Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[bug] - Ignore FP check for the private key detector #2793

Merged
merged 1 commit into from
May 6, 2024

Conversation

ahrav
Copy link
Collaborator

@ahrav ahrav commented May 6, 2024

Description:

This PR fixes a regression introduced in this PR, where we moved the false positive check to the engine. Unfortunately, the private key detector didn’t originally have a false positive check, so the default check was mistakenly added. This PR ensures the private key detector does not run the false positive check on its results.

Checklist:

  • Tests passing (make test-community)?
  • Lint passing (make lint this requires golangci-lint)?

@ahrav ahrav marked this pull request as ready for review May 6, 2024 21:23
@ahrav ahrav requested a review from a team as a code owner May 6, 2024 21:23
@ahrav ahrav linked an issue May 6, 2024 that may be closed by this pull request
@ahrav ahrav requested a review from a team May 6, 2024 21:28
@ahrav ahrav merged commit 27eae92 into main May 6, 2024
11 of 12 checks passed
@ahrav ahrav deleted the bug-detect-unverified-private-key branch May 6, 2024 21:41
@rgmz
Copy link
Contributor

rgmz commented May 6, 2024

While this may fix the symptom, I'm curious what the actual cause is. At a cursory glance, there's nothing obvious in the false positive logic change that would cause this.

Edit: perhaps this worldist entry?

@ahrav
Copy link
Collaborator Author

ahrav commented May 6, 2024

While this may fix the symptom, I'm curious what the actual cause is. At a cursory glance, there's nothing obvious in the false positive logic change that would cause this.

Edit: perhaps this worldist entry?

That and the DefaultFalsePositives, the private key used to test had aaaaaa.

haraldh added a commit to matter-labs/vault-auth-tee that referenced this pull request May 7, 2024
[![Mend
Renovate](https://app.renovatebot.com/images/banner.svg)](https://renovatebot.com)

This PR contains the following updates:

| Package | Type | Update | Change |
|---|---|---|---|
|
[trufflesecurity/trufflehog](https://togithub.com/trufflesecurity/trufflehog)
| action | patch | `v3.75.0` -> `v3.75.1` |

---

### Release Notes

<details>
<summary>trufflesecurity/trufflehog
(trufflesecurity/trufflehog)</summary>

###
[`v3.75.1`](https://togithub.com/trufflesecurity/trufflehog/releases/tag/v3.75.1)

[Compare
Source](https://togithub.com/trufflesecurity/trufflehog/compare/v3.75.0...v3.75.1)

#### What's Changed

- Update result's extra data for Slack by
[@&#8203;abmussani](https://togithub.com/abmussani) in
[trufflesecurity/trufflehog#2779
- \[chore] - Update default buffer size by
[@&#8203;ahrav](https://togithub.com/ahrav) in
[trufflesecurity/trufflehog#2778
- fix(deps): update module cloud.google.com/go/secretmanager to v1.13.0
by [@&#8203;renovate](https://togithub.com/renovate) in
[trufflesecurity/trufflehog#2775
- fix(deps): update module github.com/aws/aws-sdk-go to v1.52.2 by
[@&#8203;renovate](https://togithub.com/renovate) in
[trufflesecurity/trufflehog#2776
- fix(deps): update module github.com/googleapis/gax-go/v2 to v2.12.4 by
[@&#8203;renovate](https://togithub.com/renovate) in
[trufflesecurity/trufflehog#2781
- fix(deps): update module github.com/charmbracelet/bubbletea to v0.26.1
by [@&#8203;renovate](https://togithub.com/renovate) in
[trufflesecurity/trufflehog#2777
- fix(deps): update module golang.org/x/oauth2 to v0.20.0 by
[@&#8203;renovate](https://togithub.com/renovate) in
[trufflesecurity/trufflehog#2785
- fix(deps): update module golang.org/x/text to v0.15.0 by
[@&#8203;renovate](https://togithub.com/renovate) in
[trufflesecurity/trufflehog#2786
- fix(deps): update module google.golang.org/protobuf to v1.34.1 by
[@&#8203;renovate](https://togithub.com/renovate) in
[trufflesecurity/trufflehog#2790
- \[bug] - Ignore FP check for the private key detector by
[@&#8203;ahrav](https://togithub.com/ahrav) in
[trufflesecurity/trufflehog#2793

#### New Contributors

- [@&#8203;abmussani](https://togithub.com/abmussani) made their first
contribution in
[trufflesecurity/trufflehog#2779

**Full Changelog**:
trufflesecurity/trufflehog@v3.75.0...v3.75.1

</details>

---

### Configuration

📅 **Schedule**: Branch creation - At any time (no schedule defined),
Automerge - At any time (no schedule defined).

🚦 **Automerge**: Disabled by config. Please merge this manually once you
are satisfied.

♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the
rebase/retry checkbox.

🔕 **Ignore**: Close this PR and you won't be reminded about this update
again.

---

- [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check
this box

---

This PR has been generated by [Mend
Renovate](https://www.mend.io/free-developer-tools/renovate/). View
repository job log
[here](https://developer.mend.io/github/matter-labs/vault-auth-tee).

<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiIzNy4zNDAuMTAiLCJ1cGRhdGVkSW5WZXIiOiIzNy4zNDAuMTAiLCJ0YXJnZXRCcmFuY2giOiJtYWluIiwibGFiZWxzIjpbXX0=-->
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Development

Successfully merging this pull request may close these issues.

Private keys not being detected by Trufflehog >=3.74.0
3 participants