Skip to content

Added support for additional validation rules in custom detector#4413

Merged
kashifkhan0771 merged 9 commits into
trufflesecurity:mainfrom
kashifkhan0771:feature/oss-291
Aug 26, 2025
Merged

Added support for additional validation rules in custom detector#4413
kashifkhan0771 merged 9 commits into
trufflesecurity:mainfrom
kashifkhan0771:feature/oss-291

Conversation

@kashifkhan0771

@kashifkhan0771 kashifkhan0771 commented Aug 21, 2025

Copy link
Copy Markdown
Contributor

Description:

This PR adds support for validation rules in custom detectors to reduce false positives.

Problem:
Go's RE2 regex engine lacks support for lookahead assertions (e.g., (?=.*[0-9])), making it impossible to validate that detected secrets contain specific character types like digits, uppercase letters, or special characters. This limitation often leads to false positives when detecting API keys, passwords, and tokens that should follow specific rules.

Solution:
Added a new validations field to the Custom detector configuration that supports the following validation types:

  • contains_digit: Requires at least one numeric digit (0-9)
  • contains_lowercase: Requires at least one lowercase letter (a-z)
  • contains_uppercase: Requires at least one uppercase letter (A-Z)
  • contains_special_char: Requires at least one special character

Example Usage:

detectors:
  - name: API Key Detector
    keywords:
      - api_key
    regex:
      key: ([A-Za-z0-9]{32,})
    validations:
      key:
        contains_digit: true
        contains_uppercase: true
        contains_special_char: true

Checklist:

  • Tests passing (make test-community)?
  • Lint passing (make lint this requires golangci-lint)?

@kashifkhan0771
kashifkhan0771 requested a review from a team August 21, 2025 11:42
@kashifkhan0771
kashifkhan0771 requested review from a team as code owners August 21, 2025 11:42
@kashifkhan0771 kashifkhan0771 self-assigned this Aug 21, 2025
@kashifkhan0771
kashifkhan0771 marked this pull request as draft August 21, 2025 11:50
Comment thread pkg/custom_detectors/validation.go Outdated
Comment thread pkg/custom_detectors/validation.go Outdated
@kashifkhan0771
kashifkhan0771 marked this pull request as ready for review August 21, 2025 14:44
@kashifkhan0771
kashifkhan0771 requested a review from camgunz August 25, 2025 11:09

@nabeelalam nabeelalam left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM!

@amanfcp amanfcp left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM

@kashifkhan0771
kashifkhan0771 merged commit 15bc3e5 into trufflesecurity:main Aug 26, 2025
14 of 15 checks passed
peterfraedrich pushed a commit to peterfraedrich/trufflehog that referenced this pull request Mar 15, 2026
…fflesecurity#4413)

* Added support for additional validation rules in custom detector

* refactored the approach to support validations for each regex in config

* resolved comments
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Regex in config not matching passwords with all required elements

4 participants