credsweeper 1.10.6__tar.gz → 1.10.7__tar.gz

{credsweeper-1.10.6 → credsweeper-1.10.7}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: credsweeper
-Version: 1.10.6
+Version: 1.10.7
 Summary: Credential Sweeper
 Project-URL: Homepage, https://github.com/Samsung/CredSweeper
 Project-URL: Bug Tracker, https://github.com/Samsung/CredSweeper/issues
@@ -87,7 +87,7 @@ Full documentation can be found here: <https://credsweeper.readthedocs.io/>
 
 ### Main Requirements
 
-- Python 3.8, 3.9, 3.10, 3.11, 3.12
+- Python 3.9, 3.10, 3.11, 3.12
 
 ### Installation
 

{credsweeper-1.10.6 → credsweeper-1.10.7}/README.md

@@ -46,7 +46,7 @@ Full documentation can be found here: <https://credsweeper.readthedocs.io/>
 
 ### Main Requirements
 
-- Python 3.8, 3.9, 3.10, 3.11, 3.12
+- Python 3.9, 3.10, 3.11, 3.12
 
 ### Installation
 

{credsweeper-1.10.6 → credsweeper-1.10.7}/credsweeper/__init__.py

@@ -18,4 +18,4 @@ __all__ = [
     '__version__'
 ]
 
-__version__ = "1.10.6"
+__version__ = "1.10.7"

{credsweeper-1.10.6 → credsweeper-1.10.7}/credsweeper/__main__.py

@@ -205,8 +205,8 @@ def get_arguments() -> Namespace:
                         metavar="POSITIVE_INT")
     parser.add_argument("--thrifty",
                         help="clear objects after scan to reduce memory consumption",
-                        action="store_const",
-                        const=True)
+                        action=BooleanOptionalAction,
+                        default=True)
     parser.add_argument("--skip_ignored",
                         help="parse .gitignore files and skip credentials from ignored objects",
                         dest="skip_ignored",

{credsweeper-1.10.6 → credsweeper-1.10.7}/credsweeper/common/keyword_pattern.py

@@ -3,27 +3,30 @@ import re
 
 class KeywordPattern:
     """Pattern set of keyword types"""
-    key_left = r"(\\[nrt]|%[0-9a-f]{2})?"\
-               r"(?P<variable>(([`'\"]+[^:='\"`}<>\\/&?]*|[^:='\"`}<>\s()\\/&?;,%]*)" \
+    key_left = r"(\\[nrt]|%[0-9a-f]{2})?" \
+               r"(?P<variable>(([`'\"]{1,8}[^:='\"`}<>\\/&?]*|[^:='\"`}<>\s()\\/&?;,%]*)" \
                r"(?P<keyword>"
     # there will be inserted a keyword
     key_right = r")" \
-                r"(&(quot|apos);|[^%:='\"`<>{?!&]*)[`'\"]*))"  # <variable>
-    separator = r"(\s|\\+[tnr])*\]?(\s|\\+[tnr])*" \
-                r"(?P<separator>:( [a-z]{3,9}[?]? )?=|:|=(>|&gt;|\\u0026gt;)|!=|===|==|=|%3d)" \
-                r"(\s|\\+[tnr])*"
+                r"[^%:='\"`<>{?!&]*" \
+                r")" \
+                r"(&(quot|apos);|%[0-9a-f]{2}|[`'\"])*" \
+                r")"  # <variable>
+    separator = r"(\s|\\{1,8}[tnr])*\]?(\s|\\{1,8}[tnr])*" \
+                r"(?P<separator>:(\s[a-z]{3,9}[?]?\s)?=|:|=(>|&gt;|\\u0026gt;)|!==|!=|===|==|=|%3d)" \
+                r"(\s|\\{1,8}[tnr])*"
     # might be curly, square or parenthesis with words before
     wrap = r"(?P<wrap>(" \
-           r"(new(\s|\\+[tnr])+)?" \
+           r"(new(\s|\\{1,8}[tnr]){1,8})?" \
            r"([0-9a-z_.]|-(>|(&|\\\\*u0026)gt;))*" \
-           r"[\[\(\{]"\
-           r"(\s|\\+[tnr])*" \
+           r"[\[\(\{]" \
+           r"(\s|\\{1,8}[tnr])*" \
            r"([0-9a-z_]{1,32}=)?" \
-           r")+)?"
+           r"){1,8})?"
     string_prefix = r"(((b|r|br|rb|u|f|rf|fr|l|@)(?=(\\*[`'\"])))?"
     left_quote = r"(?P<value_leftquote>((?P<esq>\\{1,8})?([`'\"]|&(quot|apos);)){1,4}))?"
     # Authentication scheme ( oauth | basic | bearer | apikey ) precedes to credential
-    auth_keywords = r"( ?(oauth|bot|basic|bearer|apikey|accesskey) )?"
+    auth_keywords = r"(\s?(oauth|bot|basic|bearer|apikey|accesskey)\s)?"
     value = r"(?P<value>" \
             r"(?(value_leftquote)" \
             r"(" \
@@ -31,11 +34,15 @@ class KeywordPattern:
             r"(?(esq)((?!(?P=esq)([`'\"]|&(quot|apos);)).)|((?!(?P=value_leftquote)).)))" \
             r"|" \
             r"(?!&(quot|apos);)" \
-            r"(\\+([ tnr]|[^\s`'\"])|[^\s`'\",;\\])" \
-            r"){3,8000}" \
+            r"(\\{1,8}([ tnr]|[^\s`'\"])" \
+            r"|" \
+            r"(?P<url_esc>%[0-9a-f]{2})" \
+            r"|" \
+            r"(?(url_esc)[^\s`'\",;\\&]|[^\s`'\",;\\])" \
+            r")){3,8000}" \
             r"|(\{[^}]{3,8000}\})" \
             r"|(<[^>]{3,8000}>)" \
-            r")"
+            r")"  # <value>
     right_quote = r"(?(value_leftquote)" \
                   r"(?P<value_rightquote>(?<!\\)(?P=value_leftquote)|\\$|(?<=[0-9a-z+_/-])$)" \
                   r"|" \
@@ -44,7 +51,7 @@ class KeywordPattern:
     @classmethod
     def get_keyword_pattern(cls, keyword: str) -> re.Pattern:
         """Returns compiled regex pattern"""
-        expression = "".join([  #
+        expression = ''.join([  #
             cls.key_left,  #
             keyword,  #
             cls.key_right,  #

{credsweeper-1.10.6 → credsweeper-1.10.7}/credsweeper/filters/value_allowlist_check.py

@@ -8,22 +8,35 @@ from credsweeper.utils import Util
 
 
 class ValueAllowlistCheck(Filter):
-    """Check that patterns from the list is not present in the candidate value."""
+    """Check that the patterns do not MATCH the candidate value."""
 
     ALLOWED = [
         r"ENC\(.*\)",  #
         r"ENC\[.*\]",  #
         r"\$\{(\*|[0-9]+|[a-z_].*)\}",  #
-        r"\$([0-9]+\b|[a-z_]+[0-9a-z_]*)",  #
+        r"\$[0-9]+(\s|$)",  #
         r"\$\$[a-z_]+(\^%[0-9a-z_]+)?",  #
-        r"#\{.*\}",  #
+        r"#\{.+\}",  # Ruby: String Interpolation
         r"\{\{.+\}\}",  #
-        r"\S{0,5}\*{5,}",  #
         r".*@@@hl@@@(암호|비번|PW|PASS)@@@endhl@@@",  #
     ]
 
     ALLOWED_PATTERN = re.compile(Util.get_regex_combine_or(ALLOWED), flags=re.IGNORECASE)
-    ALLOWED_UNQUOTED_PATTERN = re.compile(r"[~a-z0-9_]+((\.|->)[a-z0-9_]+)+\(.*$", flags=re.IGNORECASE)
+
+    ALLOWED_QUOTED = [
+        r"\$[a-z_]+[0-9a-z_]*([$\s]|$)",  #
+        r".*\*\*\*",  #
+    ]
+
+    ALLOWED_QUOTED_PATTERN = re.compile(Util.get_regex_combine_or(ALLOWED_QUOTED), flags=re.IGNORECASE)
+
+    ALLOWED_UNQUOTED = [
+        r"[~a-z0-9_]+((\.|->)[a-z0-9_]+)+\(.*$",  #
+        r"\$[a-z_]+[0-9a-z_]*\b",  #
+        r".*\*\*\*\*\*",  #
+    ]
+
+    ALLOWED_UNQUOTED_PATTERN = re.compile(Util.get_regex_combine_or(ALLOWED_UNQUOTED), flags=re.IGNORECASE)
 
     def __init__(self, config: Config = None) -> None:
         pass
@@ -42,8 +55,11 @@ class ValueAllowlistCheck(Filter):
 
         if self.ALLOWED_PATTERN.match(line_data.value):
             return True
-
-        if not line_data.is_well_quoted_value and self.ALLOWED_UNQUOTED_PATTERN.match(line_data.value):
-            return True
+        elif line_data.is_well_quoted_value:
+            if self.ALLOWED_QUOTED_PATTERN.match(line_data.value):
+                return True
+        else:
+            if self.ALLOWED_UNQUOTED_PATTERN.match(line_data.value):
+                return True
 
         return False

{credsweeper-1.10.6 → credsweeper-1.10.7}/credsweeper/filters/value_blocklist_check.py

@@ -11,8 +11,11 @@ class ValueBlocklistCheck(Filter):
         "true",
         "false",
         "null",
+        "none",
         "bearer",
         "string",
+        "value",
+        "undefined",
     ]
 
     def __init__(self, config: Config = None) -> None:

{credsweeper-1.10.6 → credsweeper-1.10.7}/credsweeper/rules/config.yaml

@@ -1391,6 +1391,22 @@
     - code
     - doc
 
+- name: Tavily API Key
+  severity: high
+  confidence: strong
+  type: pattern
+  values:
+    - (?:(?<![0-9A-Za-z_-])|\\[0abfnrtv]|(%|\\x)[0-9A-Fa-f]{2}|\\[0-7]{3}|\\[Uu]([0-9A-Fa-f]{4}){1,2}|\x1B\[[0-9;]{0,80}m)(?P<value>tvly-[0-9A-Za-z_-]{32,40})(?![0-9A-Za-z_-])
+  min_line_len: 37
+  filter_type:
+    - ValuePatternCheck(5)
+    - ValueEntropyBase64Check
+  required_substrings:
+    - tvly-
+  target:
+    - code
+    - doc
+
 - name: Discord Bot Token
   severity: high
   confidence: strong

{credsweeper-1.10.6 → credsweeper-1.10.7}/credsweeper/utils/hop_stat.py

@@ -25,11 +25,37 @@ class HopStat:
         ')': '0',
         '_': '-',
         '+': '=',
+        'Q': 'q',
+        'W': 'w',
+        'E': 'e',
+        'R': 'r',
+        'T': 't',
+        'Y': 'y',
+        'U': 'u',
+        'I': 'i',
+        'O': 'o',
+        'P': 'p',
         '{': '[',
         '}': ']',
         '|': '\\',
+        'A': 'a',
+        'S': 's',
+        'D': 'd',
+        'F': 'f',
+        'G': 'g',
+        'H': 'h',
+        'J': 'j',
+        'K': 'k',
+        'L': 'l',
         ':': ';',
         '"': "'",
+        'Z': 'z',
+        'X': 'x',
+        'C': 'c',
+        'V': 'v',
+        'B': 'b',
+        'N': 'n',
+        'M': 'm',
         '<': ',',
         '>': '.',
         '?': '/',
@@ -75,7 +101,7 @@ class HopStat:
 
         """
         hops = []
-        value = value.lower().translate(HopStat.TRANSLATION)
+        value = value.translate(HopStat.TRANSLATION)
         for a, b in zip(value[:-1], value[1:]):
             hop = self.__hop_dict.get((a, b))
             if hop is None: