Function AllSecretMatchers

secret-matchers.go:91–166

AllSecretMatchers returns the default list of SecretMatchers

()

// AllSecretMatchers returns the default list of SecretMatchers
func AllSecretMatchers() []SecretMatcher {

	return []SecretMatcher{
		awsMatcher(),
		gcpKeyMatcher(),
		firebaseMatcher(),
		githubKeyMatcher(),

		// REACT_APP_... containing objects
		{"(object) @matches", func(n *Node) *Secret {

			// disabled due to high false positive rate
			return nil

			o := n.AsObject()

			hasReactAppKeys := false
			for _, k := range o.GetKeys() {
				if strings.HasPrefix(k, "REACT_APP_") {
					hasReactAppKeys = true
					break
				}
			}

			if !hasReactAppKeys {
				return nil
			}

			return &Secret{
				Kind: "reactApp",
				Data: o.AsMap(),
			}
		}},

		// generic secrets
		{"(pair) @matches", func(n *Node) *Secret {

			// disabled due to very high false positive rate
			// but left easy to enable for research purposes
			return nil

			key := n.ChildByFieldName("key")
			if key == nil {
				return nil
			}

			keyStr := strings.ToLower(key.RawString())
			if !strings.Contains(keyStr, "secret") {
				return nil
			}

			value := n.ChildByFieldName("value")
			if value == nil || value.Type() != "string" {
				return nil
			}

			data := map[string]string{
				"key": value.RawString(),