Skip to content

Commit 22b111f

Browse files
mickgmdbmickgmdb
authored
Merge pull request #143 from mongodb/development
v1.63.0
2 parents 1b8bb0e + 03a6699 commit 22b111f

File tree

20 files changed

+318
-130
lines changed

20 files changed

+318
-130
lines changed

‎.github/workflows/ci.yml‎

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -77,9 +77,10 @@ jobs:
7777
C:\vcpkg\downloads
7878
C:\vcpkg\archives
7979
C:\Users\runneradmin\AppData\Local\vcpkg\archives
80-
key: ${{ runner.os }}-vcpkg-hyperscan-542
80+
key: vcpkg-${{ runner.os }}-hs-542
8181
restore-keys: |
82-
${{ runner.os }}-vcpkg-
82+
vcpkg-${{ runner.os }}-
83+
vcpkg-
8384
8485
# Ensure downloads dir exists and seed PCRE 8.45 zip from a working mirror
8586
- name: Pre-seed PCRE 8.45 for vcpkg (bypass SourceForge redirect)

‎.github/workflows/release.yml‎

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -212,9 +212,10 @@ jobs:
212212
C:\vcpkg\downloads
213213
C:\vcpkg\archives
214214
C:\Users\runneradmin\AppData\Local\vcpkg\archives
215-
key: ${{ runner.os }}-vcpkg-hyperscan-542
215+
key: vcpkg-${{ runner.os }}-hs-542
216216
restore-keys: |
217-
${{ runner.os }}-vcpkg-
217+
vcpkg-${{ runner.os }}-
218+
vcpkg-
218219
219220
# Ensure downloads dir exists and seed PCRE 8.45 zip from a working mirror
220221
- name: Pre-seed PCRE 8.45 for vcpkg (bypass SourceForge redirect)

‎CHANGELOG.md‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -2,6 +2,11 @@
22

33
All notable changes to this project will be documented in this file.
44

5+
## [v1.63.0]
6+
- Fixed bug when retrieving some finding values and injecting them as TOKENS in the rule templates
7+
- Improved Datadog rule
8+
- Improved AWS rule
9+
510
## [v1.62.0]
611
- Added `pattern_requirements` checks to rules, providing lightweight post-regex character-class validation without lookarounds. See docs/RULES.md for detail
712
- Added an `ignore_if_contains` option to `pattern_requirements` to drop matches containing case-insensitive placeholder words, with tests covering the new behavior.

‎Cargo.toml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -10,7 +10,7 @@ publish = false
1010

1111
[package]
1212
name = "kingfisher"
13-
version = "1.62.0"
13+
version = "1.63.0"
1414
description = "MongoDB's blazingly fast and accurate secret scanning and validation tool"
1515
edition.workspace = true
1616
rust-version.workspace = true

‎data/rules/datadog.yml‎

Lines changed: 88 additions & 40 deletions
Original file line numberDiff line numberDiff line change
@@ -1,65 +1,113 @@
11
rules:
22
- name: Datadog API Key
3-
id: kingfisher.datadog.1
3+
id: kingfisher.datadog.3
44
pattern: |
5-
(?xi)
5+
(?xi)
66
\b
7-
datadog
7+
(?:datadog|dd)
88
(?:.|[\n\r]){0,64}?
9-
(?:SECRET|PRIVATE|ACCESS|KEY|TOKEN)
9+
(?:SECRET|PRIVATE|ACCESS|KEY|TOKEN)?
1010
(?:.|[\n\r]){0,32}?
11-
\b
11+
\b
1212
(
13-
[a-z0-9]{32}
13+
[A-Za-z0-9]{32}
1414
)
1515
\b
1616
pattern_requirements:
1717
min_digits: 2
1818
min_entropy: 3.3
1919
confidence: medium
2020
examples:
21-
- datadog-secrettoken-0024a29224affe29d173c0bf99e5a89d
21+
- DD_API_KEY=0024a29224affe29d173c0bf99e5a89d
2222
references:
2323
- https://docs.datadoghq.com/account_management/api-app-keys/
2424
validation:
2525
type: Http
2626
content:
2727
request:
28+
method: GET
29+
url: https://api.datadoghq.com/api/v1/validate
2830
headers:
2931
Accept: application/json
30-
DD-API-KEY: '{{ TOKEN }}'
31-
DD-APPLICATION-KEY: '{{ APPKEY }}'
32-
method: GET
32+
DD-API-KEY: "{{ TOKEN }}"
3333
response_matcher:
3434
- report_response: true
35-
- status:
36-
- 200
37-
type: StatusMatch
38-
url: https://api.datadoghq.com/api/v2/current_user
39-
depends_on_rule:
40-
- rule_id: kingfisher.datadog.2
41-
variable: APPKEY
35+
- type: StatusMatch
36+
status: [200]
4237

43-
- name: Datadog Application Secret
44-
id: kingfisher.datadog.2
45-
pattern: |
46-
(?xi)
47-
\b
48-
datadog
49-
(?:.|[\n\r]){0,64}?
50-
(?:SECRET|PRIVATE|ACCESS|KEY|TOKEN)
51-
(?:.|[\n\r]){0,16}?
52-
(
53-
[a-z0-9]{40}
54-
)
55-
pattern_requirements:
56-
min_digits: 2
57-
min_uppercase: 1
58-
min_lowercase: 1
59-
min_entropy: 3.3
60-
confidence: medium
61-
examples:
62-
- datadog_secret_key-3c0c3965368a6b10f7640dbda46abfdca981c2d3
63-
- datadog_token = BzHpkcs7LujMb3Q1vLRRjbpBNxxYV0ousumYoKJS
64-
references:
65-
- https://docs.datadoghq.com/account_management/api-app-keys/
38+
# - name: Datadog API Key
39+
# id: kingfisher.datadog.1
40+
# pattern: |
41+
# (?xi)
42+
# \b
43+
# datadog
44+
# (?:.|[\n\r]){0,64}?
45+
# (?:SECRET|PRIVATE|ACCESS|KEY|TOKEN)
46+
# (?:.|[\n\r]){0,32}?
47+
# \b
48+
# (
49+
# [a-z0-9]{32}
50+
# )
51+
# \b
52+
# pattern_requirements:
53+
# min_digits: 2
54+
# min_entropy: 3.3
55+
# confidence: medium
56+
# examples:
57+
# - datadog-secrettoken-0024a29224affe29d173c0bf99e5a89d
58+
# references:
59+
# - https://docs.datadoghq.com/account_management/api-app-keys/
60+
# validation:
61+
# type: Http
62+
# content:
63+
# request:
64+
# headers:
65+
# Accept: application/json
66+
# DD-API-KEY: '{{ TOKEN }}'
67+
# DD-APPLICATION-KEY: '{{ APPKEY }}'
68+
# method: GET
69+
# response_matcher:
70+
# - report_response: true
71+
# - status:
72+
# - 200
73+
# type: StatusMatch
74+
# url: https://api.datadoghq.com/api/v2/current_user
75+
# depends_on_rule:
76+
# - rule_id: kingfisher.datadog.2
77+
# variable: APPKEY
78+
79+
# - name: Datadog API Key (API-only validation)
80+
# id: kingfisher.datadog.3
81+
# pattern: |
82+
# (?xi)
83+
# \b
84+
# (?:datadog|dd)
85+
# (?:.|[\n\r]){0,64}?
86+
# (?:SECRET|PRIVATE|ACCESS|KEY|TOKEN)?
87+
# (?:.|[\n\r]){0,32}?
88+
# \b
89+
# (
90+
# [A-Za-z0-9]{32}
91+
# )
92+
# \b
93+
# pattern_requirements:
94+
# min_digits: 2
95+
# min_entropy: 3.3
96+
# confidence: medium
97+
# examples:
98+
# - DD_API_KEY=0024a29224affe29d173c0bf99e5a89d
99+
# references:
100+
# - https://docs.datadoghq.com/account_management/api-app-keys/
101+
# validation:
102+
# type: Http
103+
# content:
104+
# request:
105+
# method: GET
106+
# url: https://api.datadoghq.com/api/v1/validate
107+
# headers:
108+
# Accept: application/json
109+
# DD-API-KEY: "{{ TOKEN }}"
110+
# response_matcher:
111+
# - report_response: true
112+
# - type: StatusMatch
113+
# status: [200]

‎src/decompress.rs‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -340,7 +340,7 @@ mod tests {
340340
fn smoke_decompress_tar_gz_archive() -> anyhow::Result<()> {
341341
let dir = tempdir()?;
342342
let tar_gz = dir.path().join("payload.tar.gz");
343-
let github_pat = "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"; // this is not a real secret
343+
let github_pat = "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"; // this is not a real secret
344344

345345
// build payload.tar.gz containing secret.txt
346346
{
@@ -393,7 +393,7 @@ mod tests {
393393
fn smoke_decompress_without_extract_archives() -> anyhow::Result<()> {
394394
let dir = tempdir()?;
395395
let tar_gz = dir.path().join("payload.tar.gz");
396-
let github_pat = "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";
396+
let github_pat = "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";
397397

398398
// ── build payload.tar.gz containing secret.txt ──────────────────────────────
399399
{

‎src/main.rs‎

Lines changed: 15 additions & 15 deletions
Original file line numberDiff line numberDiff line change
@@ -5,27 +5,27 @@
55
// * Fallback - system allocator (`system-alloc` feature)
66
// ────────────────────────────────────────────────────────────
77

8-
// --- jemalloc (opt-in) ---
9-
#[cfg(feature = "use-jemalloc")]
10-
#[global_allocator]
11-
static GLOBAL: tikv_jemallocator::Jemalloc = tikv_jemallocator::Jemalloc;
12-
13-
// --- mimalloc (default) ---
14-
#[cfg(all(not(feature = "use-jemalloc"), not(feature = "system-alloc")))]
15-
#[global_allocator]
16-
static GLOBAL: mimalloc::MiMalloc = mimalloc::MiMalloc;
8+
// // --- jemalloc (opt-in) ---
9+
// #[cfg(feature = "use-jemalloc")]
10+
// #[global_allocator]
11+
// static GLOBAL: tikv_jemallocator::Jemalloc = tikv_jemallocator::Jemalloc;
1712

18-
// --- system allocator (explicit opt-out) ---
19-
#[cfg(feature = "system-alloc")]
20-
use std::alloc::System;
21-
#[cfg(feature = "system-alloc")]
22-
#[global_allocator]
23-
static GLOBAL: System = System;
13+
// // --- mimalloc (default) ---
14+
// #[cfg(all(not(feature = "use-jemalloc"), not(feature = "system-alloc")))]
15+
// #[global_allocator]
16+
// static GLOBAL: mimalloc::MiMalloc = mimalloc::MiMalloc;
2417

18+
// // --- system allocator (explicit opt-out) ---
19+
// #[cfg(feature = "system-alloc")]
2520
// use std::alloc::System;
21+
// #[cfg(feature = "system-alloc")]
2622
// #[global_allocator]
2723
// static GLOBAL: System = System;
2824

25+
use std::alloc::System;
26+
#[global_allocator]
27+
static GLOBAL: System = System;
28+
2929
use std::{
3030
io::{IsTerminal, Read},
3131
sync::{Arc, Mutex},

0 commit comments

Comments
 (0)