credsweeper 1.11.6__py3-none-any.whl → 1.12.0__py3-none-any.whl

credsweeper/ml_model/ml_config.json

@@ -8,6 +8,10 @@
         "highest": 0.92996
     },
     "features": [
+        {
+            "type": "RuleSeverity",
+            "kwargs": {}
+        },
         {
             "type": "EntropyEvaluation",
             "kwargs": {}
@@ -70,6 +74,14 @@
                 "attribute": "value"
             }
         },
+        {
+            "type": "SearchInAttribute",
+            "comment": "ASN1 prefix for PEM keys",
+            "kwargs": {
+                "pattern": "MII",
+                "attribute": "value"
+            }
+        },
         {
             "type": "SearchInAttribute",
             "comment": "camelStyle naming detection",
@@ -122,7 +134,7 @@
             "type": "SearchInAttribute",
             "comment": "VariableNotAllowedNameCheck",
             "kwargs": {
-                "pattern": "(?i:(id|size|name|type|manager)$)",
+                "pattern": "(?i:(id|size|name|type|manager|algorithm|view|error)$)",
                 "attribute": "variable"
             }
         },
@@ -139,16 +151,30 @@
             "kwargs": {
                 "words": [
                     " ",
+                    ".",
+                    ",",
+                    "]",
+                    "#",
                     "/",
-                    "_at",
+                    "\\",
                     "_id",
+                    "_at",
                     "_len",
+                    "256",
+                    "512",
                     "access",
+                    "assert",
                     "cache",
                     "client",
                     "control",
-                    "encrypted",
+                    "crypt",
+                    "crypted",
+                    "decrypt",
+                    "encrypt",
+                    "dummy",
+                    "disable",
                     "example",
+                    "expect",
                     "expire",
                     "fake",
                     "file",
@@ -173,6 +199,7 @@
                     "pw",
                     "secret",
                     "size",
+                    "sha",
                     "space",
                     "status",
                     "sword",
@@ -195,6 +222,8 @@
             "kwargs": {
                 "words": [
                     " ",
+                    ":",
+                    "=",
                     "$(",
                     "${",
                     "(",
@@ -207,25 +236,37 @@
                     "[",
                     "_id",
                     "abc",
+                    "aaaa",
                     "allow",
+                    "arn:aws:",
                     "bar",
                     "disable",
                     "changeme",
+                    "crypt",
+                    "crypted",
+                    "decrypt",
+                    "encrypt",
                     "example",
                     "fake",
                     "file",
                     "foo",
+                    "hash",
+                    "hex",
+                    "key",
                     "min",
                     "mock",
                     "my",
                     "nil",
                     "pass",
-                    "passwd",
-                    "password",
-                    "pswd",
                     "public",
                     "pwd",
+                    "rsa-",
+                    "salt",
+                    "secret",
+                    "sha",
+                    "ssh",
                     "test",
+                    "word",
                     "xxx",
                     "xyz"
                 ]
@@ -248,9 +289,12 @@
                     "@",
                     "[",
                     "approval",
+                    "arn:aws:",
                     "assert",
                     "case",
                     "circle",
+                    "color",
+                    "e.g.",
                     "equal",
                     "example",
                     "expect",
@@ -263,7 +307,6 @@
                     "none",
                     "null",
                     "pass",
-                    "password",
                     "path",
                     "pwd",
                     "sqa",
@@ -271,7 +314,8 @@
                     "true",
                     "undefined",
                     "unit",
-                    "width"
+                    "width",
+                    "word"
                 ]
             }
         },
@@ -284,11 +328,16 @@
                     "&",
                     "(",
                     "->",
+                    "=>",
                     ".",
+                    ",",
                     "?",
                     "@",
                     "[",
+                    "{",
                     "bearer",
+                    "get",
+                    "e.g.",
                     "equal",
                     "example",
                     "expect",
@@ -318,9 +367,13 @@
                     "?",
                     "@",
                     "[",
+                    "}",
+                    "\\",
                     "assert",
                     "case",
                     "circle",
+                    "color",
+                    "e.g.",
                     "equal",
                     "example",
                     "expect",
@@ -333,8 +386,6 @@
                     "none",
                     "null",
                     "pass",
-                    "passwd",
-                    "password",
                     "path",
                     "pwd",
                     "sqa",
@@ -342,7 +393,8 @@
                     "true",
                     "undefined",
                     "unit",
-                    "width"
+                    "width",
+                    "word"
                 ]
             }
         },
@@ -350,17 +402,62 @@
             "type": "WordInPath",
             "kwargs": {
                 "words": [
-                    "/conf",
-                    "/dist-packages/",
-                    "/example",
+                    "test",
+                    "mock",
+                    "/src",
+                    "code",
+                    "/include",
+                    "internal",
+                    "tool",
+                    "util",
+                    "example",
+                    "sample",
+                    "conf",
+                    "secret",
+                    "setting",
+                    "security",
+                    "secure",
+                    "resource",
+                    "fixture",
+                    "docker",
+                    "/docs",
+                    "/doc/",
+                    "document",
+                    "/lang",
+                    "/local",
+                    "/lib",
+                    "/spec",
+                    "/pkg",
+                    "/api",
+                    "/rest",
+                    "/opt",
+                    "/sys",
+                    "kube",
+                    "kafka",
+                    "cluster",
+                    "template",
+                    "other",
+                    "public",
+                    "init",
+                    "client",
+                    "server",
+                    "/model",
+                    "/modul",
+                    "browser",
+                    "/env/",
+                    "/app",
+                    "/assets/",
+                    "vendor",
+                    "readme",
+                    "build",
+                    "/dist-packages",
                     "/record",
                     "/script",
-                    "/site-packages/",
-                    "/src/",
-                    "/test",
-                    "/tool",
-                    "/usr/local/lib/python",
-                    "/assets/"
+                    "/site-packages",
+                    "python",
+                    "/usr",
+                    "/etc",
+                    "/fuzz"
                 ]
             }
         },
@@ -378,6 +475,7 @@
             "kwargs": {
                 "extensions": [
                     "",
+                    ".04",
                     ".1",
                     ".adoc",
                     ".asciidoc",
@@ -386,17 +484,16 @@
                     ".bat",
                     ".bats",
                     ".bazel",
-                    ".bin",
                     ".build",
                     ".bundle",
                     ".bzl",
                     ".c",
+                    ".cast",
                     ".cc",
                     ".cf",
                     ".cjs",
                     ".cljc",
                     ".cmd",
-                    ".cmm",
                     ".cnf",
                     ".coffee",
                     ".conf",
@@ -409,6 +506,7 @@
                     ".dist",
                     ".doc",
                     ".dockerfile",
+                    ".edited",
                     ".eex",
                     ".env",
                     ".erb",
@@ -424,7 +522,9 @@
                     ".go",
                     ".golden",
                     ".gradle",
+                    ".graphql",
                     ".groovy",
+                    ".gtpl",
                     ".h",
                     ".haml",
                     ".hs",
@@ -456,6 +556,7 @@
                     ".lua",
                     ".m",
                     ".manifest",
+                    ".markdown",
                     ".markerb",
                     ".md",
                     ".mdx",
@@ -471,6 +572,7 @@
                     ".odd",
                     ".onnx",
                     ".oracle",
+                    ".original",
                     ".pan",
                     ".patch",
                     ".php",
@@ -488,17 +590,20 @@
                     ".purs",
                     ".pxd",
                     ".py",
+                    ".pyi",
                     ".pyx",
                     ".r",
                     ".rake",
                     ".rb",
                     ".re",
                     ".red",
+                    ".response",
                     ".resx",
                     ".rexx",
                     ".rnh",
                     ".rrc",
                     ".rs",
+                    ".rsa",
                     ".rsp",
                     ".rst",
                     ".rules",
@@ -512,6 +617,7 @@
                     ".storyboard",
                     ".strings",
                     ".sty",
+                    ".swift",
                     ".t",
                     ".td",
                     ".tdf",
@@ -530,6 +636,7 @@
                     ".tsx",
                     ".txt",
                     ".var",
+                    ".vsmdi",
                     ".vue",
                     ".xaml",
                     ".xib",
@@ -550,7 +657,6 @@
                     "CMD Password",
                     "CMD Secret",
                     "CMD Token",
-                    "Certificate",
                     "Credential",
                     "Github Old Token",
                     "Key",
@@ -565,4 +671,4 @@
             }
         }
     ]
-}
+}

credsweeper/rules/config.yaml

@@ -3,14 +3,14 @@
   confidence: weak
   type: pattern
   values:
-    - (?P<variable>(\w*(?i:비밀번호|비번|패스워드|키|암호화?|토큰|(?<!by)pass(?!ed|ing|ion|es|age)|\bpwd?\b|token|secret|key|cred)\w*)\s*(설정은|[=:!]{1,3}))?\s*([._0-9A-Za-z\[\]]*get(env)?\s*\(\s*(?(variable)[^,]+)|[\"'\\]*(\\*(['\"]|&(quot|apos);)){0,4}(\w*(?i:(?<!by)pass(?!ed|ing|ion|es|age|\s+[a-z]{3,80})|\bpwd?\b|token|secret|key|cred)\w*)(\\*(['\"]|&(quot|apos);)){0,4})\s*,\s*(default\s*=\s*)?([brufl@]{1,2}(?=\\*['\"&]))?(?P<lq>(\\*(['\"]|&(quot|apos);)){1,4})(?P<value>(.(?!(?P=lq))){4,80}.?)
+    - (?P<variable>(\w*(?i:비밀번호|비번|패스워드|키|암호화?|토큰|(?<!by)pass(?!ed|ing|ion|es|age)|\bpwd?\b|token|secret|key|cred)\w*)\s*(설정은|[=:!]{1,3}))?\s*([._0-9A-Za-z\[\]]*get(env)?\s*\(\s*(?(variable)[^,]+|[\"'\\]*(\\*([\"']|&(quot|apos|#3[49]);)){0,4}(\w*(?i:(?<!by)pass(?!ed|ing|ion|es|age|\s+[a-z]{3,80})|\bpwd?\b|token|secret|key|cred)\w*))(\\*([\"']|&(quot|apos|#3[49]);)){0,4})\s*,\s*(default\s*=\s*)?([brufl@]{1,2}(?=\\*[\"'&]))?(?P<lq>(\\*([\"']|&(quot|apos|#3[49]);)){1,4})(?P<value>(.(?!(?P=lq))){4,80}.?)
   filter_type:
     - ValueAllowlistCheck
     - LineGitBinaryCheck
     - LineUUEPartCheck
     - ValueFilePathCheck
     - ValuePatternCheck(5)
-    - ValueDictionaryValueLengthCheck(4,80)
+    - ValueLengthCheck(4,80)
   min_line_len: 8
   required_substrings:
     - pass
@@ -34,14 +34,14 @@
   confidence: weak
   type: pattern
   values:
-    - (?P<wrap>[`'\"(])?\s*(?P<variable>(\w*(?i:(?<!by)passw?o?r?d?s?(?!ed|ing|ion|es|age)|pwd?\b|\bp/w\b|token|secret|key|credential)\w*|비밀번호|비번|패스워드|키|암호화?|토큰))[`'\"]*(\s+(?i:is|are|was|were)(\s*[:-])?\s+|\s*(설정은|[=:!]{1,3})\s*)(?P<quote>[`'\"]{1,6})?(?P<value>(?(quote)(?(wrap)[^`'\")]{4,80}|[^`'\"]{4,80})|(?(wrap)[^`'\")]{4,80}|\S{4,80})))
+    - (?P<wrap>[\"'`(])?\s*(?P<variable>(\w*(?i:(?<!by)passw?o?r?d?s?(?!ed|ing|ion|es|age)|pwd?\b|\bp/w\b|token|secret|key|credential)\w*|비밀번호|비번|패스워드|키|암호화?|토큰))[\"'`]*(\s+(?i:is|are|was|were)(\s*[:-])?\s+|\s*(설정은|[=:!]{1,3})\s*)(?P<quote>[\"'`]{1,6})?(?P<value>(?(quote)(?(wrap)[^\"'`)]{4,80}|[^\"'`]{4,80})|(?(wrap)[^\"'`)]{4,80}|\S{4,80})))
   filter_type:
     - ValueAllowlistCheck
     - LineGitBinaryCheck
     - LineUUEPartCheck
     - ValueFilePathCheck
     - ValuePatternCheck(5)
-    - ValueDictionaryValueLengthCheck(4,80)
+    - ValueLengthCheck(4,80)
   min_line_len: 8
   required_substrings:
     - pass
@@ -68,10 +68,10 @@
   confidence: moderate
   type: pattern
   values:
-    - (?P<variable>[`'\"]?(?i:token|secret|key|키|암호화?|토큰)[`'\"]?)((\s)*[=:](\s)*)(?P<quote>[`'\"(])?(?P<value>(?-i:(?P<a>[A-Z])|(?P<b>[a-z])|(?P<c>[0-9/_+=~!@#$%^&*;:?-])){8,80}(?(a)(?(b)(?(c)(\S|$)|(?!x)x)|(?!x)x)|(?!x)x))(?(quote)[)`'\"])
+    - (?P<variable>[\"'`]?(?i:token|secret|key|키|암호화?|토큰)[\"'`]?)((\s)*[=:](\s)*)(?P<quote>[\"'`(])?(?P<value>(?-i:(?P<a>[A-Z])|(?P<b>[a-z])|(?P<c>[0-9/_+=~!@#$%^&*;:?-])){8,80}(?(a)(?(b)(?(c)(\S|$)|(?!x)x)|(?!x)x)|(?!x)x))(?(quote)[)\"'`])
   filter_type:
     - ValueAllowlistCheck
-    - ValuePatternCheck
+    - ValuePatternCheck(4)
     - ValueEntropyBase64Check
     - ValueCoupleKeywordCheck
   min_line_len: 16
@@ -90,10 +90,10 @@
   confidence: moderate
   type: pattern
   values:
-    - (?P<variable>[`'\"]?(?i:(?<!id[ :/])pa[as]swo?r?ds?|pwd?|p/w|비밀번호|비번|패스워드|암호)[`'\"]?)((\s)*[=:](\s)*)(?P<quote>[`'\"(])?(?P<value>(?-i:(?P<a>[A-Z])|(?P<b>[a-z])|(?P<c>[0-9/_+=~!@#$%^&*;:?-])){8,31}(?(a)(?(b)(?(c)(\S|$)|(?!x)x)|(?!x)x)|(?!x)x))(?(quote)[)`'\"])
+    - (?P<variable>[\"'`]?(?i:(?<!id[ :/])pa[as]swo?r?ds?|pwd?|p/w|비밀번호|비번|패스워드|암호)[\"'`]?)((\s)*[=:](\s)*)(?P<quote>[\"'`(])?(?P<value>(?-i:(?P<a>[A-Z])|(?P<b>[a-z])|(?P<c>[0-9/_+=~!@#$%^&*;:?-])){8,31}(?(a)(?(b)(?(c)(\S|$)|(?!x)x)|(?!x)x)|(?!x)x))(?(quote)[)\"'`])
   filter_type:
     - ValueAllowlistCheck
-    - ValuePatternCheck
+    - ValuePatternCheck(4)
     - ValueDictionaryKeywordCheck
     - LineGitBinaryCheck
     - LineUUEPartCheck
@@ -121,7 +121,7 @@
     - (^|\s|(?P<variable>(?i:\bip[\s/]{1,80}id[\s/]{1,80}pw[\s/:]{0,80}))|(?P<url>://))(?P<ip>(?<![0-9.])[0-2]?[0-9]{1,2}\.[0-2]?[0-9]{1,2}\.[0-2]?[0-9]{1,2}\.[0-2]?[0-9]{1,2}(?![0-9.]))((\s*[(])?|(?(variable)[\s,/]{1,80}|(?(url)[,]|[,/])))\s*\w[\w.-]{3,80}[\s,/]{1,80}(?P<value>(?(url)(?-i:(?P<a>[A-Z])|(?P<b>[a-z])|(?P<c>[0-9_+=~!@#$%^&*;?-])){7,31}(?(a)(?(b)(?(c)(\S|$)|(?!x)x)|(?!x)x)|(?!x)x)|(?-i:(?P<e>[A-Z])|(?P<f>[a-z])|(?P<g>[0-9/_+=~!@#$%^&*;?-])){7,31}(?(e)(?(f)(?(g)(\S|$)|(?!x)x)|(?!x)x)|(?!x)x)))(?:\s|[^/]|$)
   filter_type:
     - ValueAllowlistCheck
-    - ValuePatternCheck
+    - ValuePatternCheck(4)
     - ValueDictionaryKeywordCheck
   min_line_len: 10
   required_substrings:
@@ -134,11 +134,11 @@
   confidence: moderate
   type: pattern
   values:
-    - (?P<ddash>--)?(?P<variable>\w*(?i:pa[as]swords?|passwd?|pwd|\bp/w|\bpw|비밀번호|비번|패스워드|암호))\s*?(?(ddash)[ =]|[:=/>-]{1,2})\s*(?P<quote>[`'\"]{1,8})?(?P<value>(?-i:(?P<a>[A-Z])|(?P<b>[a-z])|(?P<c>[0-9/_+=~!@#$%^&*;:?-])){4,31}(?(a)(?(b)(?(c)(\S|$)|(?!x)x)|(?!x)x)|(?!x)x))(?(quote)(?P=quote)|(\s|$))
+    - (?P<ddash>--)?(?P<variable>\w*(?i:pa[as]swords?|passwd?|pwd|\bp/w|\bpw|비밀번호|비번|패스워드|암호))\s*?(?(ddash)[ =]|[:=/>-]{1,2})\s*(?P<quote>[\"'`]{1,8})?(?P<value>(?-i:(?P<a>[A-Z])|(?P<b>[a-z])|(?P<c>[0-9/_+=~!@#$%^&*;:?-])){4,31}(?(a)(?(b)(?(c)(\S|$)|(?!x)x)|(?!x)x)|(?!x)x))(?(quote)(?P=quote)|(\s|$))
     - (?P<ddash>--)?(?P<variable>(?i:user\s*)?(?i:id|login|account|root|admin|user|name|wifi|role|host|default|계정|아이디))\s*?(?(ddash)[ =]|[ :=])\s*?(?P<value>\S+)
   filter_type:
     - ValueAllowlistCheck
-    - ValuePatternCheck
+    - ValuePatternCheck(4)
   min_line_len: 10
   required_substrings:
     - pass
@@ -160,7 +160,7 @@
     - (?P<variable>[\w.-]{0,80}(?i:(?P<id>\bid\b)|id\b|user|name|계정|아이디)[\w.-]{0,80}(?(id)[ :(/]{1,80}|[:(/]{1,80})(?i:pa[as]swo?r?ds?|pwd?|비밀번호|비번|패스워드|암호))\)?(\s*->\s*|[ =:)(/]{1,80}|\s+is\s+|\s+are\s+|\s*는\s*|\s*은\s*|\s*설정은\s*)\(?(?P<id_value>[\w.-]{2,31})[ :\(/\"',]{1,80}(?P<value>(?-i:(?P<a>[A-Z])|(?P<b>[a-z])|(?P<c>[0-9/_+=~!@#$%^&*;:?-])){4,31}(?(a)(?(b)(?(c)(\S|$)|(?!x)x)|(?!x)x)|(?!x)x))
   filter_type:
     - ValueAllowlistCheck
-    - ValuePatternCheck
+    - ValuePatternCheck(4)
     - ValueDictionaryKeywordCheck
   min_line_len: 10
   required_substrings:
@@ -179,10 +179,10 @@
   confidence: weak
   type: pattern
   values:
-    - (\\[nrt]|\b)(?i:(?P<variable>(CREATE|ALTER|SET\s{1,8}PASSWORD|INSERT(\s{1,8}IGNORE)?|UPDATE\s{1,8}[^\s;]{1,80})\s{1,8}(LOGIN|USER|ROLE|FOR|INTO|SET)\s{1,8}([^\s;]{1,80}\s{1,8}|VALUES\s*\(){1,8}(IDENTIFIED((\s{1,8}WITH\s{1,8}\S{1,80})?\s{1,8}(BY|AS))|(=|WITH)?\s*PASSWORD\b(\s*=)?)))\s*(?P<wrap>[(]\s*)?(?P<value_leftquote>((?P<esq>\\{1,8})?([`'\"]|&(quot|apos);)){1,4})?(?P<value>(?(value_leftquote)((?!(?P=value_leftquote))(?(esq)((?!(?P=esq)([`'\"]|&(quot|apos);)).)|((?!(?P=value_leftquote)).)))|(?!&(quot|apos);)(\\+([ tnr]|[^\s`'\"])|[^\s`'\",;\\])){3,80})(?(value_leftquote)(?P<value_rightquote>(?<!\\)(?P=value_leftquote))|(?(wrap)[)]|[\s`'\",;]))
+    - (\\[nrt]|\b)(?i:(?P<variable>(CREATE|ALTER|SET\s{1,8}PASSWORD|INSERT(\s{1,8}IGNORE)?|UPDATE\s{1,8}[^\s;]{1,80})\s{1,8}(LOGIN|USER|ROLE|FOR|INTO|SET)\s{1,8}([^\s;]{1,80}\s{1,8}|VALUES\s*\(){1,8}(IDENTIFIED((\s{1,8}WITH\s{1,8}\S{1,80})?\s{1,8}(BY|AS))|(=|WITH)?\s*PASSWORD\b(\s*=)?)))\s*(?P<wrap>[(]\s*)?(?P<value_leftquote>((?P<esq>\\{1,8})?([\"'`]|&(quot|apos|#3[49]);)){1,4})?(?P<value>(?(value_leftquote)((?!(?P=value_leftquote))(?(esq)((?!(?P=esq)([\"'`]|&(quot|apos|#3[49]);)).)|((?!(?P=value_leftquote)).)))|(?!&(quot|apos|#3[49]);)(\\+([ tnr]|[^\s\"'`])|[^\s\"'`,;\\])){3,80})(?(value_leftquote)(?P<value_rightquote>(?<!\\)(?P=value_leftquote))|(?(wrap)[)]|[\s\"'`,;]))
   filter_type:
     - ValueAllowlistCheck
-    - ValuePatternCheck(4)
+    - ValuePatternCheck
   min_line_len: 8
   required_substrings:
     - password
@@ -203,7 +203,7 @@
     - "-"
   required_regex: "[0-9A-Za-z_/+-]{15}"
   filter_type:
-    - ValuePatternCheck
+    - ValuePatternCheck(4)
   use_ml: false
   target:
     - code
@@ -732,7 +732,7 @@
   confidence: moderate
   type: pattern
   values:
-    - (^|\W|\\[0abfnrtv]|(?:%|\\x)[0-9A-Fa-f]{2}|\\[0-7]{3}|\\[Uu][0-9A-Fa-f]{4}|\x1B\[[0-9;]{0,80}m)(?P<variable>-[A-Za-z_-]*(?i:pass(in|out|word|phrase)))\s\s*(?!-)(?P<value_leftquote>(\\?[\"']){1,3})?(pass:)?(?!file:|env:|fd:)(?P<value>(?(value_leftquote)[^\"'\\]|[^\s\"'\\]){4,80})(?(value_leftquote)(?P<value_rightquote>(\\?[\"']){1,3}))
+    - (^|\W|\\[0abfnrtv]|(?:%|\\x)[0-9A-Fa-f]{2}|\\[0-7]{3}|\\[Uu][0-9A-Fa-f]{4}|\x1B\[[0-9;]{0,80}m)(?P<variable>-[A-Za-z_-]*(?i:pass(in|out|word|phrase)))(\s|\\?[\"'],)\s*(?!-)(?P<value_leftquote>(\\?[\"']){1,3})?(pass:)?(?!file:|env:|fd:)(?P<value>(?(value_leftquote)[^\"'\\]|[^\s\"'\\]){4,80})(?(value_leftquote)(?P<value_rightquote>(\\?[\"']){1,3}))
   filter_type: GeneralKeyword
   use_ml: true
   required_substrings:
@@ -746,7 +746,7 @@
   confidence: moderate
   type: pattern
   values:
-    - (^|\W|\\[0abfnrtv]|(?:%|\\x)[0-9A-Fa-f]{2}|\\[0-7]{3}|\\[Uu][0-9A-Fa-f]{4}|\x1B\[[0-9;]{0,80}m)(?P<variable>-[A-Za-z_-]*(?i:token))\s\s*(?!-)(?P<value_leftquote>(\\?[\"']){1,3})?(?P<value>(?(value_leftquote)[^\"'\\]|[^\s\"'\\]){4,4000})(?(value_leftquote)(?P<value_rightquote>(\\?[\"']){1,3}))
+    - (^|\W|\\[0abfnrtv]|(?:%|\\x)[0-9A-Fa-f]{2}|\\[0-7]{3}|\\[Uu][0-9A-Fa-f]{4}|\x1B\[[0-9;]{0,80}m)(?P<variable>-[A-Za-z_-]*(?i:token))(\s|\\?[\"'],)\s*(?!-)(?P<value_leftquote>(\\?[\"']){1,3})?(?P<value>(?(value_leftquote)[^\"'\\]|[^\s\"'\\]){4,4000})(?(value_leftquote)(?P<value_rightquote>(\\?[\"']){1,3}))
   filter_type: GeneralKeyword
   use_ml: true
   required_substrings:
@@ -760,7 +760,7 @@
   confidence: moderate
   type: pattern
   values:
-    - (^|\W|\\[0abfnrtv]|(?:%|\\x)[0-9A-Fa-f]{2}|\\[0-7]{3}|\\[Uu][0-9A-Fa-f]{4}|\x1B\[[0-9;]{0,80}m)(?P<variable>-[A-Za-z_-]*(?i:secret)[A-Za-z_-]*)\s\s*(?!-)(?P<value_leftquote>(\\?[\"']){1,3})?(pass:)?(?!file:|env:|fd:)(?P<value>(?(value_leftquote)[^\"'\\]|[^\s\"'\\]){4,4000})(?(value_leftquote)(?P<value_rightquote>(\\?[\"']){1,3}))
+    - (^|\W|\\[0abfnrtv]|(?:%|\\x)[0-9A-Fa-f]{2}|\\[0-7]{3}|\\[Uu][0-9A-Fa-f]{4}|\x1B\[[0-9;]{0,80}m)(?P<variable>-[A-Za-z_-]*(?i:secret)[A-Za-z_-]*)(\s|\\?[\"'],)\s*(?!-)(?P<value_leftquote>(\\?[\"']){1,3})?(pass:)?(?!file:|env:|fd:)(?P<value>(?(value_leftquote)[^\"'\\]|[^\s\"'\\]){4,4000})(?(value_leftquote)(?P<value_rightquote>(\\?[\"']){1,3}))
   filter_type: GeneralKeyword
   use_ml: true
   required_substrings:
@@ -1072,7 +1072,7 @@
   confidence: moderate
   type: pattern
   values:
-    - (?:^|[^0-9A-Za-z_+-]|\\[0abfnrtv]|(?:%|\\x)[0-9A-Fa-f]{2}|\\[0-7]{3}|\\[Uu][0-9A-Fa-f]{4}|\x1B\[[0-9;]{0,80}m)(?P<value>sl.[0-9A-Za-z_-]{135})(?![0-9A-Za-z_-])
+    - (?:^|[^0-9A-Za-z_+-]|\\[0abfnrtv]|(?:%|\\x)[0-9A-Fa-f]{2}|\\[0-7]{3}|\\[Uu][0-9A-Fa-f]{4}|\x1B\[[0-9;]{0,80}m)(?P<value>sl\.(u\.)?[0-9A-Za-z_-]{135})(?![0-9A-Za-z_-])
   filter_type: TokenPattern
   min_line_len: 138
   required_substrings:
@@ -1254,6 +1254,32 @@
     - code
     - doc
 
+- name: NKEY Seed
+  severity: high
+  confidence: weak
+  type: pattern
+  values:
+    - (?:^|[^0-9A-Za-z_+-]|\\[0abfnrtv]|(?:%|\\x)[0-9A-Fa-f]{2}|\\[0-7]{3}|\\[Uu][0-9A-Fa-f]{4}|\x1B\[[0-9;]{0,80}m)(?P<value>S[ACNOPUX][A-Z2-7]{40,200})(?![=0-9A-Za-z_+-])
+  min_line_len: 42
+  filter_type:
+    - ValueCoupleKeywordCheck
+    - ValuePatternCheck
+    - ValueEntropyBase32Check
+    - ValueBase32DataCheck
+    - ValueTokenBase32Check
+  required_substrings:
+    - SA
+    - SC
+    - SN
+    - SO
+    - SP
+    - SU
+    - SX
+  required_regex: "[0-9A-Za-z_/+-]{15}"
+  target:
+    - code
+    - doc
+
 - name: Jira 2FA
   severity: info
   confidence: weak
@@ -1362,7 +1388,7 @@
     - (?P<value>tvly-[0-9A-Za-z_-]{32,40})(?![0-9A-Za-z_-])
   min_line_len: 37
   filter_type:
-    - ValuePatternCheck(5)
+    - ValuePatternCheck
     - ValueEntropyBase64Check
   required_substrings:
     - tvly-
@@ -1378,7 +1404,7 @@
     - (?P<value>sntrys_eyJ[0-9A-Za-z_-]{80,8000}=*([0-9A-Za-z_-]{32,256})?)(?![0-9A-Za-z_-])
   min_line_len: 37
   filter_type:
-    - ValuePatternCheck(5)
+    - ValuePatternCheck
   required_substrings:
     - sntrys_eyJ
   target:
@@ -1393,7 +1419,7 @@
     - (?P<value>sntryu_[0-9a-f]{64})(?![0-9A-Za-z_-])
   min_line_len: 37
   filter_type:
-    - ValuePatternCheck(5)
+    - ValuePatternCheck
   required_substrings:
     - sntryu_
   target:
@@ -1453,7 +1479,7 @@
   confidence: weak
   type: pattern
   values:
-    - (?:^|[^0-9A-Za-z_+-]|\\[0abfnrtv]|(?:%|\\x)[0-9A-Fa-f]{2}|\\[0-7]{3}|\\[Uu][0-9A-Fa-f]{4}|\x1B\[[0-9;]{0,80}m)(?P<value>00D[0-9A-Za-z]{9,15}(![.0-9A-Za-z_-]{24,200})?)(?![0-9A-Za-z_-])
+    - (?:^|[^0-9A-Za-z_+-]|\\[0abfnrtv]|(?:%|\\x)[0-9A-Fa-f]{2}|\\[0-7]{3}|\\[Uu][0-9A-Fa-f]{4}|\x1B\[[0-9;]{0,80}m)(?P<value>(3MVG[0-9A-Za-z_.]{24,200}|00D[0-9A-Za-z]{9,15}(![0-9A-Za-z_.]{24,200})?))(?![0-9A-Za-z_.])
   min_line_len: 12
   filter_type:
     - ValuePatternCheck(9)
@@ -1461,6 +1487,7 @@
     - ValueBase64PartCheck
   required_substrings:
     - 00D
+    - 3MVG
   target:
     - code
     - doc

credsweeper/scanner/scanner.py

@@ -145,16 +145,19 @@ class Scanner:
             # Trim string from outer spaces to make future `x in str` checks faster
             target_line_stripped = target.line_strip
             target_line_stripped_len = target.line_strip_len
+            # use lower case for required substring
+            target_line_stripped_lower = target.line_lower_strip
 
             # "cache" - YAPF and pycharm formatters ...
             matched_keyword = \
                 target_line_stripped_len >= self.min_keyword_len and (  #
                         '=' in target_line_stripped
                         or ':' in target_line_stripped
-                        or "set" in target_line_stripped
                         or "#define" in target_line_stripped
                         or "%define" in target_line_stripped
                         or "%global" in target_line_stripped
+                        or "set" in target_line_stripped_lower
+                        or "%3d" in target_line_stripped_lower
                 )  #
             matched_pem_key = \
                 target_line_stripped_len >= self.min_pem_key_len \
@@ -168,8 +171,6 @@ class Scanner:
                              target.line_num)
                 continue
 
-            # use lower case for required substring
-            target_line_stripped_lower = target.line_lower_strip
             # cached value to skip the same regex verifying
             matched_regex: Dict[re.Pattern, bool] = {}
 

credsweeper/secret/config.json

@@ -164,8 +164,8 @@
         "tizen"
     ],
     "check_for_literals": true,
-    "min_pattern_value_length": 12,
-    "min_keyword_value_length": 4,
+    "max_password_value_length": 31,
+    "max_url_cred_value_length": 80,
     "line_data_output": [
         "line",
         "line_num",

credsweeper/utils/util.py

@@ -638,6 +638,8 @@ class Util:
     @staticmethod
     def subtext(text: str, pos: int, hunk_size: int) -> str:
         """cut text symmetrically for given position or use remained quota to be fitted in 2x hunk_size"""
+        # cut trailed whitespaces to obtain more informative data
+        text = text.rstrip()
         if hunk_size <= pos:
             left_quota = 0
             left_pos = pos - hunk_size

{credsweeper-1.11.6.dist-info → credsweeper-1.12.0.dist-info}/METADATA

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: credsweeper
-Version: 1.11.6
+Version: 1.12.0
 Summary: Credential Sweeper
 Project-URL: Homepage, https://github.com/Samsung/CredSweeper
 Project-URL: Bug Tracker, https://github.com/Samsung/CredSweeper/issues