From 036bce1734e0fff613b361dd441f21d1c5ff2ce2 Mon Sep 17 00:00:00 2001 From: thinkinggis Date: Tue, 21 Apr 2020 11:18:58 +0800 Subject: [PATCH 1/2] chore: add gitleaks --- .github/workflows/gitleaks.yml | 11 +++ .gitleaks.toml | 124 +++++++++++++++++++++++++++++++++ 2 files changed, 135 insertions(+) create mode 100644 .github/workflows/gitleaks.yml create mode 100644 .gitleaks.toml diff --git a/.github/workflows/gitleaks.yml b/.github/workflows/gitleaks.yml new file mode 100644 index 0000000000..1b1eb0d709 --- /dev/null +++ b/.github/workflows/gitleaks.yml @@ -0,0 +1,11 @@ +name: gitleaks + +on: [push,pull_request] + +jobs: + gitleaks: + runs-on: ubuntu-latest + steps: + - uses: actions/checkout@v1 + - name: gitleaks-action + uses: zricethezav/gitleaks-action@master diff --git a/.gitleaks.toml b/.gitleaks.toml new file mode 100644 index 0000000000..8dca9e665e --- /dev/null +++ b/.gitleaks.toml @@ -0,0 +1,124 @@ +title = "gitleaks config" +[[rules]] + description = "AWS Manager ID" + regex = '''(A3T[A-Z0-9]|AKIA|AGPA|AIDA|AROA|AIPA|ANPA|ANVA|ASIA)[A-Z0-9]{16}''' + tags = ["key", "AWS"] +[[rules]] + description = "AWS Secret Key" + regex = '''(?i)aws(.{0,20})?(?-i)['\"][0-9a-zA-Z\/+]{40}['\"]''' + tags = ["key", "AWS"] +[[rules]] + description = "AWS MWS key" + regex = '''amzn\.mws\.[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}''' + tags = ["key", "AWS", "MWS"] +[[rules]] + description = "Facebook Secret Key" + regex = '''(?i)(facebook|fb)(.{0,20})?(?-i)['\"][0-9a-f]{32}['\"]''' + tags = ["key", "Facebook"] +[[rules]] + description = "Facebook Client ID" + regex = '''(?i)(facebook|fb)(.{0,20})?['\"][0-9]{13,17}['\"]''' + tags = ["key", "Facebook"] +[[rules]] + description = "Twitter Secret Key" + regex = '''(?i)twitter(.{0,20})?['\"][0-9a-z]{35,44}['\"]''' + tags = ["key", "Twitter"] +[[rules]] + description = "Twitter Client ID" + regex = '''(?i)twitter(.{0,20})?['\"][0-9a-z]{18,25}['\"]''' + tags = ["client", "Twitter"] +[[rules]] + description = "Github" + regex = '''(?i)github(.{0,20})?(?-i)['\"][0-9a-zA-Z]{35,40}['\"]''' + tags = ["key", "Github"] +[[rules]] + description = "Github Token" + regex = '''[0-9a-zA-Z]{35,40}''' + tags = ["key", "Github Token"] +[[rules]] + description = "Alibaba" + regex = '''(alibaba|antfin)-inc''' + tags = ["key", "Alibaba"] +[[rules]] + description = "antfin" + regex = '''(?i)antfin(.{0,20})?(?-i)['\"][0-9a-zA-Z]{35,40}['\"]''' + tags = ["key", "Antfin"] +[[rules]] + description = "LinkedIn Client ID" + regex = '''(?i)linkedin(.{0,20})?(?-i)['\"][0-9a-z]{12}['\"]''' + tags = ["client", "LinkedIn"] +[[rules]] + description = "LinkedIn Secret Key" + regex = '''(?i)linkedin(.{0,20})?['\"][0-9a-z]{16}['\"]''' + tags = ["secret", "LinkedIn"] +[[rules]] + description = "Slack" + regex = '''xox[baprs]-([0-9a-zA-Z]{10,48})?''' + tags = ["key", "Slack"] +[[rules]] + description = "Asymmetric Private Key" + regex = '''-----BEGIN ((EC|PGP|DSA|RSA|OPENSSH) )?PRIVATE KEY( BLOCK)?-----''' + tags = ["key", "AsymmetricPrivateKey"] +[[rules]] + description = "Public Key" + regex = '''ssh-rsa''' + tags = ["keys", "public key"] +[[rules]] + description = "Gitlab Key" + regex = '''privateToken|private-token''' + tags = ["keys", "Gitlab"] +[[rules]] + description = "Generic Credential" + regex = '''(?i)(api_key|apikey|secret)(.{0,20})?['|"][0-9a-zA-Z]{16,45}['|"]''' + tags = ["key", "API", "generic"] +[[rules]] + description = "Google API key" + regex = '''AIza[0-9A-Za-z\\-_]{35}''' + tags = ["key", "Google"] +[[rules]] + description = "Heroku API key" + regex = '''(?i)heroku(.{0,20})?['"][0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}['"]''' + tags = ["key", "Heroku"] +[[rules]] + description = "MailChimp API key" + regex = '''(?i)(mailchimp|mc)(.{0,20})?['"][0-9a-f]{32}-us[0-9]{1,2}['"]''' + tags = ["key", "Mailchimp"] +[[rules]] + description = "Mailgun API key" + regex = '''(?i)(mailgun|mg)(.{0,20})?['"][0-9a-z]{32}['"]''' + tags = ["key", "Mailgun"] +[[rules]] + description = "PayPal Braintree access token" + regex = '''access_token\$production\$[0-9a-z]{16}\$[0-9a-f]{32}''' + tags = ["key", "Paypal"] +[[rules]] + description = "Picatic API key" + regex = '''sk_live_[0-9a-z]{32}''' + tags = ["key", "Picatic"] +[[rules]] + description = "SendGrid API Key" + regex = '''SG\.[\w_]{16,32}\.[\w_]{16,64}''' + tags = ["key", "SendGrid"] +[[rules]] + description = "Slack Webhook" + regex = '''https://hooks.slack.com/services/T[a-zA-Z0-9_]{8}/B[a-zA-Z0-9_]{8}/[a-zA-Z0-9_]{24}''' + tags = ["key", "slack"] +[[rules]] + description = "Stripe API key" + regex = '''(?i)stripe(.{0,20})?['\"][sk|rk]_live_[0-9a-zA-Z]{24}''' + tags = ["key", "Stripe"] +[[rules]] + description = "Square access token" + regex = '''sq0atp-[0-9A-Za-z\-_]{22}''' + tags = ["key", "square"] +[[rules]] + description = "Square OAuth secret" + regex = '''sq0csp-[0-9A-Za-z\\-_]{43}''' + tags = ["key", "square"] +[[rules]] + description = "Twilio API key" + regex = '''(?i)twilio(.{0,20})?['\"][0-9a-f]{32}['\"]''' + tags = ["key", "twilio"] +[whitelist] + description = "Whitelisted files" + file = '''(^\.?gitleaks.toml$|(.*?)(jpg|gif|doc|pdf|bin)|package-lock\.json$)''' From f03f6826e340b22361e43cb3218923c7f2b1e345 Mon Sep 17 00:00:00 2001 From: thinkinggis Date: Tue, 21 Apr 2020 11:18:58 +0800 Subject: [PATCH 2/2] chore: add gitleaks --- .github/workflows/gitleaks.yml | 11 +++ .gitleaks.toml | 124 +++++++++++++++++++++++++++++++++ .travis.yml | 2 +- 3 files changed, 136 insertions(+), 1 deletion(-) create mode 100644 .github/workflows/gitleaks.yml create mode 100644 .gitleaks.toml diff --git a/.github/workflows/gitleaks.yml b/.github/workflows/gitleaks.yml new file mode 100644 index 0000000000..1b1eb0d709 --- /dev/null +++ b/.github/workflows/gitleaks.yml @@ -0,0 +1,11 @@ +name: gitleaks + +on: [push,pull_request] + +jobs: + gitleaks: + runs-on: ubuntu-latest + steps: + - uses: actions/checkout@v1 + - name: gitleaks-action + uses: zricethezav/gitleaks-action@master diff --git a/.gitleaks.toml b/.gitleaks.toml new file mode 100644 index 0000000000..8dca9e665e --- /dev/null +++ b/.gitleaks.toml @@ -0,0 +1,124 @@ +title = "gitleaks config" +[[rules]] + description = "AWS Manager ID" + regex = '''(A3T[A-Z0-9]|AKIA|AGPA|AIDA|AROA|AIPA|ANPA|ANVA|ASIA)[A-Z0-9]{16}''' + tags = ["key", "AWS"] +[[rules]] + description = "AWS Secret Key" + regex = '''(?i)aws(.{0,20})?(?-i)['\"][0-9a-zA-Z\/+]{40}['\"]''' + tags = ["key", "AWS"] +[[rules]] + description = "AWS MWS key" + regex = '''amzn\.mws\.[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}''' + tags = ["key", "AWS", "MWS"] +[[rules]] + description = "Facebook Secret Key" + regex = '''(?i)(facebook|fb)(.{0,20})?(?-i)['\"][0-9a-f]{32}['\"]''' + tags = ["key", "Facebook"] +[[rules]] + description = "Facebook Client ID" + regex = '''(?i)(facebook|fb)(.{0,20})?['\"][0-9]{13,17}['\"]''' + tags = ["key", "Facebook"] +[[rules]] + description = "Twitter Secret Key" + regex = '''(?i)twitter(.{0,20})?['\"][0-9a-z]{35,44}['\"]''' + tags = ["key", "Twitter"] +[[rules]] + description = "Twitter Client ID" + regex = '''(?i)twitter(.{0,20})?['\"][0-9a-z]{18,25}['\"]''' + tags = ["client", "Twitter"] +[[rules]] + description = "Github" + regex = '''(?i)github(.{0,20})?(?-i)['\"][0-9a-zA-Z]{35,40}['\"]''' + tags = ["key", "Github"] +[[rules]] + description = "Github Token" + regex = '''[0-9a-zA-Z]{35,40}''' + tags = ["key", "Github Token"] +[[rules]] + description = "Alibaba" + regex = '''(alibaba|antfin)-inc''' + tags = ["key", "Alibaba"] +[[rules]] + description = "antfin" + regex = '''(?i)antfin(.{0,20})?(?-i)['\"][0-9a-zA-Z]{35,40}['\"]''' + tags = ["key", "Antfin"] +[[rules]] + description = "LinkedIn Client ID" + regex = '''(?i)linkedin(.{0,20})?(?-i)['\"][0-9a-z]{12}['\"]''' + tags = ["client", "LinkedIn"] +[[rules]] + description = "LinkedIn Secret Key" + regex = '''(?i)linkedin(.{0,20})?['\"][0-9a-z]{16}['\"]''' + tags = ["secret", "LinkedIn"] +[[rules]] + description = "Slack" + regex = '''xox[baprs]-([0-9a-zA-Z]{10,48})?''' + tags = ["key", "Slack"] +[[rules]] + description = "Asymmetric Private Key" + regex = '''-----BEGIN ((EC|PGP|DSA|RSA|OPENSSH) )?PRIVATE KEY( BLOCK)?-----''' + tags = ["key", "AsymmetricPrivateKey"] +[[rules]] + description = "Public Key" + regex = '''ssh-rsa''' + tags = ["keys", "public key"] +[[rules]] + description = "Gitlab Key" + regex = '''privateToken|private-token''' + tags = ["keys", "Gitlab"] +[[rules]] + description = "Generic Credential" + regex = '''(?i)(api_key|apikey|secret)(.{0,20})?['|"][0-9a-zA-Z]{16,45}['|"]''' + tags = ["key", "API", "generic"] +[[rules]] + description = "Google API key" + regex = '''AIza[0-9A-Za-z\\-_]{35}''' + tags = ["key", "Google"] +[[rules]] + description = "Heroku API key" + regex = '''(?i)heroku(.{0,20})?['"][0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}['"]''' + tags = ["key", "Heroku"] +[[rules]] + description = "MailChimp API key" + regex = '''(?i)(mailchimp|mc)(.{0,20})?['"][0-9a-f]{32}-us[0-9]{1,2}['"]''' + tags = ["key", "Mailchimp"] +[[rules]] + description = "Mailgun API key" + regex = '''(?i)(mailgun|mg)(.{0,20})?['"][0-9a-z]{32}['"]''' + tags = ["key", "Mailgun"] +[[rules]] + description = "PayPal Braintree access token" + regex = '''access_token\$production\$[0-9a-z]{16}\$[0-9a-f]{32}''' + tags = ["key", "Paypal"] +[[rules]] + description = "Picatic API key" + regex = '''sk_live_[0-9a-z]{32}''' + tags = ["key", "Picatic"] +[[rules]] + description = "SendGrid API Key" + regex = '''SG\.[\w_]{16,32}\.[\w_]{16,64}''' + tags = ["key", "SendGrid"] +[[rules]] + description = "Slack Webhook" + regex = '''https://hooks.slack.com/services/T[a-zA-Z0-9_]{8}/B[a-zA-Z0-9_]{8}/[a-zA-Z0-9_]{24}''' + tags = ["key", "slack"] +[[rules]] + description = "Stripe API key" + regex = '''(?i)stripe(.{0,20})?['\"][sk|rk]_live_[0-9a-zA-Z]{24}''' + tags = ["key", "Stripe"] +[[rules]] + description = "Square access token" + regex = '''sq0atp-[0-9A-Za-z\-_]{22}''' + tags = ["key", "square"] +[[rules]] + description = "Square OAuth secret" + regex = '''sq0csp-[0-9A-Za-z\\-_]{43}''' + tags = ["key", "square"] +[[rules]] + description = "Twilio API key" + regex = '''(?i)twilio(.{0,20})?['\"][0-9a-f]{32}['\"]''' + tags = ["key", "twilio"] +[whitelist] + description = "Whitelisted files" + file = '''(^\.?gitleaks.toml$|(.*?)(jpg|gif|doc|pdf|bin)|package-lock\.json$)''' diff --git a/.travis.yml b/.travis.yml index 2a624602e3..d656fb2d2c 100644 --- a/.travis.yml +++ b/.travis.yml @@ -35,4 +35,4 @@ script: - yarn build notifications: - webhooks: https://oapi.dingtalk.com/robot/send?access_token=2dacc76d8b1ea8bcdc792b50f103d13efdba9ef53ec0caeb70631bc3add56118 + webhooks: $dingdingWebhooks