patterns.yml

name: Configuration Secrets

patterns:
  - name: Hardcoded Database Passwords
    type: hardcoded_database_passwords
    comments:
      - "Only support for Postgres and MySQL password strings"
      - "Checks if the password is null / length of 0"
      - "Supports quoted passwords"
      - "Case insensitive"
    regex:
      version: 0.1
      pattern: |
        [^\r\n\x00-\x08]+
      start: |
        (?:[^0-9A-Za-z]|\A)(?i)(?:postgres|mysql|mysql_root)_password[\t ]*[=:][\t ]*['"]?
      end: |
        \z|[\r\n'"]
    test:
      data: postgres_password=password
      start_offset: 18
      end_offset: 26


  - name: Hardcoded Spring SQL passwords
    description: |
      Hardcoded JDBC / Spring datasource passwords which typically are in property files or passed in at runtime
    type: hardcoded_spring_sql_passwords
    regex:
      version: 0.1
      pattern: |
        [^\r\n'"\x00-\x08]+
      start: |
        (\A|\b)(?:spring\.datasource|jdbc)\.password[ \t]*=[ \t]*['"]?
      end: |
        \z|['"\r\n]
    expected:
      - name: application.properties
        start_offset: 314
        end_offset: 318
      - name: application.properties
        start_offset: 358
        end_offset: 375
      - name: application.properties
        start_offset: 422
        end_offset: 442
      - name: application.properties
        start_offset: 836
        end_offset: 843
      - name: application.properties
        start_offset: 1078
        end_offset: 1085
      - name: application.properties
        start_offset: 1346
        end_offset: 1353
      - name: application.properties
        start_offset: 1633
        end_offset: 1640
    test:
      data: spring.datasource.password=password
      start_offset: 27
      end_offset: 35


  - name: Django Secret Key
    type: django_secret_key
    regex:
      version: 0.1
      pattern: |
        [^\r\n"']+
      start: |
        (\b|\A)SECRET_KEY[ \t]*=[ \t]*["']
      end: |
        ['"]
    expected:
      - name: global_settings.py
        start_offset: 59
        end_offset: 109
    test:
      data: SECRET_KEY = "password"
      start_offset: 14
      end_offset: 22

  # Experimental

  - name: YAML Static Password Fields
    type: yaml_static_password_fields
    description: |
      Pattern to find hardcoded passwords in YAML configuration files
    experimental: true
    regex:
      version: 0.2
      pattern: |
        [^\r\n`'"\x00-\x08]+
      start: |
        (?:\n|\A)[ \t]*(?i)[a-z_-]*(?:secret|service_pass(wd|word|code|phrase)|pass(?:wd|word|code|phrase)?|key|token)[ \t]*:[ \t]*['"]?
      end: |
        ['"\r\n]|\z
      additional_not_match:
        - ^(keyPassphrase|password|key|[ \t]+|\$\{[^}]+}|(str|string|int|bool)( +#.*)?),?$
        - ^(.* = )?(None|[Tt]rue|[Ff]alse|[Nn]ull|Default(Type)?|Event|[A-Z]+_KEY|VERSION|NAME|update|destroy|(?:dis|en)ableEventListeners|\.\.\.),?$
        - ^(((this|self|obj)\.)([A-Za-z_]+\,|[A-Za-z_].*)|\{\}|\[\]|[0-9a-zA-Z],|\{)$
        - ^(([a-zA-Z_]+(\(\))?\.)*[a-zA-Z_]+\(\)|\|\s*)$|\{\{[^}]+\}\}|\$\{\{ |^!Ref |^\$\(.*\)|^(https?|file)://|^(/[a-zA-Z0-9./_-]+/)?[a-zA-Z0-9_-]{5,}(\.(pem|crt|key|cer|pub|der)|_rsa)$|^=|\(\) => |\([^)]+\) => \{
        - ^\s*(typing\.)?([Tt]uple|[Ll]ist|[Dd]ict|Callable|Iterable|Sequence|Optional|Union)\[.*$
    comments:
      - "Expect large numbers of false positives on variables containing 'key' or 'token'"
      - "The hardcoded password is any length"
      - "Some false positives in code might appear"
      - "The pattern only checks for certain key words to end the variable name (`secret`, `password`, etc.)"
      - "Does not allow for multline blocks"
    expected:
      - name: example.yml
        start_offset: 57
        end_offset: 80
      - name: example.yml
        start_offset: 57
        end_offset: 80
    test:
      data: "password: password123"
      start_offset: 10
      end_offset: 21


  - name: YAML hardcoded passwords (plain scalars)
    type: yaml_passwords_plain
    description: |
      Hardcoded passwords in YAML configuration files, using plain scalars
    experimental: true
    regex:
      version: 0.1
      pattern: |
        [^\r\n`'"\x00-\x08]+
      start: |
        (?:\n|\A)[ \t]*(?i)[a-z_-]*(?:secret|service_pass(wd|word|code|phrase)|pass(?:wd|word|code|phrase)?|key|token)[ \t]*:[ \t]*
      end: |
        [\r\n]|\z
      additional_not_match:
        - ^(keyPassphrase|password|key|[ \t]+|\$\{[^}]+}|(str|string|int|bool)( +#.*)?),?$
        - ^(.* = )?(None|[Tt]rue|[Ff]alse|[Nn]ull|Default(Type)?|Event|[A-Z]+_KEY|VERSION|NAME|update|destroy|(?:dis|en)ableEventListeners|\.\.\.),?$
        - ^(((this|self|obj)\.)([A-Za-z_]+\,|[A-Za-z_].*)|\{\}|\[\]|[0-9a-zA-Z],|\{)$
        - ^(([a-zA-Z_]+(\(\))?\.)*[a-zA-Z_]+\(\)|\|\s*)$|\{\{[^}]+\}\}|\$\{\{ |^!Ref |^\$\(.*\)|^(https?|file)://|^(/[a-zA-Z0-9./_-]+/)?[a-zA-Z0-9_-]{5,}(\.(pem|crt|key|cer|pub|der)|_rsa)$|^=|\(\) => |\([^)]+\) => \{
        - ^\s*(typing\.)?([Tt]uple|[Ll]ist|[Dd]ict|Callable|Iterable|Sequence|Optional|Union)\[.*$
    comments:
      - "The hardcoded password is any length"
      - "Some false positives in code might appear"
      - "The pattern only checks for certain key words to end the variable name (`secret`, `password`, etc.)"
      - "Only allows for plain scalars, not quoted or multi-line, to better control false positives"
    test:
      data: "password: password123"
      start_offset: 10
      end_offset: 21


  - name: YAML hardcoded passwords (single quoted strings)
    type: yaml_passwords_single_quoted
    description: |
      Hardcoded passwords in YAML configuration files, using single quotes
    experimental: true
    regex:
      version: 0.1
      pattern: |
        [^\r\n'\x00-\x08]+
      start: |
        (?:\n|\A)[ \t]*(?i)[a-z_-]*(?:secret|service_pass(wd|word|code|phrase)|pass(?:wd|word|code|phrase)?|key|token)[ \t]*:[ \t]*'
      end: |
        '([ \t]*[\r\n]|\z)
      additional_not_match:
        - \{\{[^{}]+\}\}
    comments:
      - "The hardcoded password is any length"
      - "Some false positives in code might appear"
      - "The pattern only checks for certain key words to end the variable name (`secret`, `password`, etc.)"
      - "Only allows for only single-quoted passwords, to better control false positives"
    test:
      data: "password: 'password123'"
      start_offset: 11
      end_offset: 22


  - name: YAML hardcoded passwords (double quoted strings)
    type: yaml_passwords_single_quoted
    description: |
      Hardcoded passwords in YAML configuration files, using single quotes
    experimental: true
    regex:
      version: 0.1
      pattern: |
        [^\r\n"\x00-\x08]+
      start: |
        (?:\n|\A)[ \t]*(?i)[a-z_-]*(?:secret|service_pass(wd|word|code|phrase)|pass(?:wd|word|code|phrase)?|key|token)[ \t]*:[ \t]*"
      end: |
        "([ \t]*[\r\n]|\z)
      additional_not_match:
        - \{\{[^{}]+\}\}
    comments:
      - "The hardcoded password is any length"
      - "Some false positives in code might appear"
      - "The pattern only checks for certain key words to end the variable name (`secret`, `password`, etc.)"
      - "Only allows for only double-quoted passwords, to better control false positives"
    test:
      data: |
        password: "password123"
      start_offset: 11
      end_offset: 22


  - name: YAML hardcoded passwords (multiline strings)
    type: yaml_passwords_multiline
    description: |
      Hardcoded passwords in YAML configuration files, using multiline strings
    experimental: true
    regex:
      version: 0.1
      pattern: |
        [^\x00-\x08]+?
      start: |
        (?:\n|\A)[ \t]*(?i)[a-z_-]*(?:secret|service_pass(wd|word|code|phrase)|pass(?:wd|word|code|phrase)?|key|token)[ \t]*:[ \t]*[|>][+-]?[ \t]*(\n|\r\n)[ \t]+
      end: |
        \n\n|\r\n\r\n|(\n|\r\n)[ \t]+\S+:|(\n|\r\n)\.\.\.[ \t\n\r]|\z
    comments:
      - "The hardcoded password is any length"
      - "Some false positives in code or YAML files might appear, especially where the variable is called 'key' or 'token'"
      - "The pattern checks for certain key words to end the variable name (`secret`, `password`, etc.)"
    test:
      data: |-
        password: |
          password123
          andsomemore
        other_field: foo
      start_offset: 14
      end_offset: 56


  - name: GitHub Actions SHA Checker
    type: github_actions_sha_checker
    comments:
      - "Checks for all github actions using a version that isn't a pinned SHA-1 commit hash"
      - "Checks for uses: org name / repo name @ string under 40 characters"
      - "Not case sensitive"
      - "Exclude all actions in actions, github and advanced-security repo"
    regex:
      version: 0.1
      pattern: |
        [a-z0-9_-]{1,39}\/[a-z0-9_-]{1,100}@[a-z0-9._-]{1,39}
      start: |
        \buses:[ \t]{1,5}
      end: |
        \s|\z
      additional_not_match:
        - ^(actions|github|advanced-security)/
    test:
      data: |
        uses: sample-org/sample-action@v2
      start_offset: 6
      end_offset: 33


  - name: .NET Configuration file
    type: dotnet_configuration
    regex:
      version: 0.1
      pattern: |
        [^"\x00\x08]+
      start: |
        <add\s+key="[^"]*(?i)(password|secret|pass(?:wd|word|code|phrase)?|key|token)"\s+value="
      end: |
        \"
    comments:
      - XML key/value format, <add key="key name" value="value of key" />
    expected:
      - name: app.config
        start_offset: 59
        end_offset: 84
    test:
      data: |
        <add key="password" value="mypassword" />
      start_offset: 27
      end_offset: 37


  - name: .NET MachineKey
    type: dotnet_machinekey
    regex:
      version: 0.1
      pattern: |
        [A-Fa-f0-9]+
      start: |
        <machineKey\s+[^>]*(validation|decryption)Key="
      end: |
        \"
    comments:
      - contents of the validationKey or decryptionKey of a machineKey XML element
    expected:
      - name: web.config
        start_offset: 27
        end_offset: 154
      - name: web.config
        start_offset: 171
        end_offset: 235
    test:
      data: |
        <machineKey decryptionKey="ABAA84D7EC4BB56D75D217CECFFB9628809BDB8BF91CFCD64568A145BE59719F" decryption="AES" />
      start_offset: 27
      end_offset: 91


  - name: .env file style secrets
    type: env_passwords
    description: |
      Find .env file style secrets in configuration files such as .env, Dockerfile, shell scripts etc.
    experimental: true
    regex:
      version: 0.1
      pattern: |
        [^\r\n\x00-\x08'"#]{8,}
      start: |
        (?:\n|\A)((export|ENV|ARG) )?[A-Z_]*(?:SECRET|PASS(?:WD|WOR[TD]|CODE|PHRASE)?|KEY|TOKEN)=['"]?
      end: |
        [\r\n#]|['"]\s*[\r\n]|\z
      additional_not_match:
        # variable, process substitution
        - ^\$(\{[^}]+\}|\([^)]+\)|[A-Za-z_]+|[0-9])$
        # placeholders
        - ^(<[^>]+>|\[[^]+\]|\{[^}+\}|(your|my|the|a)_[a-z_]+|.*(passwor[t]|key|secret|token|密码).*|\.\.\.|xxx+|yyy+|zzz+|aaa+|bbb+|ccc+)$
        # non-secret related "key" content
        - ^(test|value)([._-][a-z_.-]+)?$
        # non-secret related content
        - ^(?i)(true|false|y(es)?|no?|on|off|0|1|nill|null|none|(\\x[a-f0-9]{2})+)$
        # a path
        - '^(/|file:///|https?://[A-Za-z]:/)[A-Za-z0-9._-]{3,}+(/[a-z._-]{1,}){2,}/?$'
    comments:
      - "Looks for secrets in the format of `SECRET=secret` at the start of a line, possibly with an `ENV ` or `export ` prefix"
      - "Allows no whitespace in the secret, to cut false positives"
      - "Some false positives in code might appear, especially where the variable name is 'key' or 'token'"
      - "The pattern only checks for certain key words to begin the pattern (`secret`, `password`, etc.)"
      - "More restrictive than the Generic Passwords pattern, so less prone to false positives"
      - "Lower length limit of 8 to remove FPs"
    test:
      data: |
        SECRET_KEY=password123
      start_offset: 11
      end_offset: 22


  - name: YAML with Base64 encoded secrets
    type: yaml_base64
    description: |
      Hardcoded Base64-encoded passwords in YAML configuration files
    experimental: true
    regex:
      version: 0.1
      pattern: |
        (([A-Za-z0-9+/]){4})*([A-Za-z0-9+/]{4}|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{2}==)
      start: |
        (?:\n|\A)[ \t]*(?i)[a-z_-]*(?:secret|service_pass(wd|word|code|phrase)|pass(?:wd|word|code|phrase)?|key|token)[ \t]*:[ \t]*(['"]?|[|>]-?[ \t]*\n[ \t]*)
      end: |
        ['"\r\n]|\z
      additional_match:
        - '[0-9]'
        - '[A-Z]'
        - '[a-z]'
        - '^.{12,}$'
    comments:
      - "The Base64 must contain numbers, upper case and lower case and be at least 12 characters long"
      - "Some false positives in code might appear"
    test:
      data: "password: AAAAAAAAAAAa00=="
      start_offset: 10
      end_offset: 26


  - name: YAML with URI-safe Base64 encoded secrets
    type: yaml_base64_uri
    description: |
      Hardcoded URI-safe Base64-encoded passwords in YAML configuration files
    experimental: true
    regex:
      version: 0.1
      pattern: |
        (([A-Za-z0-9_-]){4})*([A-Za-z0-9_-]{4}|[A-Za-z0-9_-]{3}=|[A-Za-z0-9_-]{2}==)
      start: |
        (?:\n|\A)[ \t]*(?i)[a-z_-]*(?:secret|service_pass(wd|word|code|phrase)|pass(?:wd|word|code|phrase)?|key|token)[ \t]*:[ \t]*(['"]?|[|>]-?[ \t]*\n[ \t]*)
      end: |
        ['"\r\n]|\z
      additional_match:
        - '[0-9]'
        - '[A-Z]'
        - '[a-z]'
        - '^.{12,}$'
    comments:
      - "The Base64 must contain numbers, upper case and lower case and be at least 12 characters long"
      - "Some false positives in code might appear"
      - "This matches _- instead of +/, for URI-safe Base64"
    test:
      data: "password: AAAAAAAAAAAa00=="
      start_offset: 10
      end_offset: 26


  - name: YAML with hex token
    type: yaml_token
    description: |
      Hardcoded hex-encoded tokens in YAML configuration files
    experimental: true
    regex:
      version: 0.1
      pattern: |
        [0-9a-f]{32}|[0-9a-f]{40}|[0-9a-f]{64}
      start: |
        (?:\n|\A)[ \t]*(?i)[a-z_-]*(?:secret|service_pass(wd|word|code|phrase)|pass(?:wd|word|code|phrase)?|key|token)[ \t]*:[ \t]*(['"]?|[|>]-?[ \t]*\n[ \t]*)
      end: |
        ['"\r\n]|\z
      additional_match:
        - '[0-9]'
        - '[a-f]'
    comments:
      - "The hex token must be 32, 40 or 64 characters long, and contain numbers and letters"
      - "Some false positives in code might appear"
    test:
      data: "password: 0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef"
      start_offset: 10
      end_offset: 74


  - name: JSON with Base64 encoded secrets
    type: json_base64
    description: |
      Hardcoded Base64-encoded passwords in JSON configuration files
    experimental: true
    regex:
      version: 0.1
      pattern: |
        (([A-Za-z0-9+/]){4})*([A-Za-z0-9+/]{4}|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{2}==)
      start: |
        [{[,][ \t]*[ \t\r\n]*"(?i)[a-z_.-]*(?:secret|service_pass(wd|word|code|phrase)|pass(?:wd|word|code|phrase)?|key|token)"[ \t]*:[ \t]*"
      end: |
        "[ \t\r\n]*[,}\]]
      additional_match:
        - '[0-9]'
        - '[A-Z]'
        - '[a-z]'
        - '^.{12,}$'
    comments:
      - "The Base64 must contain numbers, upper case and lower case and be at least 12 characters long"
      - "This may match in code, such as Python, that resembles JSON"
      - "This will not match some isolated fragments of JSON, so be aware of that when testing it"
    test:
      data: |
        {"password": "AAAAAAAAAAAa00==", "user": "admin"}
      start_offset: 14
      end_offset: 30


  - name: JSON with URI-safe Base64 encoded secrets
    type: json_base64_uri
    description: |
      Hardcoded URI-safe Base64-encoded passwords in JSON configuration files
    experimental: true
    regex:
      version: 0.1
      pattern: |
        (([A-Za-z0-9_-]){4})*([A-Za-z0-9_-]{4}|[A-Za-z0-9_-]{3}=|[A-Za-z0-9_-]{2}==)
      start: |
        [{[,][ \t]*[ \t\r\n]*"(?i)[a-z_.-]*(?:secret|service_pass(wd|word|code|phrase)|pass(?:wd|word|code|phrase)?|key|token)"[ \t]*:[ \t]*"
      end: |
        "[ \t\r\n]*[,}\]]
      additional_match:
        - '[0-9]'
        - '[A-Z]'
        - '[a-z]'
        - '^.{12,}$'
    comments:
      - "The Base64 must contain numbers, upper case and lower case and be at least 12 characters long"
      - "This may match in code, such as Python, that resembles JSON"
      - "This will not match some isolated fragments of JSON, so be aware of that when testing it"
      - "This matches _- instead of +/, for URI-safe Base64"
    test:
      data: |
        {"password": "AAAAAAAAAAAa00==", "user": "admin"}
      start_offset: 14
      end_offset: 30


  - name: JSON with hex encoded secrets
    type: json_token
    description: |
      Hardcoded hex-encoded tokens in JSON configuration files
    experimental: true
    regex:
      version: 0.1
      pattern: |
        [0-9a-f]{32}|[0-9a-f]{40}|[0-9a-f]{64}
      start: |
        [{[,][ \t]*[ \t\r\n]*"(?i)[a-z_-]*(?:secret|service_pass(wd|word|code|phrase)|pass(?:wd|word|code|phrase)?|key|token)"[ \t]*:[ \t]*"
      end: |
        "[ \t\r\n]*[,}\]]
      additional_match:
        - '[0-9]'
        - '[a-f]'
    comments:
      - "The hex token must be 32, 40 or 64 characters long, and contain numbers and letters"
      - "This may match in code, such as Python, that resembles JSON"
      - "This will not match some isolated fragments of JSON, so be aware of that when testing it"
    test:
      data: |
        {"password": "0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef", "user": "admin"}
      start_offset: 14
      end_offset: 78