Repository: Checkmarx/kics (language: python)

Issue:
Bug(v1.7.3): Rule "Generic Private Key" also matches bash variable with empty default
When using bash default values the rule "Generic Private Key" [2f665079-c383-4b33-896e-88268c1fa258](https://github.com/Checkmarx/kics/blob/master/assets/queries/common/passwords_and_secrets/regex_rules.json#L227) also matches.

Example Code (was wrapped in a .gitlab-ci.yml):
```bash
if [[ -z "${GIT_REMOTE_SYNC_SSH_PRIVATE_KEY:-}" ]]; then
  echo "🛑 Missing GIT_REMOTE_SYNC_SSH_PRIVATE_KEY variable!"
  exit 1
fi
```

### Expected Behavior

KICS does not find any issues.

### Actual Behavior

- KICS throws the following error:
  ```
  Passwords And Secrets - Generic Private Key, Severity: HIGH, Results: 1
  Description: Query to find passwords and secrets in infrastructure code.
  Platform: Common
  Learn more about this vulnerability: https://docs.kics.io/latest/queries/common-queries/common/2f665079-c383-4b33-896e-88268c1fa258
    [1]: Jobs/Git/PushToExternalRepo/Anonymized.job-template.gitlab-ci.yml:65
      064:         echo "Using SSH remote..."
      065:         if [[ -z "${GIT_REMOTE_SYNC_SSH_PRIVATE_KEY:<SECRET-MASKED-ON-PURPOSE>
      066:           echo "🛑 Missing GIT_REMOTE_SYNC_SSH_PRIVATE_KEY variable!"
  ```
- Also the link to the docs is broken.


### Steps to Reproduce the Problem

(Command line arguments and flags used)

1.  Have the Example Code from above in a shell file.
2.  run: `kics scan --no-progress -p "$PWD" -o results --report-formats "codeclimate,html,json,glsast"  --output-name kics-result --ignore-on-exit all`


As you can see the regex matches even though there is no actual private key there: https://regex101.com/r/nH0NON/1

### Specifications

-   Version: 1.7.3
-   Platform: Dockercontainer from `checkmarx/kics`



Discussion / hints:

Fix patch:
diff --git a/assets/queries/common/passwords_and_secrets/regex_rules.json b/assets/queries/common/passwords_and_secrets/regex_rules.json
index bf842375ac5..058b7b8f604 100644
--- a/assets/queries/common/passwords_and_secrets/regex_rules.json
+++ b/assets/queries/common/passwords_and_secrets/regex_rules.json
@@ -229,7 +229,13 @@
       "id": "2f665079-c383-4b33-896e-88268c1fa258",
       "name": "Generic Private Key",
       "regex": "(?i)['\"]?private[_]?key['\"]?\\s*[:=]\\s*['\"]?([[A-Za-z0-9/~^_!@&%()=?*+-]+)['\"]?",
-      "specialMask": "(?i)['\"]?private[_]?key['\"]?\\s*[:=]\\s*"
+      "specialMask": "(?i)['\"]?private[_]?key['\"]?\\s*[:=]\\s*",
+      "allowRules": [
+        {
+          "description": "Avoiding bash variables",
+          "regex": "(?i)['\"]?\\$\\s*\\{[^\\s\\}]+\\}['\"]?"
+        }
+      ]
     },
     {
       "id": "baee238e-1921-4801-9c3f-79ae1d7b2cbc",


Test patch:
diff --git a/assets/queries/common/passwords_and_secrets/test/negative56.yml b/assets/queries/common/passwords_and_secrets/test/negative56.yml
new file mode 100644
index 00000000000..7d7231940c9
--- /dev/null
+++ b/assets/queries/common/passwords_and_secrets/test/negative56.yml
@@ -0,0 +1,14 @@
+stages:
+  - build
+
+variables:
+  GIT_PRIVATE_KEY: $GIT_PRIVATE_KEY
+
+job_build:
+  stage: build
+  script:
+    - if [[ -z "${GIT_PRIVATE_KEY:-}" ]]; then
+        echo "Missing GIT_PRIVATE_KEY variable!"
+        exit 1
+      fi
+    - echo "Private key is set."
diff --git a/assets/queries/common/passwords_and_secrets/test/positive49.yml b/assets/queries/common/passwords_and_secrets/test/positive49.yml
new file mode 100644
index 00000000000..f071956afac
--- /dev/null
+++ b/assets/queries/common/passwords_and_secrets/test/positive49.yml
@@ -0,0 +1,14 @@
+stages:
+  - build
+
+variables:
+  GIT_PRIVATE_KEY: "heythisisaprivatekey!"
+
+job_build:
+  stage: build
+  script:
+    - if [[ -z "${GIT_PRIVATE_KEY:-}" ]]; then
+        echo "Missing GIT_PRIVATE_KEY variable!"
+        exit 1
+      fi
+    - echo "Private key is set."
diff --git a/assets/queries/common/passwords_and_secrets/test/positive_expected_result.json b/assets/queries/common/passwords_and_secrets/test/positive_expected_result.json
index 2162aa13822..52f9288044a 100644
--- a/assets/queries/common/passwords_and_secrets/test/positive_expected_result.json
+++ b/assets/queries/common/passwords_and_secrets/test/positive_expected_result.json
@@ -400,5 +400,11 @@
     "severity": "HIGH",
     "line": 8,
     "fileName": "positive48.tf"
+  },
+  {
+    "queryName": "Passwords And Secrets - Generic Private Key",
+    "severity": "HIGH",
+    "line": 5,
+    "fileName": "positive49.yml"
   }
 ]