chore: Add a .gitleaks.toml to fix the false/positives from the infosec scans#2452
Open
lholmquist wants to merge 1 commit intoredhat-developer:mainfrom
Open
chore: Add a .gitleaks.toml to fix the false/positives from the infosec scans#2452lholmquist wants to merge 1 commit intoredhat-developer:mainfrom
lholmquist wants to merge 1 commit intoredhat-developer:mainfrom
Conversation
Review Summary by QodoAdd .gitleaks.toml to suppress false positive token detections
WalkthroughsDescription• Add .gitleaks.toml configuration file • Allowlist three test tokens to prevent false positives • Suppress infosec scan warnings for known test credentials Diagramflowchart LR
A["Infosec Scans"] -- "detect test tokens" --> B["False Positives"]
C[".gitleaks.toml"] -- "allowlist tokens" --> B
B -- "suppressed" --> D["Clean Scan Results"]
File Changes1. .gitleaks.toml
|
Code Review by Qodo
1. Global token allowlist
|
lholmquist
force-pushed
the
add-gitleaks-toml
branch
from
5d50092 to
3f6e21c
Compare
|
![rhdh-qodo-merge[bot]](https://avatars.githubusercontent.com/in/1961108?s=60&v=4){kind=small}
Comment on lines
+1
to
+8
| [allowlist] | ||
| description = "Global Allowlist" | ||
|
|
||
| regexes = [ | ||
| '''ABTLWHOULUVAXGTRYU7OC2876QJ2O''', | ||
| '''GR1348941oP5naQnWsbJRTvXHC7VJ''', | ||
| '''ghs_16C7e42F292c6912E7710c838347Ae178B4a''', | ||
| ] |
There was a problem hiding this comment.
1. Global token allowlist 🐞 Bug ⛨ Security
The new .gitleaks.toml globally allowlists full token-like values, meaning if any of these values ever appear outside the intended test fixtures, gitleaks will silently ignore them and you may miss a real leak. Since these values come from test fixtures, a safer approach is to redact/replace them in fixtures (or scope allowlisting to fixture paths) rather than allowlisting the raw token strings repo-wide.
Agent Prompt
## Issue description
A repo-wide gitleaks allowlist containing full token-like values suppresses detection everywhere and keeps realistic token strings in the repository.
## Issue Context
The allowlisted strings appear to come from bulk-import backend MSW fixtures.
## Fix Focus Areas
- .gitleaks.toml[1-8]
- workspaces/bulk-import/plugins/bulk-import-backend/__fixtures__/github/app/installations/app-installation-1-access-tokens.json[1-4]
- workspaces/bulk-import/plugins/bulk-import-backend/__fixtures__/github/repos/my-ent-org-2/A2/repo.json[205-223]
- workspaces/bulk-import/plugins/bulk-import-backend/__fixtures__/github/user/repos.json[94-103]
- workspaces/bulk-import/plugins/bulk-import-backend/__fixtures__/handlers.ts[24-36]
- workspaces/bulk-import/plugins/bulk-import-backend/__fixtures__/handlers.ts[53-64]
ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
There were some invalid access tokens in some of the test files that were triggering the infosec scans to report false positives.
After talking with that group, it was recommended that we add this
.gitleaks.tomlfile and add those to the allowed list so the scans would not report them.I confirmed that the scan ignores these by running the rh-gitleaks tool locally.
cc @kim-tsao
Hey, I just made a Pull Request!
✔️ Checklist