Repository: prowler-cloud/prowler
Pull request: fix(detect_secrets): refactor logic for detect-secrets
### Context

Fix #6467
Thanks @kagahd for the heads up! 🚀 
### Description

This PR change the logic from the checks: `ecs_task_definitions_no_environment_secrets`, `awslambda_function_no_secrets_in_variables`
The main problem here is that we are re-writing the ecs env vars into a format that Detect-Secrets could find them and we were using the line from the output to create the `status_extended`. That's why the line was incorrect (it was taking the lines from the re-written variables).

The new approach changes the status extended from:
`...Secret keyword on line 2.`
to
`...Secret keyword on env var DB_PASSWORD.`

This way, the user will have the env name on the output.

### Checklist

- Are there new checks included in this PR? Yes / No
    - If so, do we need to update permissions for the provider? Please review this carefully.
- [ ] Review if the code is being covered by tests.
- [ ] Review if code is being documented following this specification https://github.com/google/styleguide/blob/gh-pages/pyguide.md#38-comments-and-docstrings
- [ ] Review if backport is needed.
- [ ] Review if is needed to change the [Readme.md](https://github.com/prowler-cloud/prowler/blob/master/README.md)

### License

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license.


Problem statement:
report of DetectSecrets line number is wrong
### Steps to Reproduce

Run a check which uses DetectSecrets e.g. `ecs_task_definitions_no_environment_secrets` on a resource with potential secrets. The check will report the line number where the potential secret was found.
Prowler's `ecs_task_definitions_no_environment_secrets` metadata states:

> If a secret is detected, the line number shown in the finding matches with the environment variable `Name` attribute starting to count at the `environment` key from the ECS Task Definition in JSON format.

Given the following example the key `environment` of a AWS ECS task definition in json format which is shown in AWS console as follows:

```
"environment": [
  {
      "name": "FIRST_PARAM",
      "value": "first value"
  },
  {
      "name": "SECOND_PARAM",
      "value": "second value"
  },
  {
      "name": "POTENTIAL_SECRET",
      "value": "potential secret"
  }
]
```

If the third entry of the `environment` key of the task definition contains a potential secret, the check would indicate **line number four**. Why is it so? Because the json that prowler is passing to DetectSecrets is transformed as follows:

```
{
  "FIRST_PARAM": "first value",
  "SECOND_PARAM": "second value",
  "POTENTIAL_SECRET": "potential secret",
}
```
Obviously, DetectSecrets counts the opening curly bracket from the json expression as line number one.

### Expected behavior

I'd expect to read the correct line number in prowler's report.

### Actual Result with Screenshots or Logs

doesn't matter

### How did you install Prowler?

Cloning the repository from github.com (git clone)

### Environment Resource

Docker container locally

### OS used

MacOS

### Prowler version

5.0.5

### Pip version

doesn't matter

### Context

_No response_

Hints from issue discussion:
Hey @kagahd thanks for the heads up! 
We'll review the detect-secrets behaviour and we'll ping you with the solution when we find it.

Commit message: fix(ecs): refactor logic for detect-secrets

Patch to review:
diff --git a/prowler/providers/aws/services/ecs/ecs_task_definitions_no_environment_secrets/ecs_task_definitions_no_environment_secrets.py b/prowler/providers/aws/services/ecs/ecs_task_definitions_no_environment_secrets/ecs_task_definitions_no_environment_secrets.py
index 53fe501f9c..7d4a17e771 100644
--- a/prowler/providers/aws/services/ecs/ecs_task_definitions_no_environment_secrets/ecs_task_definitions_no_environment_secrets.py
+++ b/prowler/providers/aws/services/ecs/ecs_task_definitions_no_environment_secrets/ecs_task_definitions_no_environment_secrets.py
@@ -1,3 +1,4 @@
+import hashlib
 from json import dumps
 
 from prowler.lib.check.models import Check, Check_Report_AWS
@@ -25,8 +26,16 @@ def execute(self):
 
                 if container.environment:
                     dump_env_vars = {}
+                    original_env_vars = {}
                     for env_var in container.environment:
                         dump_env_vars.update({env_var.name: env_var.value})
+                        original_env_vars.update(
+                            {
+                                hashlib.sha1(  # nosec B324 SHA1 is used here for non-security-critical unique identifiers
+                                    env_var.value.encode("utf-8")
+                                ).hexdigest(): env_var.name
+                            }
+                        )
 
                     env_data = dumps(dump_env_vars, indent=2)
                     detect_secrets_output = detect_secrets_scan(
@@ -35,7 +44,7 @@ def execute(self):
                     if detect_secrets_output:
                         secrets_string = ", ".join(
                             [
-                                f"{secret['type']} on line {secret['line_number']}"
+                                f"{secret['type']} on env var {original_env_vars[secret['hashed_secret']]}"
                                 for secret in detect_secrets_output
                             ]
                         )
diff --git a/tests/providers/aws/services/ecs/ecs_task_definitions_no_environment_secrets/ecs_task_definitions_no_environment_secrets_test.py b/tests/providers/aws/services/ecs/ecs_task_definitions_no_environment_secrets/ecs_task_definitions_no_environment_secrets_test.py
index 8f8490a726..b42351dab1 100644
--- a/tests/providers/aws/services/ecs/ecs_task_definitions_no_environment_secrets/ecs_task_definitions_no_environment_secrets_test.py
+++ b/tests/providers/aws/services/ecs/ecs_task_definitions_no_environment_secrets/ecs_task_definitions_no_environment_secrets_test.py
@@ -132,7 +132,7 @@ def test_container_env_var_with_secrets(self):
             assert result[0].status == "FAIL"
             assert (
                 result[0].status_extended
-                == f"Potential secrets found in ECS task definition {TASK_NAME} with revision {TASK_REVISION}: Secrets in container test-container -> Secret Keyword on line 2."
+                == f"Potential secrets found in ECS task definition {TASK_NAME} with revision {TASK_REVISION}: Secrets in container test-container -> Secret Keyword on env var DB_PASSWORD."
             )
             assert result[0].resource_id == f"{TASK_NAME}:{TASK_REVISION}"
             assert result[0].resource_arn == task_arn


Code review comments:
diff_hunk: @@ -35,7 +44,7 @@ def execute(self):
                     if detect_secrets_output:
                         secrets_string = ", ".join(
                             [
-                                f"{secret['type']} on line {secret['line_number']}"
+                                f"{secret['type']} on env var {original_env_vars[secret['hashed_secret']]}"
path: prowler/providers/aws/services/ecs/ecs_task_definitions_no_environment_secrets/ecs_task_definitions_no_environment_secrets.py
text: @user1:
```suggestion
                                f"{secret['type']} on the environment variable {original_env_vars[secret['hashed_secret']]}"
```

@author:
Done