Repository: bridgecrewio/checkov

Issue:
Secrets framework scan not working in 2.0.407
**Describe the bug**
This is to duplicate #1536 which has been closed. I don't believe the issue has been resolved.

```
bash-5.1# pwd
/test
bash-5.1# checkov -d . --framework all

       _               _
   ___| |__   ___  ___| | _______   __
  / __| '_ \ / _ \/ __| |/ / _ \ \ / /
 | (__| | | |  __/ (__|   < (_) \ V /
  \___|_| |_|\___|\___|_|\_\___/ \_/

By bridgecrew.io | version: 2.0.407

bash-5.1# ls -la
total 4
drwxrwxrwx    1 root     root          4096 Aug 25 16:35 .
drwxr-xr-x    1 root     root          4096 Sep 12 16:29 ..
-rwxrwxrwx    1 root     root            73 Aug 25 16:26 password.txt
-rwxrwxrwx    1 root     root            44 Aug 25 16:34 providers.tf
-rwxrwxrwx    1 root     root            30 Aug 25 16:35 secret_password.yaml

bash-5.1# cat providers.tf
access_key = "sfffglfgjldfjdlrt5454002lfofd"bash-5.1# cat password.txt
password: mypassword
b64password: bXlwYXNzd29yZAo=
mypassword=secretkey

bash-5.1# cat secret_password.yaml
pwd: correcthorsebatterystaple

bash-5.1# checkov -d ./ --framework secrets

       _               _
   ___| |__   ___  ___| | _______   __
  / __| '_ \ / _ \/ __| |/ / _ \ \ / /
 | (__| | | |  __/ (__|   < (_) \ V /
  \___|_| |_|\___|\___|_|\_\___/ \_/

By bridgecrew.io | version: 2.0.407

bash-5.1# ls -la
total 4
drwxrwxrwx    1 root     root          4096 Aug 25 16:35 .
drwxr-xr-x    1 root     root          4096 Sep 12 16:29 ..
-rwxrwxrwx    1 root     root            73 Aug 25 16:26 password.txt
-rwxrwxrwx    1 root     root            44 Aug 25 16:34 providers.tf
-rwxrwxrwx    1 root     root            30 Aug 25 16:35 secret_password.yaml
```

**To Reproduce**
Steps to reproduce the behavior:
1. See above and details in #1536 

**Expected behavior**
I expect secrets to be detected.

**Desktop (please complete the following information):**
 - running the checkov container
 - Checkov Version: 2.0.204

**Additional context**
Add any other context about the problem here (e.g. code snippets).



Discussion:
Before I dig into this topic deeper, just a quick heads up. `checkov` doesn't check all files, only with specific file extensions. The `secrets` are only checked in following file extensions
- .tf
- .yml
- .yaml
- .json
- .template
so the secret in `password.txt` will not be flagged.

Your `access_key` is not a "real" AWS Access Key, therefore it is not flagged. A real one needs to validate against following regex `AKIA[0-9A-Z]{16}`

For `secret_password.yaml` I'm not sure, if there is a check, which is supposed to find this kind of password, maybe @tronxd can give some more details about it 🙂 
@gruebel if you see this blog - the `secret_password.yaml` is exactly as per the example given: https://bridgecrew.io/blog/checkov-secrets-scanning-find-exposed-credentials-in-iac/.
I've amended the password files and given this another go at versions `2.0.407` and `2.0.413`. It is now finding the AWS secret, but still failing to find the "Base64 High Entropy String" (as per https://docs.bridgecrew.io/docs/git_secrets_6):
```
bash-5.1# pwd
/test

bash-5.1# ls -la
total 4
drwxrwxrwx    1 root     root          4096 Sep 14 09:32 .
drwxr-xr-x    1 root     root          4096 Sep 14 09:39 ..
-rwxrwxrwx    1 root     root            73 Aug 25 16:26 password.txt
-rwxrwxrwx    1 root     root            36 Sep 14 09:35 providers.tf
-rwxrwxrwx    1 root     root            76 Sep 14 09:39 secret_password.yaml
drwxrwxrwx    1 root     root          4096 Sep 14 09:32 terraform

bash-5.1# cat providers.tf
access_key = "AKIAAI0SF0DNN7EXAMPLE"

bash-5.1# cat secret_password.yaml
pwd: correcthorsebatterystaple
newpwd: Y29ycmVjdGhvcnNlYmF0dGVyeXN0YXBsZQ==

bash-5.1# checkov -d ./

       _               _
   ___| |__   ___  ___| | _______   __
  / __| '_ \ / _ \/ __| |/ / _ \ \ / /
 | (__| | | |  __/ (__|   < (_) \ V /
  \___|_| |_|\___|\___|_|\_\___/ \_/

By bridgecrew.io | version: 2.0.413

secrets scan results:

Passed checks: 0, Failed checks: 2, Skipped checks: 0

Check: CKV_SECRET_2: "AWS Access Key"
        FAILED for resource: 2b4e50bcbde22261373a5e3cf6925a818837181a
        File: /providers.tf:1-2
        Guide: https://docs.bridgecrew.io/docs/git_secrets_2

                1 | access_key = "AKIAAI0SF0DNN7EXAMPLE"


Check: CKV_SECRET_2: "AWS Access Key"
        FAILED for resource: 2b4e50bcbde22261373a5e3cf6925a818837181a
        File: /terraform/aws/providers.tf:1-2
        Guide: https://docs.bridgecrew.io/docs/git_secrets_2

                1 | access_key = "AKIAAI0SF0DNN7EXAMPLE"
```

I can't see any difference between what I'm doing with `secret_password.yaml` and what was shown in the [blog](https://bridgecrew.io/blog/checkov-secrets-scanning-find-exposed-credentials-in-iac/).
@mtcolman thanks for the link, I checked the code and found the "issue", the entropy limit is set quite high, so this password is not flagged as a real password. @schosterbarak I could lower the entropy level from 4.5 to 3, which seems like a better fit, but would result in more strings to be flagged as a potential password.

here some examples for the calculated entropy level
- `correcthorsebatterystaple` -> 3.36
- `hhmd^r0i=m8Wt6G<]hMSw{3ca]e*AEx1aP=UA#,S^2d85d(I2h` -> 3.98 (created by 1password with 50 chars)- 
- `qwertyuiopasdfghjklzxcv` -> 4.52 (me typing each letter on the keyboard 😄 )
@gruebel that probably explains it then! Please let me know how this progresses, thank you.
@gruebel for IaC, we're looking for cross-matches of the entropies + the secret keyword matcher (i.e. `password`, `secret` etc). So I'm not too worried about the noise. I'm open to reducing the threshold there

Resolving patch:
diff --git a/checkov/secrets/plugins/entropy_keyword_combinator.py b/checkov/secrets/plugins/entropy_keyword_combinator.py
--- a/checkov/secrets/plugins/entropy_keyword_combinator.py
+++ b/checkov/secrets/plugins/entropy_keyword_combinator.py
@@ -1,7 +1,7 @@
 from detect_secrets.core.potential_secret import PotentialSecret
 from detect_secrets.plugins.high_entropy_strings import Base64HighEntropyString, HexHighEntropyString
 from detect_secrets.plugins.keyword import KeywordDetector
-from detect_secrets.plugins.base import    BasePlugin
+from detect_secrets.plugins.base import BasePlugin
 from typing import Generator, Any, Set
 
 
@@ -24,10 +24,10 @@ def analyze_line(
         one of the entropy scanners find a match (on a line which was already matched by keyword plugin) - it is returned.
         """
         keyword_matches = self.keyword_scanner.analyze_line(filename, line, line_number, **kwargs)
-        if len(keyword_matches):
+        if keyword_matches:
             for entropy_scanner in self.high_entropy_scanners:
                 matches = entropy_scanner.analyze_line(filename, line, line_number, **kwargs)
-                if len(matches) > 0:
+                if matches:
                     return matches
         return set([])
 
diff --git a/checkov/secrets/runner.py b/checkov/secrets/runner.py
--- a/checkov/secrets/runner.py
+++ b/checkov/secrets/runner.py
@@ -45,6 +45,7 @@
 }
 CHECK_ID_TO_SECRET_TYPE = {v: k for k, v in SECRET_TYPE_TO_ID.items()}
 
+ENTROPY_KEYWORD_LIMIT = 3
 PROHIBITED_FILES = ['Pipfile.lock', 'yarn.lock', 'package-lock.json', 'requirements.txt']
 
 
@@ -56,8 +57,14 @@ class _CheckResult(TypedDict, total=False):
 class Runner(BaseRunner):
     check_type = 'secrets'
 
-    def run(self, root_folder, external_checks_dir=None, files=None, runner_filter=RunnerFilter(),
-            collect_skip_comments=True) -> Report:
+    def run(
+        self,
+        root_folder: str,
+        external_checks_dir: Optional[List[str]] = None,
+        files: Optional[List[str]] = None,
+        runner_filter: RunnerFilter = RunnerFilter(),
+        collect_skip_comments: bool = True
+    ) -> Report:
         current_dir = os.path.dirname(os.path.realpath(__file__))
         secrets = SecretsCollection()
         with transient_settings({
@@ -105,7 +112,7 @@ def run(self, root_folder, external_checks_dir=None, files=None, runner_filter=R
                 {
                     'name': 'EntropyKeywordCombinator',
                     'path': f'file://{current_dir}/plugins/entropy_keyword_combinator.py',
-                    'limit': 4.5
+                    'limit': ENTROPY_KEYWORD_LIMIT
                 }
             ]
         }) as settings:
@@ -124,7 +131,7 @@ def run(self, root_folder, external_checks_dir=None, files=None, runner_filter=R
 
             settings.disable_filters(*['detect_secrets.filters.heuristic.is_indirect_reference'])
 
-            def _scan_file(file_paths: List[str]):
+            def _scan_file(file_paths: List[str]) -> None:
                 for file_path in file_paths:
                     start = time.time()
                     try:


Test patch:
diff --git a/tests/secrets/test_plugin.py b/tests/secrets/test_plugin.py
--- a/tests/secrets/test_plugin.py
+++ b/tests/secrets/test_plugin.py
@@ -1,17 +1,19 @@
 import unittest
+
 from checkov.secrets.plugins.entropy_keyword_combinator import EntropyKeywordCombinator
+from checkov.secrets.runner import ENTROPY_KEYWORD_LIMIT
 
-class TestCombinatorPlugin(unittest.TestCase):
 
+class TestCombinatorPlugin(unittest.TestCase):
     def setUp(self) -> None:
-        self.plugin = EntropyKeywordCombinator(4.5)
+        self.plugin = EntropyKeywordCombinator(ENTROPY_KEYWORD_LIMIT)
 
     def test_positive_value(self):
-        result = self.plugin.analyze_line("mock.tf", "api_key = \"wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMAAAKEY\"", 5)
+        result = self.plugin.analyze_line("mock.tf", 'api_key = "wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMAAAKEY"', 5)
         self.assertEqual(1, len(result))
         secret = result.pop()
-        self.assertEqual('Base64 High Entropy String', secret.type)
-        self.assertEqual('c00f1a6e4b20aa64691d50781b810756d6254b8e', secret.secret_hash)
+        self.assertEqual("Base64 High Entropy String", secret.type)
+        self.assertEqual("c00f1a6e4b20aa64691d50781b810756d6254b8e", secret.secret_hash)
 
     def test_negative_keyword_value(self):
         result = self.plugin.analyze_line("mock.tf", "wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMAAAKEY", 5)
@@ -20,3 +22,10 @@ def test_negative_keyword_value(self):
     def test_negative_entropy_value(self):
         result = self.plugin.analyze_line("mock.tf", "api_key = var.api_key", 5)
         self.assertEqual(0, len(result))
+
+    def test_popular_kubernetes_manifest_password(self):
+        result = self.plugin.analyze_line("mock.yaml", 'pwd: "correcthorsebatterystaple"', 5)
+        self.assertEqual(1, len(result))
+        secret = result.pop()
+        self.assertEqual("Base64 High Entropy String", secret.type)
+        self.assertEqual("bfd3617727eab0e800e62a776c76381defbc4145", secret.secret_hash)