Security check for json files

[bartoszWesolowski]

Hello,
This is rather a question, not an issue.

I am currently working on detecting sensitive data in properties files kept in source control repositories (passwords, api credentials - secrets in general). I was thinking about writing a plugin that will check all property files like xml/json/yaml/.properties for any entry that possibly contains sensitive data.

Do you think rule like that could be added here ?

I am attaching related sonar forum question: Sonar forum

[sbaudoin]

Hi,

You mean add the gitleaks patterns in a new rule? There are tens of patterns: what would be the approach to enable or disable the patterns depending on needs? Should all the patterns be checked every time or should we be able to select the patterns we want to check?

[bartoszWesolowski]

Hello,

I was thinking about providing all patterns as a config entry with default set of patterns provided OOTB by the rule.

I actually meant adding rule that will go through all properties and check whether their names matches patterns implying that property might contain secret but implementing another rule for checking attributes values with gitleaks approach also might be worth doing.

[sbaudoin]

Hello,

This does not seem to be easily feasible: so far I have not found a way to create a generic rule with predefined expressions that you would select. So the options I've identified are: whether I create a rule per expression (which is a bit tedious), or I had the expressions as examples on the documentation on a first, simple and very straightforward approach. Any thought on that?