Просмотр исходного кода

Add MaxMind license key rule (#1771)

* Add MaxMind license key rule

* Address review feedback for MaxMind license key rule
mmpnelson 10 месяцев назад
Родитель
Сommit
3e8cd2d1ab
3 измененных файлов с 29 добавлено и 0 удалено
  1. 1 0
      cmd/generate/config/main.go
  2. 21 0
      cmd/generate/config/rules/maxmind.go
  3. 7 0
      config/gitleaks.toml

+ 1 - 0
cmd/generate/config/main.go

@@ -147,6 +147,7 @@ func main() {
 		rules.MailGunSigningKey(),
 		rules.MapBox(),
 		rules.MattermostAccessToken(),
+		rules.MaxMindLicenseKey(),
 		rules.Meraki(),
 		rules.MessageBirdAPIToken(),
 		rules.MessageBirdClientID(),

+ 21 - 0
cmd/generate/config/rules/maxmind.go

@@ -0,0 +1,21 @@
+package rules
+
+import (
+	"github.com/zricethezav/gitleaks/v8/cmd/generate/config/utils"
+	"github.com/zricethezav/gitleaks/v8/config"
+)
+
+func MaxMindLicenseKey() *config.Rule {
+	// define rule
+	r := config.Rule{
+		RuleID:      "maxmind-license-key",
+		Description: "Discovered a potential MaxMind license key.",
+		Regex:       utils.GenerateUniqueTokenRegex(`[A-Za-z0-9]{6}_[A-Za-z0-9]{29}_mmk`, false),
+		Entropy:     4,
+		Keywords:    []string{"_mmk"},
+	}
+
+	// validate
+	tps := utils.GenerateSampleSecrets("maxmind", `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`) // gitleaks:allow
+	return utils.Validate(r, tps, nil)
+}

+ 7 - 0
config/gitleaks.toml

@@ -2514,6 +2514,13 @@ description = "Identified a Mattermost Access Token, which may compromise team c
 regex = '''(?i)[\w.-]{0,50}?(?:mattermost)(?:[ \t\w.-]{0,20})[\s'"]{0,3}(?:=|>|:{1,3}=|\|\||:|=>|\?=|,)[\x60'"\s=]{0,5}([a-z0-9]{26})(?:[\x60'"\s;]|\\[nr]|$)'''
 keywords = ["mattermost"]
 
+[[rules]]
+id = "maxmind-license-key"
+description = "Discovered a potential MaxMind license key."
+regex = '''\b([A-Za-z0-9]{6}_[A-Za-z0-9]{29}_mmk)(?:[\x60'"\s;]|\\[nr]|$)'''
+entropy = 4
+keywords = ["_mmk"]
+
 [[rules]]
 id = "messagebird-api-token"
 description = "Found a MessageBird API token, risking unauthorized access to communication platforms and message data."