thoughtworks / talisman

Using a pre-commit hook, Talisman validates the outgoing changeset for things that look suspicious — such as tokens, passwords, and private keys.
https://thoughtworks.github.io/talisman/
MIT License
1.87k stars 241 forks source link

allowed_patterns when used in fileignoreconfig at the file level only results in warnings later wrt .talismanrc file itself #439

Open muzakh opened 7 months ago

muzakh commented 7 months ago

Describe the bug I have tested 'Ignoring specific keywords' feature in fileignoreconfig on a single repository and found that allowed_patterns keywords fails the git push due to availability of those allowed patterns in .talismanrc itself. Talisman should bypass contents of filename list allowed patterns in .talismanrc file in terms of scanning during the git push to fulfil the requirements whenever allowed_patterns are used at the file level only instead of the whole repo level.

I am testing a scenario in a CI/CD pipeline using Jenkinsfile where I am using SonarQube scans. Talisman denies git push as it finds -Dsonar.projectKey=numeric-application as a key suspect, whereas it's just an identifier. Allowing it at the repo level allowed_patterns: ['projectKey=numeric-application'] does do the trick but it also rules out any possibilities of Talisman notifying us about accidental commits in the future with those keys anywhere else within the repo.

To conclude, Talisman should allow git pushes whenever allowed_patterns list in fileignoreconfig is being used to filter patterns only at the file level 'Ignoring specific keywords'.

To Reproduce Steps to reproduce the behavior:

  1. Do a single repo installation of Talisman
  2. Inside the repository directory create any file with mvn sonar:sonar -Dsonar.projectKey=numeric-application
  3. Add the same contents in .talismanrc file as:
    fileignoreconfig:
    - filename: Jenkinsfile
    allowed_patterns: ['-Dsonar.projectKey=numeric-application']
  4. Commit the code and push to the repository.

Expected behavior Talisman should allow git pushes whenever allowed_patterns list in fileignoreconfig is being used to filter patterns only at the file level 'Ignoring specific keywords'.

Screenshots

image image image

Talisman version: