45 lines
2.1 KiB
Bash
Executable File
45 lines
2.1 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
# Lightweight fail-closed scan for the checked-out source tree. Historical Git
|
|
# secrets are deliberately not rewritten here; this gate prevents new obvious
|
|
# plaintext credentials from entering the current product tree.
|
|
set -euo pipefail
|
|
|
|
if ! command -v rg >/dev/null 2>&1; then
|
|
echo 'rg is required for the repository secret scan.' >&2
|
|
exit 69
|
|
fi
|
|
|
|
# Only configuration and executable wiring can introduce a usable credential.
|
|
# Application code contains benign variables such as `rawPassword`; scanning it
|
|
# creates noise and makes a security gate easy to ignore.
|
|
scan_args=(--hidden --pcre2 --glob '!.git/**' --glob '!client/node_modules/**' --glob '!server/target/**' --glob '!client/dist/**' --glob '*.yml' --glob '*.yaml' --glob '*.properties' --glob '.env' --glob '.env.*' --glob '*.sh')
|
|
|
|
# Ignore environment placeholders and explicitly fake examples. Reject literal
|
|
# values of at least 12 characters, which includes all deployable credentials.
|
|
credential_pattern='(?i)(?<![A-Za-z0-9_])(password|passwd|secret|api[_-]?key|access[_-]?key)[[:space:]]*[:=][[:space:]]*["\x27]?(?!\$\{|<|your-|[A-Za-z0-9._-]*xxx)[A-Za-z0-9][A-Za-z0-9_+/.=-]{11,}'
|
|
credential_matches="$(rg -n -I "${scan_args[@]}" "${credential_pattern}" . || true)"
|
|
if [[ -n "${credential_matches}" ]]; then
|
|
echo 'Potential plaintext credential(s) detected outside tests:' >&2
|
|
printf '%s\n' "${credential_matches}" >&2
|
|
exit 73
|
|
fi
|
|
|
|
jdbc_userinfo_matches="$(rg -n -I "${scan_args[@]}" 'jdbc:(mysql|postgresql):[^[:space:]]*//[^[:space:]@/]+:[^[:space:]@/]+@' . || true)"
|
|
if [[ -n "${jdbc_userinfo_matches}" ]]; then
|
|
echo 'JDBC URL with embedded user information detected:' >&2
|
|
printf '%s\n' "${jdbc_userinfo_matches}" >&2
|
|
exit 74
|
|
fi
|
|
|
|
for config_file in server/src/main/resources/application-dev.yml server/src/main/resources/application-prod.yml; do
|
|
if [[ ! -f "${config_file}" ]]; then
|
|
continue
|
|
fi
|
|
if rg --pcre2 -n '^\s*(url|username|password):\s*(?!\$\{)[^#\s].*$' "${config_file}" >/dev/null; then
|
|
echo "${config_file} contains a non-environment datasource value." >&2
|
|
exit 75
|
|
fi
|
|
done
|
|
|
|
echo 'Repository plaintext-secret scan passed.'
|