Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

fix(telegram_bot_token): Regex must match just bot tokens #878

Open
wants to merge 5 commits into
base: master
Choose a base branch
from

Conversation

jfagoagas
Copy link

@jfagoagas jfagoagas commented Sep 3, 2024

  • Please check if the PR fulfils these requirements
  • Tests for the changes have been added
  • Docs have been added / updated
  • All CI checks are green
(venv) ➜  time python -m pytest tests/plugins/telegram_token_test.py
================================================================================ test session starts =================================================================================
platform darwin -- Python 3.11.9, pytest-7.4.3, pluggy-1.5.0
rootdir: /private/tmp/detect-secrets
plugins: xdist-3.6.1
collected 6 items

tests/plugins/telegram_token_test.py ......                                                                                                                                    [100%]

================================================================================= 6 passed in 0.05s ==================================================================================
python -m pytest tests/plugins/telegram_token_test.py  0,21s user 0,04s system 96% cpu 0,262 total
  • What kind of change does this PR introduce?

This PR fixes a bug with the TelegramBotToken since some AWS ARNs were matched against it due to the regex configured in the deny_list.

  • What is the current behaviour?

The following AWS ARN arn:aws:sns:aaa:111122223333:aaaaaaaaaaaaaaaaaaassssssdddddddddddd matches against the TelegramBotToken when the verify option is not enabled, but it should not be needed to be verified since it is not.

This match because the regex is not enough restrictive from the beginning and the end.

  • What is the new behaviour (if this is a feature change)?
    Add the start-of-line ^ and end-of-line $ character to reduce false positives.

  • Does this PR introduce a breaking change?

No.

  • Other information:

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

1 participant