Hardcoded credentials rule will flag any parser code (like for "token")

[securego]

Hardcoded credentials rule will flag any parser code (like for "token")

[gcmurphy]

Just merged PR #109 that will ensure the first example does not report an error.

The second example shouldn't trigger as we only look for variables containing phrases like password, key, token or secret so 'UsernameFieldLabel' shouldn't trigger it, however the error reporting for GenDecl blocks such as that didn't reference the exact constant declaration that was causing the error, instead it was referencing the entire const ( ) block. So I fixed that in PR #110.

The test is still pretty noisy which is why it has been marked as a low confidence result. We are looking at introducing and additional entropy check (see #105) which should reduce these kinds of false positives.

[willfaught]

Wouldn't PasswordFieldLabel be flagged?

…

On Wed, Jan 11, 2017 at 10:31 AM Grant Murphy ***@***.***> wrote: Just merged PR #109 <#109> that will ensure the first example does not report an error. The second example shouldn't trigger as we only look for variables containing phrases like password, key, token or secret so 'UsernameFieldLabel' shouldn't trigger it, however the error reporting for GenDecl blocks such as that didn't reference the exact constant declaration that was causing the error, instead it was referencing the entire const ( ) block. So I fixed that in PR #110 <#110>. The test is still pretty noisy which is why it has been marked as a low confidence result. We are looking at introducing and additional entropy check (see #105 <#105>) which should reduce these kinds of false positives. — You are receiving this because you authored the thread. Reply to this email directly, view it on GitHub <#108 (comment)>, or mute the thread <https://github.com/notifications/unsubscribe-auth/AAD5Vhfcgme_klIKE8GOIhnA0ZHICT_bks5rRSACgaJpZM4Lgdp8> .

[gcmurphy]

Yes it would currently. There is the option to use the flag -exclude=G101 to exclude this rule.

[gcmurphy]

Closing.

There isn't really a heuristic that we can use here to reduce false positives in variable naming. This test should really target things like API keys so when #105 is merged it will eliminate a large number of false positives around innocuous things like const PasswordFieldLabel = "Enter password".

In addition the option is available to exclude this test altogether via the -exclude=G101 command line option or add a // #nosec comment to the affected field. (e.g. const PasswordFieldLabel = "Enter password" // #nosec), the nosec tags are also applicable to entire blocks. (e.g. a whole block of constants).

[willfaught]

OK, thanks.