Skip to content

Added Heroku API Key New Version#1883

Merged
zricethezav merged 2 commits into
gitleaks:masterfrom
kashifkhan0771:rule/heroku-api-key-v2
Jun 5, 2025
Merged

Added Heroku API Key New Version#1883
zricethezav merged 2 commits into
gitleaks:masterfrom
kashifkhan0771:rule/heroku-api-key-v2

Conversation

@kashifkhan0771
Copy link
Copy Markdown
Contributor

@kashifkhan0771 kashifkhan0771 commented Jun 4, 2025

Description:

Heroku API Keys Pattern is updated.

Checklist:

  • Does your PR pass tests?
  • Have you written new tests for your changes?
  • Have you lint your code locally prior to submission?

Comment thread cmd/generate/config/rules/heroku.go Outdated
Comment on lines +33 to +34
Regex: utils.GenerateUniqueTokenRegex(`\b(HRKU-AA[0-9a-zA-Z_-]{58})\b`, true),
Keywords: []string{"HRKU-AA"},
Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

A few observations:

  1. Using \b isn't required in conjunction with GenerateUniqueTokenRegex. Also, \b is never valid beside a character like -, on [a-zA-Z0-9_].
  2. GenerateUniqueTokenRegex also take scare of capture groups, so they don't have to be manually defined.
  3. The second parameter should be false, otherwise it marks the entire regex as case-insensitive which makes it possible to match invalid strings (hrku-aa).
  4. A rule should almost always have a minimum entropy threshold.
Suggested change
Regex: utils.GenerateUniqueTokenRegex(`\b(HRKU-AA[0-9a-zA-Z_-]{58})\b`, true),
Keywords: []string{"HRKU-AA"},
Regex: utils.GenerateUniqueTokenRegex(`HRKU-AA[0-9a-zA-Z_-]{58}`, false),
Entropy: 4,
Keywords: []string{"HRKU-AA"},

@zricethezav
Copy link
Copy Markdown
Collaborator

nice, thanks @kashifkhan0771 and @rgmz

@zricethezav zricethezav merged commit 6f251ee into gitleaks:master Jun 5, 2025
2 checks passed
@kashifkhan0771 kashifkhan0771 deleted the rule/heroku-api-key-v2 branch June 5, 2025 05:22
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants