feat: pam built-in masking - #403
sheensantoscapadngan wants to merge 2 commits into
Conversation
|
💬 Discussion in Slack: #pr-review-cli-403-feat-pam-built-in-masking Posted by Review Police — reviews, comments, new commits, and CI failures will stream into this channel. |
|
| GitGuardian id | GitGuardian status | Secret | Commit | Filename | |
|---|---|---|---|---|---|
| 37371478 | Triggered | JSON Web Token | 42c1446 | packages/pam/session/masking/masking_test.go | View secret |
| 37409076 | Triggered | Generic High Entropy Secret | cf98da7 | packages/pam/session/masking/masking_test.go | View secret |
🛠 Guidelines to remediate hardcoded secrets
- Understand the implications of revoking this secret by investigating where it is used in your code.
- Replace and store your secrets safely. Learn here the best practices.
- Revoke and rotate these secrets.
- If possible, rewrite git history. Rewriting git history is not a trivial act. You might completely break other contributing developers' workflow and you risk accidentally deleting legitimate data.
To avoid such incidents in the future consider
- following these best practices for managing and storing secrets including API keys and other credentials
- install secret detection on pre-commit to catch secret before it leaves your machine and ease remediation.
🦉 GitGuardian detects secrets in your source code to help developers and security teams secure the modern development process. You are seeing this because you or someone else with access to this repository has authorized GitGuardian to scan your pull request.
 |
![greptile-apps[bot]](https://avatars.githubusercontent.com/in/867647?s=60&v=4){kind=small}
![veria-ai[bot]](https://avatars.githubusercontent.com/in/1723776?s=60&v=4){kind=small}
PR overviewAll previously flagged issues have been addressed. No open security concerns remain on this pull request. Security reviewNo open security issues remain on this pull request. Fixed/addressed: 1 · PR risk: 0/10 |
| if len(finding.Secret) < minSecretLength { | ||
| continue | ||
| } | ||
| result = strings.ReplaceAll(result, finding.Secret, Placeholder) |
There was a problem hiding this comment.
The logger masks one rendered terminal line at a time, so anything spanning many lines never matches. Confirmed cat id_rsa still leaks the key body with detection on, since the private-key rule needs the whole BEGIN/END block in one fragment. credentialValues has the same gap for c.PrivateKey.
| } | ||
| // Longest first: a credential containing another (a passphrase inside a key block) must be | ||
| // redacted before the shorter one rewrites the text around it. | ||
| for i := 1; i < len(secrets); i++ { |
There was a problem hiding this comment.
A bit of a nit but Claude says:
we should just use sort.SliceStable here
| // Declared on each heartbeat. The platform stores the map verbatim, so an absent key means the | ||
| // gateway is too old to support the feature, not that the feature is off. |
There was a problem hiding this comment.
A bit of a nit but I think this comment is useless
| @@ -0,0 +1,252 @@ | |||
| package masking | |||
There was a problem hiding this comment.
If we end up fixing the multi-line detection for stuff like private keys, we should add a test case for that here.
2 participants
Description 📣
This PR adds support for built-in PAM masking
Type ✨
Tests 🛠️
# Here's some code block to paste some code snippets