago

I'll need to close as this is an issue upstream with a pending PR: https://github.com/zricethezav/gitleaks/pull/268, and there's nothing for us to do here but upvote and wait.