diff --git a/CHANGELOG.md b/CHANGELOG.md index f826736..c760c91 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -3,6 +3,7 @@ All notable changes to this project will be documented in this file. ## [1.42.0] +- Added rules for authress, clickhouse - Internal refactoring of rule loader, git enumerator, and filetype guesser - Improved language detection diff --git a/data/rules/clickhouse.yml b/data/rules/clickhouse.yml new file mode 100644 index 0000000..8e3d7c4 --- /dev/null +++ b/data/rules/clickhouse.yml @@ -0,0 +1,55 @@ +rules: + - name: ClickHouse Cloud Secret Key + id: kingfisher.clickhouse.1 + pattern: | + (?xi) + \b + ( + 4b1d[a-z0-9]{38} + ) + \b + confidence: medium + min_entropy: 3.5 + examples: + - "4b1dwEZ8aNo1U9ODBqffSci1INBrltLHM2d1bHF4dq" + validation: + type: Http + content: + request: + method: GET + url: "https://api.clickhouse.cloud/v1/organizations" + headers: + Authorization: "Basic {{ CLICKHOUSE_ID | append: ':' | append: TOKEN | b64enc }}" + response_matcher: + - report_response: true + - type: StatusMatch + status: [200] + - type: WordMatch + words: + - '"id":' + - '"name":' + match_all_words: true + depends_on_rule: + - rule_id: "kingfisher.clickhouse.2" + variable: CLICKHOUSE_ID + references: + - https://clickhouse.com/docs/en/cloud/security/service-accounts + - name: ClickHouse Cloud Key ID + id: kingfisher.clickhouse.2 + pattern: | + (?xi) + \b + clickhouse + (?:.|[\n\r]){0,16}? + (?:\bID|\bUSER) + (?:.|[\n\r]){0,16}? + \b + ( + [a-z0-9]{20} + ) + \b + confidence: medium + visible: false + min_entropy: 3.0 + examples: + - "clickhouse_id = 4ywspD2Tb0gJh4QbLnDI"