gitlab-secret_detection 0.20.2 → 0.20.3

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 6c4a46de83d50ad3fa7c06657f57435bc179487c7f32e72e62a770ac97225dea
-  data.tar.gz: 05244c00091e0d97fbeb5f49e2b7eefd6451ac77510da6f7a72f31f42f467607
+  metadata.gz: 5c7ff10984ce1af1372aa46a2cd7583305f51641bbf8872f5c5fb90c92ea0d82
+  data.tar.gz: add8b9353eb3d2f24d39d58c7f1695f02bc92e896fa5838553ba9f060bf23a1c
 SHA512:
-  metadata.gz: 7d4918b73c28f2feb0d238be8f66689020a247eef62ade67c249c16ea1dc89620733070ce015356aa1f642c377d2b4b6ea575ad5ff5d7a3c0d7986b6890913f7
-  data.tar.gz: f81e88adfd45196bbe0180a67487d4e03fc2ab9b0b8abc7354fb3d39e49efa9e1f43eb6b6c86aa7b42b4c293826dee4a0a74f0482b2d1b287cf7b13f01e4d435
+  metadata.gz: 77a3b885d321e938fecd389f4d3063ed65da6422aeec14d3a09ea466c9625e720d49e96d6033827a0d5a64fa2e6549e4dc1d2e79b363a1c375de302a54218a81
+  data.tar.gz: 607b3a1bc04502208418ec177dee2f4c3d868d50c17b4f510b8bbdc714ab036420565c7ae4525e495484ded7f186a95ba1e3647411a7287a9110f67bfea77573

data/README.md

@@ -167,9 +167,9 @@ You should see the following response as a result:
 
 
 ```shell
-$ grpcurl -d @ \
-  localhost:50001 \
+grpcurl -plaintext -d @ \
   -rpc-header 'x-sd-auth:12345' \
+  localhost:50001 \
   gitlab.secret_detection.Scanner/Scan <<EOM
 {
   "payloads": [

data/lib/gitlab/secret_detection/core/ruleset.rb

@@ -59,7 +59,7 @@ module Gitlab
           rules_data[:rules].freeze
         rescue StandardError => e
           logger.error(message: "Failed to parse local secret detection ruleset: #{e.message}")
-          raise Core::Scanner::RulesetParseError, e
+          raise RulesetParseError, e
         end
       end
     end

data/lib/gitlab/secret_detection/core/scanner.rb

@@ -38,7 +38,7 @@ module Gitlab
             tags: DEFAULT_PATTERN_MATCHER_TAGS,
             include_missing_tags: false
           )
-          @default_pattern_matcher = build_pattern_matcher(
+          @default_pattern_matcher, @default_rules = build_pattern_matcher(
             tags: DEFAULT_PATTERN_MATCHER_TAGS,
             include_missing_tags: false
           ) # includes only gitlab_blocking rules
@@ -97,11 +97,15 @@ module Gitlab
 
             next Core::Response.new(status: Core::Status::NOT_FOUND) if matched_payloads.empty?
 
+            # the pattern matcher will filter rules by tags so we use the filtered rule list
+            pattern_matcher, active_rules = build_pattern_matcher(tags:)
+
             scan_args = {
               payloads: matched_payloads,
               payload_timeout:,
-              pattern_matcher: build_pattern_matcher(tags:),
-              exclusions:
+              pattern_matcher:,
+              exclusions:,
+              rules: active_rules
             }.freeze
 
             logger.info(
@@ -135,7 +139,7 @@ module Gitlab
 
         private
 
-        attr_reader :logger, :rules, :keywords, :default_pattern_matcher, :default_keyword_matcher
+        attr_reader :logger, :rules, :keywords, :default_pattern_matcher, :default_keyword_matcher, :default_rules
 
         # Builds RE2::Set pattern matcher for the given combination of rules
         # and tags. It also allows a choice(via `include_missing_tags`) to consider rules
@@ -147,7 +151,7 @@ module Gitlab
             logger.info(
               message: "Given tags input matches default matcher tags, using pre-defined RE2 Pattern Matcher"
             )
-            return default_pattern_matcher
+            return [default_pattern_matcher, default_rules]
           end
 
           logger.info(
@@ -155,21 +159,28 @@ module Gitlab
             tags:,
             include_missing_tags:
           )
+          active_rules = []
 
           matcher = RE2::Set.new
 
-          rules.each do |rule|
-            rule_tags = rule[:tags]
+          begin
+            rules.each do |rule|
+              rule_tags = rule[:tags]
 
-            include_rule = if tags.empty?
-                             true
-                           elsif rule_tags
-                             tags.intersect?(rule_tags)
-                           else
-                             include_missing_tags
-                           end
+              include_rule = if tags.empty?
+                               true
+                             elsif rule_tags
+                               tags.intersect?(rule_tags)
+                             else
+                               include_missing_tags
+                             end
 
-            matcher.add(rule[:regex]) if include_rule
+              active_rules << rule if include_rule
+              matcher.add(rule[:regex]) if include_rule
+            end
+          rescue StandardError => e
+            logger.error "Failed to add regex secret detection ruleset in RE::Set: #{e.message}"
+            raise Core::Ruleset::RulesetCompilationError, cause: e
           end
 
           unless matcher.compile
@@ -178,7 +189,7 @@ module Gitlab
             raise Core::Ruleset::RulesetCompilationError
           end
 
-          matcher
+          [matcher, active_rules]
         end
 
         # Creates and returns the unique set of rule matching keywords
@@ -271,7 +282,8 @@ module Gitlab
           payloads:,
           payload_timeout:,
           pattern_matcher:,
-          exclusions: {}
+          exclusions: {},
+          rules: []
         )
           all_applied_exclusions = Set.new
 
@@ -285,7 +297,8 @@ module Gitlab
               findings, applied_exclusions = find_secrets_in_payload(
                 payload:,
                 pattern_matcher:,
-                exclusions:
+                exclusions:,
+                rules:
               )
               all_applied_exclusions.merge(applied_exclusions)
               findings
@@ -303,9 +316,11 @@ module Gitlab
           payloads:,
           payload_timeout:,
           pattern_matcher:,
-          exclusions: {}
+          exclusions: {},
+          rules: []
         )
           all_applied_exclusions = Set.new
+
           payload_sizes = payloads.map(&:size)
           grouped_payload_indices = group_by_chunk_size(payload_sizes)
 
@@ -327,7 +342,8 @@ module Gitlab
                 findings, applied_exclusions = find_secrets_in_payload(
                   payload:,
                   pattern_matcher:,
-                  exclusions:
+                  exclusions:,
+                  rules:
                 )
                 all_applied_exclusions.merge(applied_exclusions)
                 findings
@@ -345,7 +361,7 @@ module Gitlab
         # Finds secrets in the given payload guarded with a timeout as a circuit breaker. It accepts
         # literal values to exclude from the input before the scan, also SD rules to exclude during
         # the scan.
-        def find_secrets_in_payload(payload:, pattern_matcher:, exclusions: {})
+        def find_secrets_in_payload(payload:, pattern_matcher:, exclusions: {}, rules: @default_rules)
           findings = []
           applied_exclusions = Set.new
 
@@ -421,7 +437,7 @@ module Gitlab
           end
 
           payloads.all? do |payload|
-            has_valid_fields = payload.respond_to?(:id) && payload.respond_to?(:data)
+            has_valid_fields = payload.respond_to?(:id) && payload.respond_to?(:data) && payload.data.is_a?(String)
             unless has_valid_fields
               logger.debug(
                 message: "Scan input validation error: one of the payloads does not respond to `id` or `data`"

data/lib/gitlab/secret_detection/version.rb

@@ -8,7 +8,7 @@ module Gitlab
       #  https://gitlab.com/gitlab-org/gitlab/-/issues/514015
       #
       # Ensure to maintain the same version in CHANGELOG file.
-      VERSION = "0.20.2"
+      VERSION = "0.20.3"
 
       # SD_ENV env var is used to determine which environment the
       # server is running. This var is defined in `.runway/env-<env>.yml` files.

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: gitlab-secret_detection
 version: !ruby/object:Gem::Version
-  version: 0.20.2
+  version: 0.20.3
 platform: ruby
 authors:
 - group::secret detection
@@ -10,7 +10,7 @@ authors:
 autorequire:
 bindir: bin
 cert_chain: []
-date: 2025-03-06 00:00:00.000000000 Z
+date: 2025-03-07 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: grpc