fix(scan): exempt the metasyntactic credential pair in a DSN - #107
Merged
Conversation
`postgres://user:pass@localhost/db` is how every database driver documents its connection string, and secret-database-url reported each one as high with CWE-798. On thecodearcher/limen that was eight of the ten high findings, all of them inside fenced code blocks in a README. This is not the AWS example-key case the list above it deliberately refuses. `AKIAIOSFODNN7EXAMPLE` is a real credential format carrying a fake value, so it arrives by way of a pasted template and the remediation is the same as for a live key. `user:pass` is the English words in the position a credential goes. Both halves have to be metasyntactic, so `root:hunter2@` is still reported: a real password beside a common username is the case this must not swallow. Closes #105
ThreatCrush Security Scan67 finding(s) HIGH/CRITICAL: 11 | MEDIUM: 55 | LOW: 1
…and 17 more. Full results in the Security tab. Snippets are redacted; ThreatCrush never prints matched credential material. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Closes #105.
postgres://user:pass@localhost/dbis how every database driver documents its connection string, andsecret-database-urlreported each one ashigh/ CWE-798. On thecodearcher/limen that was 8 of the 10highfindings, every one inside a fenced code block in a README.Why this is not the AWS case the list already refuses
The comment above
KNOWN_PLACEHOLDERSdeliberately declines to exemptAKIAIOSFODNN7EXAMPLE, because it is a real credential format carrying a fake value: it arrives by way of a pasted credentials template, and the remediation is the same as for a live key. That reasoning is right and it does not transfer.user:passis the English words sitting where a credential goes.The safety property
Both halves must be metasyntactic.
root:hunter2@is still reported, because a real password beside a common username is exactly the case this must not swallow. Three tests pin that.Tests
text.test.ts— the exemption, and that a real password besideroot,userandadminis stillhigh.limen-regression.test.ts— limen's README block copied verbatim scans to 0 findings, and the same file with a real DSN appended still reports exactly 1.pnpm testinpackages/scan: 162 passing.pnpm typecheckclean. Pre-commit hook (full CLI + landing page build) passed.