diff --git a/src/Regex/Supplier/Gitlab.php b/src/Regex/Supplier/Gitlab.php new file mode 100644 index 0000000..b8c5a51 --- /dev/null +++ b/src/Regex/Supplier/Gitlab.php @@ -0,0 +1,50 @@ + + * + * For the full copyright and license information, please view the LICENSE + * file that was distributed with this source code. + */ + +declare(strict_types=1); + +namespace CaptainHook\Secrets\Regex\Supplier; + +use CaptainHook\Secrets\Regex\Supplier; + +/** + * Gitlab regex + * + * Provides the regex to find Gitlab secrets. + * + * @package CaptainHook-Secrets + * @since Class available since Release 0.9.6 + */ +final class Gitlab implements Supplier { + + /** + * Sourced from https://github.com/gitlabhq/gitlabhq/blob/master/gems/gitlab-secret_detection/lib/gitleaks.toml#L4-L51 + * @return string[] + */ + public function patterns(): array { + return [ + // GitLab Personal Access Token + '#' . Util::OPTIONAL_QUOTE . '(glpat-[0-9a-zA-Z_\\-]{20})' . Util::OPTIONAL_QUOTE . '#', + // GitLab Pipeline Trigger Token + '#' . Util::OPTIONAL_QUOTE . '(glptt-[0-9a-zA-Z_\\-]{40})' . Util::OPTIONAL_QUOTE . '#', + // GitLab Runner Registration Token + '#' . Util::OPTIONAL_QUOTE . '(GR1348941[0-9a-zA-Z_\\-]{20})' . Util::OPTIONAL_QUOTE . '#', + // GitLab OAuth Application Secrets + '#' . Util::OPTIONAL_QUOTE . '(gloas-[0-9a-zA-Z_\\-]{64})' . Util::OPTIONAL_QUOTE . '#', + // GitLab Feed token + '#' . Util::OPTIONAL_QUOTE . '(glft-[0-9a-zA-Z_\\-]{20})' . Util::OPTIONAL_QUOTE . '#', + // GitLab Agent for Kubernetes token + '#' . Util::OPTIONAL_QUOTE . '(glagent-[0-9a-zA-Z_\\-]{50})' . Util::OPTIONAL_QUOTE . '#', + // GitLab Incoming email token + '#' . Util::OPTIONAL_QUOTE . '(glimt-[0-9a-zA-Z_\\-]{25})' . Util::OPTIONAL_QUOTE . '#', + ]; + } +} \ No newline at end of file diff --git a/tests/Regex/Supplier/GitlabTest.php b/tests/Regex/Supplier/GitlabTest.php new file mode 100644 index 0000000..71e852b --- /dev/null +++ b/tests/Regex/Supplier/GitlabTest.php @@ -0,0 +1,29 @@ +useSuppliers(new Gitlab()); + $result = $detector->detectIn($haystack); + + $this->assertTrue($result->wasSecretDetected()); + $this->assertCount(1, $result->matches()); + } + + public function testDontDetectSecret(): void + { + $haystack = 'bar glpat-mBvGsDcJUvx... gitlab glpat-15487234 glpat-mBvG{}_JUvxvFZktWpzz'; + $detector = Detector::create()->useSuppliers(new Gitlab()); + $result = $detector->detectIn($haystack); + + $this->assertFalse($result->wasSecretDetected()); + $this->assertCount(0, $result->matches()); + } +} \ No newline at end of file