Add context to Artifactory encrypted token (#229)

bridgecrewio · Nov 18, 2024 · 09e470f · 09e470f
1 parent b6d2e92
commit 09e470f
Show file tree

Hide file tree

Showing 2 changed files with 12 additions and 11 deletions.
diff --git a/detect_secrets/plugins/artifactory.py b/detect_secrets/plugins/artifactory.py
@@ -12,6 +12,6 @@ class ArtifactoryDetector(RegexBasedDetector):
         # API token:
         re.compile(r'(?:\s|=|:|"|^)AKC[a-zA-Z0-9]{10,200}(?:\s|"|$)'),
         # Artifactory encrypted passwords begin with AP[A-Z]
-        # Password:
-        re.compile(r'(?<!AAAA[_\-\w]{7})(?:\s|=|:|"|^)AP[\dABCDEF][a-zA-Z0-9]{8,200}(?:\s|"|$)'),
+        # Keyword with Password:
+        re.compile(r'(?<!AAAA[_\-\w]{7})(?i:artif|jfrog|buildkit)(?:.{0,100}\n?){0,2}(?:\s|=|:|"|^)(AP[\dABCDEF][a-zA-Z0-9]{8,200})(?:\s|"|$)'),
     ]
diff --git a/tests/plugins/artifactory_test.py b/tests/plugins/artifactory_test.py
@@ -8,18 +8,19 @@ class TestArtifactoryDetector:
     @pytest.mark.parametrize(
         'payload, should_flag',
         [
-            ('AP6xxxxxxxxxx', True),
-            ('AP2xxxxxxxxxx', True),
-            ('AP3xxxxxxxxxx', True),
-            ('AP5xxxxxxxxxx', True),
-            ('APAxxxxxxxxxx', True),
-            ('APBxxxxxxxxxx', True),
+            ('artifactory = AP6xxxxxxxxxx', True),
+            ('artifactory = ap6xxxxxxxxxx', False),
+            ('artif \n key=AP2xxxxxxxxxx', True),
+            ('jfrog      AP3xxxxxxxxxx', True),
+            ('jfrog AP5xxxxxxxxxx', True),
+            ('jfrog APAxxxxxxxxxx', True),
+            ('jfrog APBxxxxxxxxxx', True),
             ('AKCxxxxxxxxxx', True),
-            (' AP6xxxxxxxxxx', True),
+            ('jfrog_secret=AP6xxxxxxxxxx', True),
             (' AKCxxxxxxxxxx', True),
-            ('=AP6xxxxxxxxxx', True),
+            ('artifactory_secret=AP6xxxxxxxxxx', True),
             ('=AKCxxxxxxxxxx', True),
-            ('\"AP6xxxxxxxxxx\"', True),
+            ('artif \"AP6xxxxxxxxxx\"', True),
             ('\"AKCxxxxxxxxxx\"', True),
             ('artif-key:AP6xxxxxxxxxx', True),
             ('artif-key:AKCxxxxxxxxxx', True),