Skip to content

Commit a027585

Browse files
DariuszPorowskiDariuszPorowski
authoredMar 12, 2025··
enhance action inputs (#82)
Add: - exit_code - log_opts - max_decode_depth
·
v2.1.0v2
1 parent 97d8d46 commit a027585

File tree

6 files changed

+64
-41
lines changed

6 files changed

+64
-41
lines changed
 

‎.gitleaks/UDMSecretChecks.toml

+18-18
Original file line numberDiff line numberDiff line change
@@ -35,7 +35,7 @@ id = "CSCAN0030"
3535
description = "PublishSettings"
3636
regex = '''userPWD="[a-zA-Z0-9\+\/]{60}"'''
3737
path = '''(?i)(publishsettings|\.pubxml$)'''
38-
[rules.allowlist]
38+
[rules.allowlists]
3939
regexes = [
4040
'''Credentials?Type|ConnectionStringKey|notasecret|PartitionKey|notreal|insertkey|LookupKey|IgnoreKeys|SecretsService|SecretsTenantId|(?:Password|pwd|secret|credentials?)(?:Key|Location)|KeyManager''',
4141
'''(?:_AppKey"|(?:(?:credential|password|token)s?|(?:Account|access)Key=)"[\s\r?\n]*/|Username"|\.dll|(?:Secret|Token|Key|Credential)s?(?:Encryption|From|(?:Signing)?Certificate|Options|Thumbprint|Contacts|String|UserId)|Key(1;value1|word|s?Path|Index|Id|Store|WillDoWithoutValidation|:NamePattern|Name"|Ref")|(Secret|Credential)s?(Name|Path)"|(StrongName|Chaos\s?Mon|Redis|Registry|Registery|User|Insights?|Instrumentation|Match\()Key|(Certificate|cert)(Issuer|Subject)|rollingdate|skuId|HKEY_|AddServicePrincipalCredentials|Password Resets|SecretStore|(0|x|\*){8,})''',
@@ -52,7 +52,7 @@ id = "CSCAN0091-1"
5252
description = "AspNetMachineKeyInConfig1"
5353
path = '''\.(?:xml|pubxml|definitions|ps1|wadcfgx|ccf|config|cscfg|json|js|txt|cpp|sql|dtsx|md|java|FF|template|settings|ini|BF|ste|isml|test|ts|resx|Azure|sample|backup|rd|hpp|psm1|cshtml|htm|bat|waz|yml|Beta|py|sh|m|php|xaml|keys|cmd|rds|loadtest|properties)$|hubot'''
5454
regex = '''<machineKey[^>]+(?:decryptionKey\s*\=\s*"[a-fA-F0-9]{48,}|validationKey\s*\=\s*"[a-fA-F0-9]{48,})[^>]+>'''
55-
[rules.allowlist]
55+
[rules.allowlists]
5656
regexes = [
5757
'''Credentials?Type|ConnectionStringKey|notasecret|PartitionKey|notreal|insertkey|LookupKey|IgnoreKeys|SecretsService|SecretsTenantId|(?:Password|pwd|secret|credentials?)(?:Key|Location)|KeyManager''',
5858
'''(?:_AppKey"|(?:(?:credential|password|token)s?|(?:Account|access)Key=)"[\s\r?\n]*/|Username"|\.dll|(?:Secret|Token|Key|Credential)s?(?:Encryption|From|(?:Signing)?Certificate|Options|Thumbprint|Contacts|String|UserId)|Key(1;value1|word|s?Path|Index|Id|Store|WillDoWithoutValidation|:NamePattern|Name"|Ref")|(Secret|Credential)s?(Name|Path)"|(StrongName|Chaos\s?Mon|Redis|Registry|Registery|User|Insights?|Instrumentation|Match\()Key|(Certificate|cert)(Issuer|Subject)|rollingdate|skuId|HKEY_|AddServicePrincipalCredentials|Password Resets|SecretStore|(0|x|\*){8,})''',
@@ -63,7 +63,7 @@ id = "CSCAN0091-2"
6363
description = "AspNetMachineKeyInConfig2"
6464
path = '''\.(?:xml|pubxml|definitions|ps1|wadcfgx|ccf|config|cscfg|json|js|txt|cpp|sql|dtsx|md|java|FF|template|settings|ini|BF|ste|isml|test|ts|resx|Azure|sample|backup|rd|hpp|psm1|cshtml|htm|bat|waz|yml|Beta|py|sh|m|php|xaml|keys|cmd|rds|loadtest|properties)$|hubot'''
6565
regex = '''(?:decryptionKey|validationKey)="[a-zA-Z0-9]+"'''
66-
[rules.allowlist]
66+
[rules.allowlists]
6767
regexes = [
6868
'''Credentials?Type|ConnectionStringKey|notasecret|PartitionKey|notreal|insertkey|LookupKey|IgnoreKeys|SecretsService|SecretsTenantId|(?:Password|pwd|secret|credentials?)(?:Key|Location)|KeyManager''',
6969
'''(?:_AppKey"|(?:(?:credential|password|token)s?|(?:Account|access)Key=)"[\s\r?\n]*/|Username"|\.dll|(?:Secret|Token|Key|Credential)s?(?:Encryption|From|(?:Signing)?Certificate|Options|Thumbprint|Contacts|String|UserId)|Key(1;value1|word|s?Path|Index|Id|Store|WillDoWithoutValidation|:NamePattern|Name"|Ref")|(Secret|Credential)s?(Name|Path)"|(StrongName|Chaos\s?Mon|Redis|Registry|Registery|User|Insights?|Instrumentation|Match\()Key|(Certificate|cert)(Issuer|Subject)|rollingdate|skuId|HKEY_|AddServicePrincipalCredentials|Password Resets|SecretStore|(0|x|\*){8,})''',
@@ -74,15 +74,15 @@ id = "CSCAN0092-1"
7474
description = "SqlConnectionStringInConfig1"
7575
path = '''\.(?:xml|pubxml|definitions|ps1|wadcfgx|ccf|config|cscfg|json|js|txt|cpp|sql|dtsx|md|java|FF|template|settings|ini|BF|ste|isml|test|ts|resx|Azure|sample|backup|rd|hpp|psm1|cshtml|htm|bat|waz|yml|Beta|py|sh|m|php|xaml|keys|cmd|rds|loadtest|properties)$|hubot'''
7676
regex = '''(?i)(?:connection[sS]tring|connString)[^=]*=["'][^"']*[pP]assword\s*=\s*[^\s;][^"']*(?:'|")'''
77-
[rules.allowlist]
77+
[rules.allowlists]
7878
regexes = '''Credentials?Type|ConnectionStringKey|notasecret|PartitionKey|notreal|insertkey|LookupKey|IgnoreKeys|SecretsService|SecretsTenantId|(?:Password|pwd|secret|credentials?)(?:Key|Location)|KeyManager'''
7979

8080
[[rules]]
8181
id = "CSCAN0092-2"
8282
description = "SqlConnectionStringInConfig2"
8383
path = '''\.(?:xml|pubxml|definitions|ps1|wadcfgx|ccf|config|cscfg|json|js|txt|cpp|sql|dtsx|md|java|FF|template|settings|ini|BF|ste|isml|test|ts|resx|Azure|sample|backup|rd|hpp|psm1|cshtml|htm|bat|waz|yml|Beta|py|sh|m|php|xaml|keys|cmd|rds|loadtest|properties|policy_and_key\.hpp|AccountConfig\.h)$|hubot'''
8484
regex = '''(?i)(?:User ID|uid|UserId).*(?:Password|[^a-z]pwd)=[^'\$%<@'";\[\{][^;/"]{4,128}(?:;|")'''
85-
[rules.allowlist]
85+
[rules.allowlists]
8686
regexes = [
8787
'''Credentials?Type|ConnectionStringKey|notasecret|PartitionKey|notreal|insertkey|LookupKey|IgnoreKeys|SecretsService|SecretsTenantId|(?:Password|pwd|secret|credentials?)(?:Key|Location)|KeyManager''',
8888
'''(?:prefix <<|guestaccesstoken|skiptoken|cookie|tsm|fake|example|badlyFormatted|Invalid|sha512|sha256|"input"|ENCRYPTED|"EncodedRequestUri"|looks like|myStorageAccountName|(?:0|x|\*){8,})''',
@@ -93,7 +93,7 @@ id = "CSCAN0043"
9393
description = "SqlConnectionStringInCode"
9494
path = '''\.(?:xml|pubxml|definitions|ps1|wadcfgx|ccf|config|cscfg|json|js|txt|cpp|sql|dtsx|md|java|FF|template|settings|ini|BF|ste|isml|test|ts|resx|Azure|sample|backup|rd|hpp|psm1|cshtml|htm|bat|waz|yml|Beta|py|sh|m|php|xaml|keys|cmd|rds|loadtest|properties|policy_and_key\.hpp|AccountConfig\.h)$|hubot'''
9595
regex = '''(?i)(?:User ID|uid|UserId).*(?:Password|[^a-z]pwd)=[^'\$%<@'";\[\{][^;/"]{4,128}(?:;|")'''
96-
[rules.allowlist]
96+
[rules.allowlists]
9797
regexes = [
9898
'''Credentials?Type|ConnectionStringKey|notasecret|PartitionKey|notreal|insertkey|LookupKey|IgnoreKeys|SecretsService|SecretsTenantId|(?:Password|pwd|secret|credentials?)(?:Key|Location)|KeyManager''',
9999
'''(?:prefix <<|guestaccesstoken|skiptoken|cookie|tsm|fake|example|badlyFormatted|Invalid|sha512|sha256|"input"|ENCRYPTED|"EncodedRequestUri"|looks like|myStorageAccountName|(?:0|x|\*){8,})''',
@@ -140,7 +140,7 @@ id = "CSCAN0095-1"
140140
description = "GeneralSecretInConfig1"
141141
path = '''\.(?:config|cscfg|json|js|txt|cpp|sql|dtsx|md|java|FF|template|settings|ini|BF|ste|isml|test|ts|resx|Azure|sample|backup|rd|hpp|psm1|cshtml|htm|bat|waz|yml|Beta|py|sh|m|php|xaml|keys|cmd|rds|loadtest|properties)$|hubot'''
142142
regex = '''<add\skey="[^"]+(?:key(?:s|[0-9])?|credentials?|secret(?:s|[0-9])?|password|token|KeyPrimary|KeySecondary|KeyOrSas|KeyEncrypted)"\s*value\s*="[^"]+"[^>]*/>'''
143-
[rules.allowlist]
143+
[rules.allowlists]
144144
regexes = [
145145
'''key\s*=\s*"[^"]*AppKey[^"]*"\s+value\s*=\s*"[a-z]+"''',
146146
'''value\s*=\s*"(?:[a-z]+(?: [a-z]+)+"|_+[a-z]+_+"|[a-z]+-[a-z]+-[a-z]+["-]|[a-z]+-[a-z]+"|[a-z]+\\[a-z]+"|\d+"|[^"]*ConnectionString")''',
@@ -155,7 +155,7 @@ id = "CSCAN0095-2"
155155
description = "GeneralSecretInConfig2"
156156
path = '''\.(?:config|cscfg|json|js|txt|cpp|sql|dtsx|md|java|FF|template|settings|ini|BF|ste|isml|test|ts|resx|Azure|sample|backup|rd|hpp|psm1|cshtml|htm|bat|waz|yml|Beta|py|sh|m|php|xaml|keys|cmd|rds|loadtest|properties)$|hubot'''
157157
regex = '''<add\skey="[^"]+"\s*value="[^"]*EncryptedSecret:[^"]+"\s*/>'''
158-
[rules.allowlist]
158+
[rules.allowlists]
159159
regexes = [
160160
'''key\s*=\s*"[^"]*AppKey[^"]*"\s+value\s*=\s*"[a-z]+"''',
161161
'''value\s*=\s*"(?:[a-z]+(?: [a-z]+)+"|_+[a-z]+_+"|[a-z]+-[a-z]+-[a-z]+["-]|[a-z]+-[a-z]+"|[a-z]+\\[a-z]+"|\d+"|[^"]*ConnectionString")''',
@@ -170,7 +170,7 @@ id = "CSCAN0095-3"
170170
description = "GeneralSecretInConfig3"
171171
path = '''\.(?:config|cscfg|json|js|txt|cpp|sql|dtsx|md|java|FF|template|settings|ini|BF|ste|isml|test|ts|resx|Azure|sample|backup|rd|hpp|psm1|cshtml|htm|bat|waz|yml|Beta|py|sh|m|php|xaml|keys|cmd|rds|loadtest|properties)$|hubot'''
172172
regex = '''<Credential\sname="[^"]*(?:key(?:s|[0-9])?|credentials?|secret(?:s|[0-9])?|password|token|KeyPrimary|KeySecondary|KeyOrSas|KeyEncrypted)"(\s*value\s*="[^"]+".*?/>|[^>]*>.*?</Credential>)'''
173-
[rules.allowlist]
173+
[rules.allowlists]
174174
regexes = [
175175
'''key\s*=\s*"[^"]*AppKey[^"]*"\s+value\s*=\s*"[a-z]+"''',
176176
'''value\s*=\s*"(?:[a-z]+(?: [a-z]+)+"|_+[a-z]+_+"|[a-z]+-[a-z]+-[a-z]+["-]|[a-z]+-[a-z]+"|[a-z]+\\[a-z]+"|\d+"|[^"]*ConnectionString")''',
@@ -185,7 +185,7 @@ id = "CSCAN0095-4"
185185
description = "GeneralSecretInConfig4"
186186
path = '''\.(?:config|cscfg|json|js|txt|cpp|sql|dtsx|md|java|FF|template|settings|ini|BF|ste|isml|test|ts|resx|Azure|sample|backup|rd|hpp|psm1|cshtml|htm|bat|waz|yml|Beta|py|sh|m|php|xaml|keys|cmd|rds|loadtest|properties)$|hubot'''
187187
regex = '''<setting\sname="[^"]*Password".*[\r?\n]*\s*<value>.+</value>'''
188-
[rules.allowlist]
188+
[rules.allowlists]
189189
regexes = [
190190
'''key\s*=\s*"[^"]*AppKey[^"]*"\s+value\s*=\s*"[a-z]+"''',
191191
'''value\s*=\s*"(?:[a-z]+(?: [a-z]+)+"|_+[a-z]+_+"|[a-z]+-[a-z]+-[a-z]+["-]|[a-z]+-[a-z]+"|[a-z]+\\[a-z]+"|\d+"|[^"]*ConnectionString")''',
@@ -218,7 +218,7 @@ id = "CSCAN0220-1"
218218
description = "DefaultPasswordContexts1"
219219
path = '''\.(?:ps1|psm1|)$'''
220220
regex = '''ConvertTo-SecureString(?:\s*-String)?\s*"[^$"\r?\n]+"'''
221-
[rules.allowlist]
221+
[rules.allowlists]
222222
regexes = [
223223
'''Credentials?Type|ConnectionStringKey|notasecret|PartitionKey|notreal|insertkey|LookupKey|IgnoreKeys|SecretsService|SecretsTenantId|(?:Password|pwd|secret|credentials?)(?:Key|Location)|KeyManager''',
224224
'''(?:_AppKey"|(?:(?:credential|password|token)s?|(?:Account|access)Key=)"[\s\r?\n]*/|Username"|\.dll|(?:Secret|Token|Key|Credential)s?(?:Encryption|From|(?:Signing)?Certificate|Options|Thumbprint|Contacts|String|UserId)|Key(1;value1|word|s?Path|Index|Id|Store|WillDoWithoutValidation|:NamePattern|Name"|Ref")|(Secret|Credential)s?(Name|Path)"|(StrongName|Chaos\s?Mon|Redis|Registry|Registery|User|Insights?|Instrumentation|Match\()Key|(Certificate|cert)(Issuer|Subject)|rollingdate|skuId|HKEY_|AddServicePrincipalCredentials|Password Resets|SecretStore|(0|x|\*){8,})''',
@@ -229,7 +229,7 @@ id = "CSCAN0220-2"
229229
description = "DefaultPasswordContexts2"
230230
path = '''\.(?:cs|xml|config|json|ts|cfg|txt|ps1|bat|cscfg|publishsettings|cmd|psm1|aspx|asmx|vbs|added_cluster|clean|pubxml|ccf|ini|svd|sql|c|xslt|csv|FF|ExtendedTests|settings|cshtml|template|trd|argpath)$|(config|certificate|publish|UT)\.js$|(commands|user|tests)\.cpp$'''
231231
regex = '''new\sX509Certificate2\([^()]*,\s*"[^"\r?\n]+"[^)]*\)'''
232-
[rules.allowlist]
232+
[rules.allowlists]
233233
regexes = [
234234
'''Credentials?Type|ConnectionStringKey|notasecret|PartitionKey|notreal|insertkey|LookupKey|IgnoreKeys|SecretsService|SecretsTenantId|(?:Password|pwd|secret|credentials?)(?:Key|Location)|KeyManager''',
235235
'''(?:_AppKey"|(?:(?:credential|password|token)s?|(?:Account|access)Key=)"[\s\r?\n]*/|Username"|\.dll|(?:Secret|Token|Key|Credential)s?(?:Encryption|From|(?:Signing)?Certificate|Options|Thumbprint|Contacts|String|UserId)|Key(1;value1|word|s?Path|Index|Id|Store|WillDoWithoutValidation|:NamePattern|Name"|Ref")|(Secret|Credential)s?(Name|Path)"|(StrongName|Chaos\s?Mon|Redis|Registry|Registery|User|Insights?|Instrumentation|Match\()Key|(Certificate|cert)(Issuer|Subject)|rollingdate|skuId|HKEY_|AddServicePrincipalCredentials|Password Resets|SecretStore|(0|x|\*){8,})''',
@@ -240,7 +240,7 @@ id = "CSCAN0220-3"
240240
description = "DefaultPasswordContexts3"
241241
path = '''\.(?:cs|xml|config|json|ts|cfg|txt|ps1|bat|cscfg|publishsettings|cmd|psm1|aspx|asmx|vbs|added_cluster|clean|pubxml|ccf|ini|svd|sql|c|xslt|csv|FF|ExtendedTests|settings|cshtml|template|trd|argpath)$|(config|certificate|publish|UT)\.js$|(commands|user|tests)\.cpp$'''
242242
regex = '''AdminPassword\s*=\s*"[^"\r?\n]+"'''
243-
[rules.allowlist]
243+
[rules.allowlists]
244244
regexes = [
245245
'''Credentials?Type|ConnectionStringKey|notasecret|PartitionKey|notreal|insertkey|LookupKey|IgnoreKeys|SecretsService|SecretsTenantId|(?:Password|pwd|secret|credentials?)(?:Key|Location)|KeyManager''',
246246
'''(?:_AppKey"|(?:(?:credential|password|token)s?|(?:Account|access)Key=)"[\s\r?\n]*/|Username"|\.dll|(?:Secret|Token|Key|Credential)s?(?:Encryption|From|(?:Signing)?Certificate|Options|Thumbprint|Contacts|String|UserId)|Key(1;value1|word|s?Path|Index|Id|Store|WillDoWithoutValidation|:NamePattern|Name"|Ref")|(Secret|Credential)s?(Name|Path)"|(StrongName|Chaos\s?Mon|Redis|Registry|Registery|User|Insights?|Instrumentation|Match\()Key|(Certificate|cert)(Issuer|Subject)|rollingdate|skuId|HKEY_|AddServicePrincipalCredentials|Password Resets|SecretStore|(0|x|\*){8,})''',
@@ -251,7 +251,7 @@ id = "CSCAN0220-4"
251251
description = "DefaultPasswordContexts4"
252252
path = '''\.(?:cs|xml|config|json|ts|cfg|txt|ps1|bat|cscfg|publishsettings|cmd|psm1|aspx|asmx|vbs|added_cluster|clean|pubxml|ccf|ini|svd|sql|c|xslt|csv|FF|ExtendedTests|settings|cshtml|template|trd|argpath)$|(config|certificate|publish|UT)\.js$|(commands|user|tests)\.cpp$'''
253253
regex = '''(?i)<password>.+</password>'''
254-
[rules.allowlist]
254+
[rules.allowlists]
255255
regexes = [
256256
'''Credentials?Type|ConnectionStringKey|notasecret|PartitionKey|notreal|insertkey|LookupKey|IgnoreKeys|SecretsService|SecretsTenantId|(?:Password|pwd|secret|credentials?)(?:Key|Location)|KeyManager''',
257257
'''(?:_AppKey"|(?:(?:credential|password|token)s?|(?:Account|access)Key=)"[\s\r?\n]*/|Username"|\.dll|(?:Secret|Token|Key|Credential)s?(?:Encryption|From|(?:Signing)?Certificate|Options|Thumbprint|Contacts|String|UserId)|Key(1;value1|word|s?Path|Index|Id|Store|WillDoWithoutValidation|:NamePattern|Name"|Ref")|(Secret|Credential)s?(Name|Path)"|(StrongName|Chaos\s?Mon|Redis|Registry|Registery|User|Insights?|Instrumentation|Match\()Key|(Certificate|cert)(Issuer|Subject)|rollingdate|skuId|HKEY_|AddServicePrincipalCredentials|Password Resets|SecretStore|(0|x|\*){8,})''',
@@ -262,7 +262,7 @@ id = "CSCAN0220-5"
262262
description = "DefaultPasswordContexts5"
263263
path = '''\.(?:cs|xml|config|json|ts|cfg|txt|ps1|bat|cscfg|publishsettings|cmd|psm1|aspx|asmx|vbs|added_cluster|clean|pubxml|ccf|ini|svd|sql|c|xslt|csv|FF|ExtendedTests|settings|cshtml|template|trd|argpath)$|(config|certificate|publish|UT)\.js$|(commands|user|tests)\.cpp$'''
264264
regex = '''ClearTextPassword"?\s*[:=]\s*"[^"\r?\n]+"'''
265-
[rules.allowlist]
265+
[rules.allowlists]
266266
regexes = [
267267
'''Credentials?Type|ConnectionStringKey|notasecret|PartitionKey|notreal|insertkey|LookupKey|IgnoreKeys|SecretsService|SecretsTenantId|(?:Password|pwd|secret|credentials?)(?:Key|Location)|KeyManager''',
268268
'''(?:_AppKey"|(?:(?:credential|password|token)s?|(?:Account|access)Key=)"[\s\r?\n]*/|Username"|\.dll|(?:Secret|Token|Key|Credential)s?(?:Encryption|From|(?:Signing)?Certificate|Options|Thumbprint|Contacts|String|UserId)|Key(1;value1|word|s?Path|Index|Id|Store|WillDoWithoutValidation|:NamePattern|Name"|Ref")|(Secret|Credential)s?(Name|Path)"|(StrongName|Chaos\s?Mon|Redis|Registry|Registery|User|Insights?|Instrumentation|Match\()Key|(Certificate|cert)(Issuer|Subject)|rollingdate|skuId|HKEY_|AddServicePrincipalCredentials|Password Resets|SecretStore|(0|x|\*){8,})''',
@@ -273,7 +273,7 @@ id = "CSCAN0220-6"
273273
description = "DefaultPasswordContexts6"
274274
path = '''\.(?:cs|xml|config|json|ts|cfg|txt|ps1|bat|cscfg|publishsettings|cmd|psm1|aspx|asmx|vbs|added_cluster|clean|pubxml|ccf|ini|svd|sql|c|xslt|csv|FF|ExtendedTests|settings|cshtml|template|trd|argpath)$|(config|certificate|publish|UT)\.js$|(commands|user|tests)\.cpp$'''
275275
regex = '''certutil.*?\-p\s+("[^"%]+"|'[^'%]+'|[^"']\S*\s)'''
276-
[rules.allowlist]
276+
[rules.allowlists]
277277
regexes = [
278278
'''Credentials?Type|ConnectionStringKey|notasecret|PartitionKey|notreal|insertkey|LookupKey|IgnoreKeys|SecretsService|SecretsTenantId|(?:Password|pwd|secret|credentials?)(?:Key|Location)|KeyManager''',
279279
'''(?:_AppKey"|(?:(?:credential|password|token)s?|(?:Account|access)Key=)"[\s\r?\n]*/|Username"|\.dll|(?:Secret|Token|Key|Credential)s?(?:Encryption|From|(?:Signing)?Certificate|Options|Thumbprint|Contacts|String|UserId)|Key(1;value1|word|s?Path|Index|Id|Store|WillDoWithoutValidation|:NamePattern|Name"|Ref")|(Secret|Credential)s?(Name|Path)"|(StrongName|Chaos\s?Mon|Redis|Registry|Registery|User|Insights?|Instrumentation|Match\()Key|(Certificate|cert)(Issuer|Subject)|rollingdate|skuId|HKEY_|AddServicePrincipalCredentials|Password Resets|SecretStore|(0|x|\*){8,})''',
@@ -284,7 +284,7 @@ id = "CSCAN0220-7"
284284
description = "DefaultPasswordContexts7"
285285
path = '''\.(?:cs|xml|config|json|ts|cfg|txt|ps1|bat|cscfg|publishsettings|cmd|psm1|aspx|asmx|vbs|added_cluster|clean|pubxml|ccf|ini|svd|sql|c|xslt|csv|FF|ExtendedTests|settings|cshtml|template|trd|argpath)$|(config|certificate|publish|UT)\.js$|(commands|user|tests)\.cpp$'''
286286
regex = '''password\s*=\s*N?(["][^"\r?\n]{4,}["]|['][^'\r?\n]{4,}['])'''
287-
[rules.allowlist]
287+
[rules.allowlists]
288288
regexes = [
289289
'''Credentials?Type|ConnectionStringKey|notasecret|PartitionKey|notreal|insertkey|LookupKey|IgnoreKeys|SecretsService|SecretsTenantId|(?:Password|pwd|secret|credentials?)(?:Key|Location)|KeyManager''',
290290
'''(?:_AppKey"|(?:(?:credential|password|token)s?|(?:Account|access)Key=)"[\s\r?\n]*/|Username"|\.dll|(?:Secret|Token|Key|Credential)s?(?:Encryption|From|(?:Signing)?Certificate|Options|Thumbprint|Contacts|String|UserId)|Key(1;value1|word|s?Path|Index|Id|Store|WillDoWithoutValidation|:NamePattern|Name"|Ref")|(Secret|Credential)s?(Name|Path)"|(StrongName|Chaos\s?Mon|Redis|Registry|Registery|User|Insights?|Instrumentation|Match\()Key|(Certificate|cert)(Issuer|Subject)|rollingdate|skuId|HKEY_|AddServicePrincipalCredentials|Password Resets|SecretStore|(0|x|\*){8,})''',
@@ -295,7 +295,7 @@ id = "CSCAN0160"
295295
description = "DomainPassword"
296296
regex = '''new(?:-object)?\s+System.Net.NetworkCredential\(?:.*?,\s*"[^"]+"'''
297297
path = '''\.cs$|\.c$|\.cpp$|\.ps1$|\.ps$|\.cmd$|\.bat$|\.log$|\.psd$|\.psm1$'''
298-
[rules.allowlist]
298+
[rules.allowlists]
299299
regexes = '''(%1%|\$MIGUSER_PASSWORD|%miguser_pwd%)'''
300300
description = "ignore placeholders"
301301

‎Dockerfile

+2-2
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
1-
FROM zricethezav/gitleaks:latest
2-
# FROM ghcr.io/zricethezav/gitleaks:latest
1+
# FROM zricethezav/gitleaks:latest
2+
FROM ghcr.io/gitleaks/gitleaks:latest
33

44
LABEL "com.github.actions.name"="Gitleaks Scanner"
55
LABEL "com.github.actions.description"="Runs Gitleaks in your CI/CD workflow"

‎LICENSE

+1-1
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
MIT License
22

3-
Copyright (c) 2022-2023 Dariusz Porowski
3+
Copyright (c) 2022-2025 Dariusz Porowski
44

55
Permission is hereby granted, free of charge, to any person obtaining a copy
66
of this software and associated documentation files (the "Software"), to deal

‎README.md

+22-18
Original file line numberDiff line numberDiff line change
@@ -10,17 +10,21 @@ This GitHub Action allows you to run [Gitleaks](https://github.com/gitleaks/gitl
1010
1111
## Inputs
1212

13-
| Name | Required | Type | Default value | Description |
14-
|---------------|:--------:|:------:|---------------------------------|----------------------------------------------------------------------------------|
15-
| source | false | string | $GITHUB_WORKSPACE | Path to source (relative to $GITHUB_WORKSPACE) |
16-
| config | false | string | /.gitleaks/UDMSecretChecks.toml | Config file path (relative to $GITHUB_WORKSPACE) |
17-
| baseline_path | false | string | *not set* | Path to baseline with issues that can be ignored (relative to $GITHUB_WORKSPACE) |
18-
| report_format | false | string | json | Report file format: json, csv, sarif |
19-
| no_git | false | bool | *not set* | Treat git repos as plain directories and scan those file |
20-
| redact | false | bool | true | Redact secrets from log messages and leaks |
21-
| fail | false | bool | true | Fail if secrets founded |
22-
| verbose | false | bool | true | Show verbose output from scan |
23-
| log_level | false | string | info | Log level (trace, debug, info, warn, error, fatal) |
13+
| Name | Required | Type | Default value | Description |
14+
|------------------|:--------:|:------:|---------------------------------|----------------------------------------------------------------------------------|
15+
| source | false | string | $GITHUB_WORKSPACE | Path to source (relative to $GITHUB_WORKSPACE) |
16+
| config | false | string | /.gitleaks/UDMSecretChecks.toml | Config file path (relative to $GITHUB_WORKSPACE) |
17+
| baseline_path | false | string | *not set* | Path to baseline with issues that can be ignored (relative to $GITHUB_WORKSPACE) |
18+
| report_format | false | string | json | Report file format: json, csv, sarif |
19+
| no_git | false | bool | *not set* | Treat git repos as plain directories and scan those file |
20+
| redact | false | bool | true | Redact secrets from log messages and leaks |
21+
| fail | false | bool | true | Fail if secrets founded |
22+
| verbose | false | bool | true | Show verbose output from scan |
23+
| log_level | false | string | info | Log level (trace, debug, info, warn, error, fatal) |
24+
| exit_code | false | int | 1 | Exit code when leaks have been encountered |
25+
| log_opts | false | string | *not set* | Exit code when leaks have been encountered |
26+
| max_decode_depth | false | int | 0 | Allow recursive decoding up to this depth (default "0", no decoding is done) |
27+
| follow_symlinks | false | bool | false | Scan files that are symlinks to other files |
2428

2529
> ⚠️ The solution provides predefined configuration (See: [.gitleaks](https://github.com/DariuszPorowski/github-action-gitleaks/tree/main/.gitleaks) path). You can override it by yours config using relative to `$GITHUB_WORKSPACE`.
2630
@@ -36,7 +40,7 @@ This GitHub Action allows you to run [Gitleaks](https://github.com/gitleaks/gitl
3640

3741
## Example usage
3842

39-
> ⚠️ You must use `actions/checkout` before the `github-action-gitleaks` step. If you are using `actions/checkout@v3` you must specify a commit depth other than the default which is 1.
43+
> ⚠️ You must use `actions/checkout` before the `github-action-gitleaks` step. If you are using `actions/checkout@v4` you must specify a commit depth other than the default which is 1.
4044
>
4145
> Using a `fetch-depth` of '0' clones the entire history. If you want to do a more efficient clone, use '2', but that is not guaranteed to work with pull requests.
4246
@@ -62,7 +66,7 @@ jobs:
6266
runs-on: ubuntu-latest
6367
steps:
6468
- name: Checkout
65-
uses: actions/checkout@v3
69+
uses: actions/checkout@v4
6670
with:
6771
fetch-depth: 0
6872

@@ -73,7 +77,7 @@ jobs:
7377
fail: false
7478

7579
- name: Post PR comment
76-
uses: actions/github-script@v6
80+
uses: actions/github-script@v7
7781
if: ${{ steps.gitleaks.outputs.exitcode == 1 && github.event_name == 'pull_request' }}
7882
with:
7983
github-token: ${{ github.token }}
@@ -101,7 +105,7 @@ jobs:
101105
102106
```yaml
103107
- name: Checkout
104-
uses: actions/checkout@v3
108+
uses: actions/checkout@v4
105109
with:
106110
fetch-depth: 0
107111

@@ -126,7 +130,7 @@ jobs:
126130

127131
- name: Upload Gitleaks SARIF report to code scanning service
128132
if: ${{ steps.gitleaks.outputs.exitcode == 1 }}
129-
uses: github/codeql-action/upload-sarif@v2
133+
uses: github/codeql-action/upload-sarif@v3
130134
with:
131135
sarif_file: ${{ steps.gitleaks.outputs.report }}
132136
```
@@ -137,7 +141,7 @@ jobs:
137141
138142
```yaml
139143
- name: Checkout
140-
uses: actions/checkout@v3
144+
uses: actions/checkout@v4
141145
with:
142146
fetch-depth: 0
143147

@@ -148,7 +152,7 @@ jobs:
148152
config: MyGitleaksConfigs/MyGitleaksConfig.toml
149153

150154
- name: Upload Gitleaks JSON report to artifacts
151-
uses: actions/upload-artifact@v3
155+
uses: actions/upload-artifact@v4
152156
if: failure()
153157
with:
154158
name: gitleaks

‎action.yml

+12-1
Original file line numberDiff line numberDiff line change
@@ -38,9 +38,20 @@ inputs:
3838
required: false
3939
default: "info"
4040
exit_code:
41-
description: "exit code when leaks have been encountered (default 1)"
41+
description: "Exit code when leaks have been encountered (default 1)"
4242
required: false
4343
default: "1"
44+
log_opts:
45+
description: "Git log options (default: <not set>)"
46+
required: false
47+
max_decode_depth:
48+
description: "Allow recursive decoding up to this depth (default 0, no decoding is done)"
49+
required: false
50+
default: "0"
51+
follow_symlinks:
52+
description: "Scan files that are symlinks to other files (default: false)"
53+
required: false
54+
default: "false"
4455

4556
outputs:
4657
exitcode: # id of output

‎entrypoint.sh

+9-1
Original file line numberDiff line numberDiff line change
@@ -41,6 +41,8 @@ INPUT_FAIL=$(default 'true' 'false' "${INPUT_FAIL}" 'true')
4141
INPUT_VERBOSE=$(default 'true' 'false' "${INPUT_VERBOSE}" 'true')
4242
INPUT_LOG_LEVEL=$(default 'info' "${INPUT_LOG_LEVEL}" "${INPUT_LOG_LEVEL}" 'true')
4343
INPUT_EXIT_CODE=$(default '1' '0' "${INPUT_EXIT_CODE}" 'true')
44+
INPUT_MAX_DECODE_DEPTH=$(default '0' '0' "${INPUT_MAX_DECODE_DEPTH}" 'true')
45+
INPUT_FOLLOW_SYMLINKS=$(default 'false' 'true' "${INPUT_FOLLOW_SYMLINKS}" 'true')
4446

4547
echo "----------------------------------"
4648
echo "INPUT PARAMETERS"
@@ -55,6 +57,9 @@ echo "INPUT_FAIL: ${INPUT_FAIL}"
5557
echo "INPUT_VERBOSE: ${INPUT_VERBOSE}"
5658
echo "INPUT_LOG_LEVEL: ${INPUT_LOG_LEVEL}"
5759
echo "INPUT_EXIT_CODE: ${INPUT_EXIT_CODE}"
60+
echo "INPUT_LOG_OPTS: ${INPUT_LOG_OPTS}"
61+
echo "INPUT_MAX_DECODE_DEPTH: ${INPUT_MAX_DECODE_DEPTH}"
62+
echo "INPUT_FOLLOW_SYMLINKS: ${INPUT_FOLLOW_SYMLINKS}"
5863
echo "----------------------------------"
5964

6065
echo "Setting Git safe directory (CVE-2022-24765)"
@@ -74,14 +79,17 @@ command+=$(arg '--verbose' "${INPUT_VERBOSE}")
7479
command+=$(arg '--log-level %s' "${INPUT_LOG_LEVEL}")
7580
command+=$(arg '--report-path %s' "${GITHUB_WORKSPACE}/gitleaks-report.${INPUT_REPORT_FORMAT}")
7681
command+=$(arg '--exit-code %d' "${INPUT_EXIT_CODE}")
82+
command+=$(arg '--max-decode-depth %d' "${INPUT_MAX_DECODE_DEPTH}")
83+
command+=$(arg '--follow-symlinks' "${INPUT_FOLLOW_SYMLINKS}")
7784

7885
if [[ "${GITHUB_EVENT_NAME}" == "pull_request" ]]; then
7986
command+=$(arg '--source %s' "${GITHUB_WORKSPACE}")
8087

8188
base_sha=$(git rev-parse "refs/remotes/origin/${GITHUB_BASE_REF}")
82-
head_sha=$(git rev-list --no-merges -n 1 refs/remotes/pull/${GITHUB_REF_NAME})
89+
head_sha=$(git rev-list --no-merges -n 1 "refs/remotes/pull/${GITHUB_REF_NAME}")
8390
command+=$(arg '--log-opts "%s"' "--no-merges --first-parent ${base_sha}...${head_sha}")
8491
else
92+
command+=$(arg '--log-opts "%s"' "${INPUT_LOG_OPTS}")
8593
command+=$(arg '--source %s' "${INPUT_SOURCE}")
8694
command+=$(arg '--no-git' "${INPUT_NO_GIT}")
8795
fi

0 commit comments

Comments
 (0)
Please sign in to comment.