Repository: gitleaks/gitleaks
Pull request #1474 (2024-08-19 06:38:35)

Added poetry.lock to default allowlist paths
### Description:

Poetry generates a `poetry.lock` file where package versions and checksums are being stored: https://python-poetry.org/docs/basic-usage/#installing-with-poetrylock

This file should be excluded (similar to `yarn.lock` or `package-lock.json`) to prevent false-positives in random hash values.

Example where an `square-access-token` is falsely being detected:

<details>
  <summary>poetry.lock</summary>

```
# This file is automatically @generated by Poetry 1.8.3 and should not be changed by hand.

[[package]]
name = "ruff"
version = "0.6.0"
description = "An extremely fast Python linter and code formatter, written in Rust."
optional = false
python-versions = ">=3.7"
files = [
    {file = "ruff-0.6.0-py3-none-linux_armv6l.whl", hash = "sha256:92dcce923e5df265781e5fc76f9a1edad52201a7aafe56e586b90988d5239013"},
    {file = "ruff-0.6.0-py3-none-macosx_10_12_x86_64.whl", hash = "sha256:31b90ff9dc79ed476c04e957ba7e2b95c3fceb76148f2079d0d68a908d2cfae7"},
    {file = "ruff-0.6.0-py3-none-macosx_11_0_arm64.whl", hash = "sha256:6d834a9ec9f8287dd6c3297058b3a265ed6b59233db22593379ee38ebc4b9768"},
    {file = "ruff-0.6.0-py3-none-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:f2089267692696aba342179471831a085043f218706e642564812145df8b8d0d"},
    {file = "ruff-0.6.0-py3-none-manylinux_2_17_armv7l.manylinux2014_armv7l.whl", hash = "sha256:aa62b423ee4bbd8765f2c1dbe8f6aac203e0583993a91453dc0a449d465c84da"},
    {file = "ruff-0.6.0-py3-none-manylinux_2_17_i686.manylinux2014_i686.whl", hash = "sha256:7344e1a964b16b1137ea361d6516ce4ee61a0403fa94252a1913ecc1311adcae"},
    {file = "ruff-0.6.0-py3-none-manylinux_2_17_ppc64.manylinux2014_ppc64.whl", hash = "sha256:487f3a35c3f33bf82be212ce15dc6278ea854e35573a3f809442f73bec8b2760"},
    {file = "ruff-0.6.0-py3-none-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl", hash = "sha256:75db409984077a793cf344d499165298a6f65449e905747ac65983b12e3e64b1"},
    {file = "ruff-0.6.0-py3-none-manylinux_2_17_s390x.manylinux2014_s390x.whl", hash = "sha256:84908bd603533ecf1db456d8fc2665d1f4335d722e84bc871d3bbd2d1116c272"},
    {file = "ruff-0.6.0-py3-none-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:0f1749a0aef3ec41ed91a0e2127a6ae97d2e2853af16dbd4f3c00d7a3af726c5"},
    {file = "ruff-0.6.0-py3-none-musllinux_1_2_aarch64.whl", hash = "sha256:016fea751e2bcfbbd2f8cb19b97b37b3fd33148e4df45b526e87096f4e17354f"},
    {file = "ruff-0.6.0-py3-none-musllinux_1_2_armv7l.whl", hash = "sha256:6ae80f141b53b2e36e230017e64f5ea2def18fac14334ffceaae1b780d70c4f7"},
    {file = "ruff-0.6.0-py3-none-musllinux_1_2_i686.whl", hash = "sha256:eaaaf33ea4b3f63fd264d6a6f4a73fa224bbfda4b438ffea59a5340f4afa2bb5"},
    {file = "ruff-0.6.0-py3-none-musllinux_1_2_x86_64.whl", hash = "sha256:7667ddd1fc688150a7ca4137140867584c63309695a30016880caf20831503a0"},
    {file = "ruff-0.6.0-py3-none-win32.whl", hash = "sha256:ae48365aae60d40865a412356f8c6f2c0be1c928591168111eaf07eaefa6bea3"},
    {file = "ruff-0.6.0-py3-none-win_amd64.whl", hash = "sha256:774032b507c96f0c803c8237ce7d2ef3934df208a09c40fa809c2931f957fe5e"},
    {file = "ruff-0.6.0-py3-none-win_arm64.whl", hash = "sha256:a5366e8c3ae6b2dc32821749b532606c42e609a99b0ae1472cf601da931a048c"},
    {file = "ruff-0.6.0.tar.gz", hash = "sha256:272a81830f68f9bd19d49eaf7fa01a5545c5a2e86f32a9935bb0e4bb9a1db5b8"},
]

[metadata]
lock-version = "2.0"
python-versions = "^3.12"
```
</details>

### Checklist:

* [x] Does your PR pass tests?
* [ ] Have you written new tests for your changes?
* [x] Have you lint your code locally prior to submission?



Patch:
diff --git a/cmd/generate/config/rules/config.tmpl b/cmd/generate/config/rules/config.tmpl
index eef7001..3abe012 100644
--- a/cmd/generate/config/rules/config.tmpl
+++ b/cmd/generate/config/rules/config.tmpl
@@ -1,5 +1,5 @@
 # This file has been auto-generated. Do not edit manually.
-# If you would like to contribute new rules, please use 
+# If you would like to contribute new rules, please use
 # cmd/generate/config/main.go and follow the contributing guidelines
 # at https://github.com/zricethezav/gitleaks/blob/master/CONTRIBUTING.md
 
@@ -22,6 +22,7 @@ paths = [
     '''package-lock.json''',
     '''yarn.lock''',
     '''pnpm-lock.yaml''',
+    '''poetry.lock''',
     '''Database.refactorlog''',
     '''vendor''',
 ]
diff --git a/config/gitleaks.toml b/config/gitleaks.toml
index 0c8d27e..351acb0 100644
--- a/config/gitleaks.toml
+++ b/config/gitleaks.toml
@@ -1,5 +1,5 @@
 # This file has been auto-generated. Do not edit manually.
-# If you would like to contribute new rules, please use 
+# If you would like to contribute new rules, please use
 # cmd/generate/config/main.go and follow the contributing guidelines
 # at https://github.com/zricethezav/gitleaks/blob/master/CONTRIBUTING.md
 
@@ -22,6 +22,7 @@ paths = [
     '''package-lock.json''',
     '''yarn.lock''',
     '''pnpm-lock.yaml''',
+    '''poetry.lock''',
     '''Database.refactorlog''',
     '''vendor''',
 ]
diff --git a/report/sarif.go b/report/sarif.go
index c6b1af1..59b4b37 100644
--- a/report/sarif.go
+++ b/report/sarif.go
@@ -56,22 +56,11 @@ func getRules(cfg config.Config) []Rules {
 	// TODO	for _, rule := range cfg.Rules {
 	var rules []Rules
 	for _, rule := range cfg.GetOrderedRules() {
-		shortDescription := ShortDescription{
-			Text: rule.Description,
-		}
-		if rule.Regex != nil {
-			shortDescription = ShortDescription{
-				Text: rule.Regex.String(),
-			}
-		} else if rule.Path != nil {
-			shortDescription = ShortDescription{
-				Text: rule.Path.String(),
-			}
-		}
 		rules = append(rules, Rules{
-			ID:          rule.RuleID,
-			Name:        rule.Description,
-			Description: shortDescription,
+			ID: rule.RuleID,
+			Description: ShortDescription{
+				Text: rule.Description,
+			},
 		})
 	}
 	return rules
@@ -162,7 +151,6 @@ type FullDescription struct {
 
 type Rules struct {
 	ID          string           `json:"id"`
-	Name        string           `json:"name"`
 	Description ShortDescription `json:"shortDescription"`
 }
 


Test patch:
diff --git a/testdata/expected/report/sarif_simple.sarif b/testdata/expected/report/sarif_simple.sarif
index 1b0562e..61adf03 100644
--- a/testdata/expected/report/sarif_simple.sarif
+++ b/testdata/expected/report/sarif_simple.sarif
@@ -11,254 +11,218 @@
      "rules": [
       {
        "id": "aws-access-key",
-       "name": "AWS Access Key",
        "shortDescription": {
-        "text": "(?:A3T[A-Z0-9]|AKIA|ASIA|ABIA|ACCA)[A-Z0-9]{16}"
+        "text": "AWS Access Key"
        }
       },
       {
        "id": "aws-secret-key",
-       "name": "AWS Secret Key",
        "shortDescription": {
-        "text": "(?i)aws_(.{0,20})?=?.[\\'\\\"0-9a-zA-Z\\/+]{40}"
+        "text": "AWS Secret Key"
        }
       },
       {
        "id": "aws-mws-key",
-       "name": "AWS MWS key",
        "shortDescription": {
-        "text": "amzn\\.mws\\.[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}"
+        "text": "AWS MWS key"
        }
       },
       {
        "id": "facebook-secret-key",
-       "name": "Facebook Secret Key",
        "shortDescription": {
-        "text": "(?i)(facebook|fb)(.{0,20})?(?-i)['\\\"][0-9a-f]{32}['\\\"]"
+        "text": "Facebook Secret Key"
        }
       },
       {
        "id": "facebook-client-id",
-       "name": "Facebook Client ID",
        "shortDescription": {
-        "text": "(?i)(facebook|fb)(.{0,20})?['\\\"][0-9]{13,17}['\\\"]"
+        "text": "Facebook Client ID"
        }
       },
       {
        "id": "twitter-secret-key",
-       "name": "Twitter Secret Key",
        "shortDescription": {
-        "text": "(?i)twitter(.{0,20})?['\\\"][0-9a-z]{35,44}['\\\"]"
+        "text": "Twitter Secret Key"
        }
       },
       {
        "id": "twitter-client-id",
-       "name": "Twitter Client ID",
        "shortDescription": {
-        "text": "(?i)twitter(.{0,20})?['\\\"][0-9a-z]{18,25}['\\\"]"
+        "text": "Twitter Client ID"
        }
       },
       {
        "id": "github-pat",
-       "name": "Github Personal Access Token",
        "shortDescription": {
-        "text": "ghp_[0-9a-zA-Z]{36}"
+        "text": "Github Personal Access Token"
        }
       },
       {
        "id": "github-oauth",
-       "name": "Github OAuth Access Token",
        "shortDescription": {
-        "text": "gho_[0-9a-zA-Z]{36}"
+        "text": "Github OAuth Access Token"
        }
       },
       {
        "id": "github-app",
-       "name": "Github App Token",
        "shortDescription": {
-        "text": "(ghu|ghs)_[0-9a-zA-Z]{36}"
+        "text": "Github App Token"
        }
       },
       {
        "id": "github-refresh",
-       "name": "Github Refresh Token",
        "shortDescription": {
-        "text": "ghr_[0-9a-zA-Z]{76}"
+        "text": "Github Refresh Token"
        }
       },
       {
        "id": "linkedin-client",
-       "name": "LinkedIn Client ID",
        "shortDescription": {
-        "text": "(?i)linkedin(.{0,20})?(?-i)[0-9a-z]{12}"
+        "text": "LinkedIn Client ID"
        }
       },
       {
        "id": "linkedin-secret",
-       "name": "LinkedIn Secret Key",
        "shortDescription": {
-        "text": "(?i)linkedin(.{0,20})?[0-9a-z]{16}"
+        "text": "LinkedIn Secret Key"
        }
       },
       {
        "id": "slack",
-       "name": "Slack",
        "shortDescription": {
-        "text": "xox[baprs]-(?:[0-9a-zA-Z]{10,48})?"
+        "text": "Slack"
        }
       },
       {
        "id": "apkey",
-       "name": "Asymmetric Private Key",
        "shortDescription": {
-        "text": "-----BEGIN (?:(?:EC|PGP|DSA|RSA|OPENSSH) )?PRIVATE KEY(?: BLOCK)?-----"
+        "text": "Asymmetric Private Key"
        }
       },
       {
        "id": "google",
-       "name": "Google (GCP) Service Account",
        "shortDescription": {
-        "text": "\"type\": \"service_account\""
+        "text": "Google (GCP) Service Account"
        }
       },
       {
        "id": "google",
-       "name": "Google (GCP) Service Account",
        "shortDescription": {
-        "text": "\"type\": \"service_account\""
+        "text": "Google (GCP) Service Account"
        }
       },
       {
        "id": "heroku",
-       "name": "Heroku API key",
        "shortDescription": {
-        "text": "(?i)heroku(.{0,20})?[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}"
+        "text": "Heroku API key"
        }
       },
       {
        "id": "mailchimp",
-       "name": "MailChimp API key",
        "shortDescription": {
-        "text": "(?i)(mailchimp|mc)(.{0,20})?[0-9a-f]{32}-us[0-9]{1,2}"
+        "text": "MailChimp API key"
        }
       },
       {
        "id": "mailgun",
-       "name": "Mailgun API key",
        "shortDescription": {
-        "text": "((?i)(mailgun|mg)(.{0,20})?)?key-[0-9a-z]{32}"
+        "text": "Mailgun API key"
        }
       },
       {
        "id": "paypal",
-       "name": "PayPal Braintree access token",
        "shortDescription": {
-        "text": "access_token\\$production\\$[0-9a-z]{16}\\$[0-9a-f]{32}"
+        "text": "PayPal Braintree access token"
        }
       },
       {
        "id": "piacatic",
-       "name": "Picatic API key",
        "shortDescription": {
-        "text": "sk_live_[0-9a-z]{32}"
+        "text": "Picatic API key"
        }
       },
       {
        "id": "sendgrid",
-       "name": "SendGrid API Key",
        "shortDescription": {
-        "text": "SG\\.[\\w_]{16,32}\\.[\\w_]{16,64}"
+        "text": "SendGrid API Key"
        }
       },
       {
        "id": "sidekiq-secret",
-       "name": "Sidekiq Secret",
        "shortDescription": {
-        "text": "(?i)(?:BUNDLE_ENTERPRISE__CONTRIBSYS__COM|BUNDLE_GEMS__CONTRIBSYS__COM)(?:[0-9a-z\\-_\\t .]{0,20})(?:[\\s|']|[\\s|\"]){0,3}(?:=|\u003e|:=|\\|\\|:|\u003c=|=\u003e|:)(?:'|\\\"|\\s|=|\\x60){0,5}([a-f0-9]{8}:[a-f0-9]{8})(?:['|\\\"|\\n|\\r|\\s|\\x60|;]|$)"
+        "text": "Sidekiq Secret"
        }
       },
       {
        "id": "sidekiq-sensitive-url",
-       "name": "Sidekiq Sensitive URL",
        "shortDescription": {
-        "text": "(?i)\\b(http(?:s??):\\/\\/)([a-f0-9]{8}:[a-f0-9]{8})@(?:gems.contribsys.com|enterprise.contribsys.com)(?:[\\/|\\#|\\?|:]|$)"
+        "text": "Sidekiq Sensitive URL"
        }
       },
       {
        "id": "slack-webhook",
-       "name": "Slack Webhook",
        "shortDescription": {
-        "text": "https://hooks.slack.com/services/T[a-zA-Z0-9_]{8}/B[a-zA-Z0-9_]{8,12}/[a-zA-Z0-9_]{24}"
+        "text": "Slack Webhook"
        }
       },
       {
        "id": "stripe",
-       "name": "Stripe API key",
        "shortDescription": {
-        "text": "(?i)stripe(.{0,20})?[sr]k_live_[0-9a-zA-Z]{24}"
+        "text": "Stripe API key"
        }
       },
       {
        "id": "square",
-       "name": "Square access token",
        "shortDescription": {
-        "text": "sq0atp-[0-9A-Za-z\\-_]{22}"
+        "text": "Square access token"
        }
       },
       {
        "id": "square-oauth",
-       "name": "Square OAuth secret",
        "shortDescription": {
-        "text": "sq0csp-[0-9A-Za-z\\-_]{43}"
+        "text": "Square OAuth secret"
        }
       },
       {
        "id": "twilio",
-       "name": "Twilio API key",
        "shortDescription": {
-        "text": "(?i)twilio(.{0,20})?SK[0-9a-f]{32}"
+        "text": "Twilio API key"
        }
       },
       {
        "id": "dynatrace",
-       "name": "Dynatrace ttoken",
        "shortDescription": {
-        "text": "dt0[a-zA-Z]{1}[0-9]{2}\\.[A-Z0-9]{24}\\.[A-Z0-9]{64}"
+        "text": "Dynatrace ttoken"
        }
       },
       {
        "id": "shopify",
-       "name": "Shopify shared secret",
        "shortDescription": {
-        "text": "shpss_[a-fA-F0-9]{32}"
+        "text": "Shopify shared secret"
        }
       },
       {
        "id": "shopify-access",
-       "name": "Shopify access token",
        "shortDescription": {
-        "text": "shpat_[a-fA-F0-9]{32}"
+        "text": "Shopify access token"
        }
       },
       {
        "id": "shopify-custom",
-       "name": "Shopify custom app access token",
        "shortDescription": {
-        "text": "shpca_[a-fA-F0-9]{32}"
+        "text": "Shopify custom app access token"
        }
       },
       {
        "id": "shopify-private",
-       "name": "Shopify private app access token",
        "shortDescription": {
-        "text": "shppa_[a-fA-F0-9]{32}"
+        "text": "Shopify private app access token"
        }
       },
       {
        "id": "pypi",
-       "name": "PyPI upload token",
        "shortDescription": {
-        "text": "pypi-AgEIcHlwaS5vcmc[A-Za-z0-9-_]{50,1000}"
+        "text": "PyPI upload token"
        }
       }
      ]