gitleaks/config/allowlist.go

package config

import (
	"regexp"
)

// used for ignoring .git directories when the --no-git flag is set
// related issue: https://github.com/zricethezav/gitleaks/issues/486
const dotGit = `/\.git/`

// AllowList is struct containing items that if encountered will allowlist
// a commit/line of code that would be considered a leak.
type AllowList struct {
	Description string
	Regexes     []*regexp.Regexp
	Commits     []string
	Files       []*regexp.Regexp
	Paths       []*regexp.Regexp
	Repos       []*regexp.Regexp
}

// CommitAllowed checks if a commit is allowlisted
func (a *AllowList) CommitAllowed(commit string) bool {
	for _, hash := range a.Commits {
		if commit == hash {
			return true
		}
	}
	return false
}

// FileAllowed checks if a file is allowlisted
func (a *AllowList) FileAllowed(fileName string) bool {
	return anyRegexMatch(fileName, a.Files)
}

// PathAllowed checks if a path is allowlisted
func (a *AllowList) PathAllowed(filePath string) bool {
	return anyRegexMatch(filePath, a.Paths)
}

// RegexAllowed checks if a regex is allowlisted
func (a *AllowList) RegexAllowed(content string) bool {
	return anyRegexMatch(content, a.Regexes)
}

// RepoAllowed checks if a regex is allowlisted
func (a *AllowList) RepoAllowed(repo string) bool {
	return anyRegexMatch(repo, a.Repos)
}

// IgnoreDotGit appends a `\.git` rule to ignore all .git paths. This is used for --no-git scans
func (a *AllowList) IgnoreDotGit() error {
	re, err := regexp.Compile(dotGit)
	if err != nil {
		return err
	}
	a.Paths = append(a.Paths, re)
	return nil
}