forked from mirrors/kingfisher
0f953f59a5
Why: Hyperscan doesn’t support lookaheads/behinds, so many “must contain X and Y” checks had to be baked into the regex (hurting readability) or were impossible. pattern_requirements applies lightweight, in-memory checks after a match is found, keeping patterns fast and clean.
63 lines
No EOL
1.9 KiB
YAML
63 lines
No EOL
1.9 KiB
YAML
rules:
|
|
- name: GCP API Token
|
|
id: kingfisher.gcp.1
|
|
pattern: |
|
|
(?xims)
|
|
(
|
|
\{[^{}]*
|
|
\"auth_provider_x509_cert_url\":
|
|
.{0,512}?
|
|
}
|
|
)
|
|
|
|
|
\{
|
|
(?:[^{}]|\{(?:[^{}]|\{[^{}]*\})*\})*
|
|
"auth_provider_x509_cert_url":\s*".+?"
|
|
(?:[^{}]|\{(?:[^{}]|\{[^{}]*\})*\})*
|
|
\}
|
|
pattern_requirements:
|
|
min_digits: 2
|
|
min_entropy: 4.5
|
|
confidence: high
|
|
examples:
|
|
- '{"auth_provider_x509_cert_url":DFD5dC97C711CE1E078FD0A5CBCE1fE895D44abb47faeD9280db6137a35EDdfBd173Dbf57B1e54c10dD9B8E36bdE4816EedEF6c55D9ca4FC14dEf71c9bNd6a5aF9c46EC6BdfCD4f7fEeb2B9E96A8CfBD9a965bbaDAACe0d09ffe19Fc5BF3B6c9636A9b35d0cFcfC0ECb118edf8E2dEae3f1D3C36F5Da9DBe562f3E2deb9D20f4ndDC106bdEdBeaB5629362eE6d0C1b90e84A6C281C14c2ade40c3AF17ACeEfe0e998d5f3BaadbB7D479ab3cEbc8Be263Dc07dF2}'
|
|
- |-
|
|
{
|
|
"admin": {
|
|
"credential": {
|
|
"auth_provider_x509_cert_url": "https://www.googleapis.com/oauth2/v1/certs",
|
|
"auth_uri": "https://accounts.google.com/o/oauth2/auth",
|
|
"client_email": "firebase-example@firebase-example.iam.gserviceaccount.com",
|
|
"client_id": "218284793146200123456",
|
|
"client_x509_cert_url": "https://www.googleapis.com/robot/v1/metadata/x509/firebase-example-a1mrc%40firebase-example.iam.gserviceaccount.com",
|
|
"database_url": "https://example.firebaseio.com"
|
|
}
|
|
}
|
|
}
|
|
validation:
|
|
type: GCP
|
|
- name: GCP Private Key ID
|
|
id: kingfisher.gcp.3
|
|
pattern: |
|
|
(?xi)
|
|
\b
|
|
gcp
|
|
(?:
|
|
.{0,20}?
|
|
(?:key|secret)
|
|
)
|
|
.{0,12}
|
|
[=:]
|
|
\s{0,8}
|
|
["']?
|
|
(
|
|
[0-9a-z]{35,40}
|
|
)
|
|
["']?
|
|
\b
|
|
pattern_requirements:
|
|
min_digits: 2
|
|
min_entropy: 3.5
|
|
confidence: medium
|
|
examples:
|
|
- gcp_secret = ANzaSy0c3475372a7b10f7740dbda47abfdca42 |