fix(loki.secretfilter): Fix partial masking for short secrets and support multiple allowlists per rule #2320
Conversation
|
💻 Deploy preview available: https://deploy-preview-alloy-2320-zb444pucvq-vp.a.run.app/docs/alloy/latest/ |
romain-gaillard
requested review from
clayton-cornell and
a team
as code owners
| Regexes []string | ||
| } | ||
| Rules []struct { | ||
| ID string | ||
| Description string | ||
| Description string // Not used |
There was a problem hiding this comment.
Are these unused variables still here so the format processes? What is the harm in removing them?
There was a problem hiding this comment.
Yes, indeed they could be removed. I initially added them to keep track of features we don't currently support but might in the future.
There was a problem hiding this comment.
In that case I would rather remote/comment out the whole line so they cant mistakenly be used.
There was a problem hiding this comment.
👍 I removed it
clayton-cornell
added
the
type/docs
|
|
||
| The `gitleaks_config` argument is the path to the custom `gitleaks.toml` file. | ||
| The Gitleaks configuration file embedded in the component is used if you don't provide the path to a custom configuration file. | ||
|
|
||
| The `types` argument is a map of secret types to look for. The values are used as prefixes for the secret types in the Gitleaks configuration. If you don't provide this argument, all types are used. | ||
| {{< admonition type="note" >}} | ||
| This component does not support all the features of the Gitleaks configuration file. Currently, it only supports the regex-based rules, `secretGroup`, and allowlist regexes (`regexTarget` only supports the default value `secret`). Other features such as `keywords`, `entropy`, `paths`, and `stopwords` are not supported. The `extend` feature is also not supported, meaning that a custom configuration file must contain all the rules to use. |
There was a problem hiding this comment.
| This component does not support all the features of the Gitleaks configuration file. Currently, it only supports the regex-based rules, `secretGroup`, and allowlist regexes (`regexTarget` only supports the default value `secret`). Other features such as `keywords`, `entropy`, `paths`, and `stopwords` are not supported. The `extend` feature is also not supported, meaning that a custom configuration file must contain all the rules to use. | |
| This component doesn't support all the features of the Gitleaks configuration file. It only supports regular expression-based rules, `secretGroup`, and allowlist regular expressions. `regexTarget` only supports the default value `secret`. Other features such as `keywords`, `entropy`, `paths`, and `stopwords` are not supported. The `extend` feature is not supported. If you use a custom configuration file, you must include all the rules you want to use within the configuration file. |
It's not clear to me here... is it regex-based rules AND secretGroup AND allowlist? Or just secretGroup and allowlist (which are regex-based rules)? I assume it's the first one... and the suggestion reflects that assumption.
The "other features"... are they actually features? or arguments?
There was a problem hiding this comment.
Yes, indeed, it's the first one.
I think it's still worth keeping a mention to the Gitleaks configuration file? Because people would read the documentation on the Gitleaks configuration file (or import it from a different place they use it) and maybe expect some features to work in this component too. That's why I wanted to list what's supported and what's not in the Gitleaks configuration file format
There was a problem hiding this comment.
Also, for the feature/argument part, it's probably both. The feature (e.g. entropy, stopwords, ...) is configured via arguments. The feature is currently not implemented and the related arguments are therefore ignored.
There was a problem hiding this comment.
I updated the suggestion to include the Gitleaks part. We can leave the "other features" part as-is :-)
Co-authored-by: Clayton Cornell <[email protected]>
PR Description
partial_maskvalue.[[rules.allowlists]]format added in Gitleaks v8.21.0Which issue(s) this PR fixes
Notes to the Reviewer
PR Checklist