diff --git a/config/falsepositives/false-positives.yaml b/config/falsepositives/false-positives.yaml index dd58afc..8e9060a 100644 --- a/config/falsepositives/false-positives.yaml +++ b/config/falsepositives/false-positives.yaml @@ -513,7 +513,7 @@ rules: - 3075 - 6001 - 6002 - Pattern: "(?i)((password|secret|credentials|passphrase)['\"]? ?[:=] ?['\"]?([a-z]+[\\._\\s]+)+(password|pass|pwd|pswd|secret|passphrase)['\"]?$)" + Pattern: "(?i)((password|secret|credentials|passphrase|token)['\"]? ?[:=] ?['\"]?([a-z]+[\\._\\s]+)+(password|pass|pwd|pswd|secret|passphrase|token)['\"]?[,]?$)" FileExtensions: [] UseFullLine: true Description: 'Ignore variable definitions as password values eg: password = mongo.password or password: couchbase_db_password' diff --git a/pkg/scan/falsePositives_test.go b/pkg/scan/falsePositives_test.go index 1af69dc..94e94ad 100644 --- a/pkg/scan/falsePositives_test.go +++ b/pkg/scan/falsePositives_test.go @@ -681,6 +681,15 @@ func Test_findFalsePositive(t *testing.T) { }, wantIsFP: false, }, + { + name: "Skip token as variable definitions", + hit: Hit{ + Code: 3037, + Filename: "source.kt", + LineValue: ` const val AUTHORIZATION_TOKEN = "Authorization Token",`, + }, + wantIsFP: true, + }, } for _, tt := range tests { t.Run(tt.name, func(t *testing.T) {