Skip to content

Commit bbc2ec9

Browse files
asloobqasloobq
authored
Merge pull request #33 from IABTechLab/aaq-UID2-3163-enable-secret-scanning
Add pre-commit and trivy scan configs
2 parents ebdeb84 + 17019d6 commit bbc2ec9

File tree

2 files changed

+229
-0
lines changed

2 files changed

+229
-0
lines changed

‎.pre-commit-config.yaml‎

Lines changed: 19 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,19 @@
1+
repos:
2+
- repo: https://github.com/mxab/pre-commit-trivy.git
3+
rev: v0.12.0
4+
hooks:
5+
- id: trivyfs-docker
6+
args:
7+
- --scanners
8+
- secret
9+
- --secret-config
10+
- /src/trivy-secret.yaml
11+
- --skip-dirs
12+
- /src/target
13+
- --skip-dirs
14+
- /src/.idea
15+
- --skip-dirs
16+
- /src/venv
17+
- --skip-files
18+
- /src/e2e/docker/localstack/kms/seed.yaml
19+
- .

‎trivy-secret.yaml‎

Lines changed: 210 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,210 @@
1+
rules:
2+
##################
3+
# UID2 Admin Key #
4+
##################
5+
- id: uid2-admin-key-test
6+
category: uid2
7+
title: UID2 - Admin Key - Test
8+
severity: CRITICAL
9+
keywords:
10+
- UID2-A-T
11+
regex: UID2-A-T-(?P<secret>.{6}\..{38})
12+
secret-group-name: secret
13+
- id: uid2-admin-key-integ
14+
category: uid2
15+
title: UID2 - Admin Key - Integ
16+
severity: CRITICAL
17+
keywords:
18+
- UID2-A-I
19+
regex: UID2-A-I-(?P<secret>.{6}\..{38})
20+
secret-group-name: secret
21+
- id: uid2-admin-key-prod
22+
category: uid2
23+
title: UID2 - Admin Key - Prod
24+
severity: CRITICAL
25+
keywords:
26+
- UID2-A-P
27+
regex: UID2-A-P-(?P<secret>.{6}\..{38})
28+
secret-group-name: secret
29+
30+
###################
31+
# UID2 Client Key #
32+
###################
33+
- id: uid2-client-key-test
34+
category: uid2
35+
title: UID2 - Client Key - Test
36+
severity: CRITICAL
37+
keywords:
38+
- UID2-C-T
39+
regex: UID2-C-T-[0-9]+-(?P<secret>.{6}\..{38})
40+
secret-group-name: secret
41+
- id: uid2-client-key-integ
42+
category: uid2
43+
title: UID2 - Client Key - Integ
44+
severity: CRITICAL
45+
keywords:
46+
- UID2-C-I
47+
regex: UID2-C-I-[0-9]+-(?P<secret>.{6}\..{38})
48+
secret-group-name: secret
49+
- id: uid2-client-key-prod
50+
category: uid2
51+
title: UID2 - Client Key - Prod
52+
severity: CRITICAL
53+
keywords:
54+
- UID2-C-P
55+
regex: UID2-C-P-[0-9]+-(?P<secret>.{6}\..{38})
56+
secret-group-name: secret
57+
58+
#####################
59+
# UID2 Operator Key #
60+
#####################
61+
- id: uid2-operator-key-test
62+
category: uid2
63+
title: UID2 - Operator Key - Test
64+
severity: CRITICAL
65+
keywords:
66+
- UID2-O-T
67+
regex: UID2-O-T-[0-9]+-(?P<secret>.{6}\..{38})
68+
secret-group-name: secret
69+
- id: uid2-operator-key-integ
70+
category: uid2
71+
title: UID2 - Operator Key - Integ
72+
severity: CRITICAL
73+
keywords:
74+
- UID2-O-I
75+
regex: UID2-O-I-[0-9]+-(?P<secret>.{6}\..{38})
76+
secret-group-name: secret
77+
- id: uid2-operator-key-prod
78+
category: uid2
79+
title: UID2 - Operator Key - Prod
80+
severity: CRITICAL
81+
keywords:
82+
- UID2-O-P
83+
regex: UID2-O-P-[0-9]+-(?P<secret>.{6}\..{38})
84+
secret-group-name: secret
85+
86+
########################################
87+
# UID2 Client Side Keypair Private Key #
88+
########################################
89+
- id: uid2-client-side-keypair-private-key-test
90+
category: uid2
91+
title: UID2 - Client Side Keypair Private Key - Test
92+
severity: CRITICAL
93+
keywords:
94+
- UID2-Y-T
95+
regex: (?P<secret>UID2-Y-T-.{92})
96+
secret-group-name: secret
97+
- id: uid2-client-side-keypair-private-key-integ
98+
category: uid2
99+
title: UID2 - Client Side Keypair Private Key - Integ
100+
severity: CRITICAL
101+
keywords:
102+
- UID2-Y-I
103+
regex: (?P<secret>UID2-Y-I-.{92})
104+
secret-group-name: secret
105+
- id: uid2-client-side-keypair-private-key-prod
106+
category: uid2
107+
title: UID2 - Client Side Keypair Private Key - Prod
108+
severity: CRITICAL
109+
keywords:
110+
- UID2-Y-P
111+
regex: (?P<secret>UID2-Y-P-.{92})
112+
secret-group-name: secret
113+
114+
##################
115+
# EUID Admin Key #
116+
##################
117+
- id: euid-admin-key-test
118+
category: euid
119+
title: EUID - Admin Key - Test
120+
severity: CRITICAL
121+
keywords:
122+
- EUID-A-T
123+
regex: EUID-A-T-(?P<secret>.{6}\..{38})
124+
secret-group-name: secret
125+
- id: euid-admin-key-integ
126+
category: euid
127+
title: EUID - Admin Key - Integ
128+
severity: CRITICAL
129+
keywords:
130+
- EUID-A-I
131+
regex: EUID-A-I-(?P<secret>.{6}\..{38})
132+
secret-group-name: secret
133+
- id: euid-admin-key-prod
134+
category: euid
135+
title: EUID - Admin Key - Prod
136+
severity: CRITICAL
137+
keywords:
138+
- EUID-A-P
139+
regex: EUID-A-P-(?P<secret>.{6}\..{38})
140+
secret-group-name: secret
141+
142+
###################
143+
# EUID Client Key #
144+
###################
145+
- id: euid-client-key-test
146+
category: euid
147+
title: EUID - Client Key - Test
148+
severity: CRITICAL
149+
keywords:
150+
- EUID-C-T
151+
regex: EUID-C-T-[0-9]+-(?P<secret>.{6}\..{38})
152+
secret-group-name: secret
153+
- id: euid-client-key-integ
154+
category: euid
155+
title: EUID - Client Key - Integ
156+
severity: CRITICAL
157+
keywords:
158+
- EUID-C-I
159+
regex: EUID-C-I-[0-9]+-(?P<secret>.{6}\..{38})
160+
secret-group-name: secret
161+
- id: euid-client-key-prod
162+
category: euid
163+
title: EUID - Client Key - Prod
164+
severity: CRITICAL
165+
keywords:
166+
- EUID-C-P
167+
regex: EUID-C-P-[0-9]+-(?P<secret>.{6}\..{38})
168+
secret-group-name: secret
169+
170+
#####################
171+
# EUID Operator Key #
172+
#####################
173+
- id: euid-operator-key-test
174+
category: euid
175+
title: EUID - Operator Key - Test
176+
severity: CRITICAL
177+
keywords:
178+
- EUID-O-T
179+
regex: EUID-O-T-[0-9]+-(?P<secret>.{6}\..{38})
180+
secret-group-name: secret
181+
- id: euid-operator-key-integ
182+
category: euid
183+
title: EUID - Operator Key - Integ
184+
severity: CRITICAL
185+
keywords:
186+
- EUID-O-I
187+
regex: EUID-O-I-[0-9]+-(?P<secret>.{6}\..{38})
188+
secret-group-name: secret
189+
- id: euid-operator-key-prod
190+
category: euid
191+
title: EUID - Operator Key - Prod
192+
severity: CRITICAL
193+
keywords:
194+
- EUID-O-P
195+
regex: EUID-O-P-[0-9]+-(?P<secret>.{6}\..{38})
196+
secret-group-name: secret
197+
198+
disable-allow-rules:
199+
- tests
200+
- examples
201+
- vendor
202+
- usr-dirs
203+
- locale-dir
204+
- markdown
205+
- node.js
206+
- golang
207+
- python
208+
- rubygems
209+
- wordpress
210+
- anaconda-log

0 commit comments

Comments
 (0)