Merge pull request americanexpress#26 from grinish21/test-eb

chore: update false postiive regex for token #patch
grinish21 · Jul 5, 2021 · 0f519db · 0f519db
2 parents ba5a32c + 25fc914
commit 0f519db
Show file tree

Hide file tree

Showing 2 changed files with 10 additions and 1 deletion.
diff --git a/config/falsepositives/false-positives.yaml b/config/falsepositives/false-positives.yaml
@@ -513,7 +513,7 @@ rules:
       - 3075
       - 6001
       - 6002
-    Pattern: "(?i)((password|secret|credentials|passphrase)['\"]? ?[:=] ?['\"]?([a-z]+[\\._\\s]+)+(password|pass|pwd|pswd|secret|passphrase)['\"]?$)"
+    Pattern: "(?i)((password|secret|credentials|passphrase|token)['\"]? ?[:=] ?['\"]?([a-z]+[\\._\\s]+)+(password|pass|pwd|pswd|secret|passphrase|token)['\"]?[,]?$)"
     FileExtensions: []
     UseFullLine: true
     Description: 'Ignore variable definitions as password values eg: password = mongo.password or password: couchbase_db_password'

diff --git a/pkg/scan/falsePositives_test.go b/pkg/scan/falsePositives_test.go
@@ -681,6 +681,15 @@ func Test_findFalsePositive(t *testing.T) {
 			},
 			wantIsFP: false,
 		},
+		{
+			name: "Skip token as variable definitions",
+			hit: Hit{
+				Code:     3037,
+				Filename: "source.kt",
+				LineValue: `	const val AUTHORIZATION_TOKEN = "Authorization Token",`,
+			},
+			wantIsFP: true,
+		},
 	}
 	for _, tt := range tests {
 		t.Run(tt.name, func(t *testing.T) {