Huge News!Announcing our $40M Series B led by Abstract Ventures.Learn More
Socket
Sign inDemoInstall
Socket

eslint-plugin-no-secrets

Package Overview
Dependencies
Maintainers
1
Versions
17
Alerts
File Explorer

Advanced tools

Socket logo

Install Socket

Detect and block malicious and high-risk dependencies

Install

eslint-plugin-no-secrets

An eslint rule that searches for potential secrets/keys in code

  • 0.7.9
  • Source
  • npm
  • Socket score

Version published
Weekly downloads
89K
increased by8.39%
Maintainers
1
Weekly downloads
 
Created
Source

Build Status

eslint-plugin-no-secrets

An eslint rule that searches for potential secrets/keys in code and JSON files.

1. Usage

npm i -D eslint-plugin-no-secrets

.eslintrc

{
   "plugins":["no-secrets"],
   "rules":{
       "no-secrets/no-secrets":"error"
   }
}
//Found a string with entropy 4.3 : "ZWVTjPQSdhwRgl204Hc51YCsritMIzn8B=/p9UyeX7xu6KkAGqfm3FJ+oObLDNEva"
const A_SECRET = "ZWVTjPQSdhwRgl204Hc51YCsritMIzn8B=/p9UyeX7xu6KkAGqfm3FJ+oObLDNEva";
//Found a string that matches "AWS API Key" : "AKIAIUWUUQQN3GNUA88V"
const AWS_TOKEN = "AKIAIUWUUQQN3GNUA88V";

1.1. Include JSON files

If you want to include JSON files, either us the --ext flag from the command line

eslint . --ext .json,.js

or run them on individual JSON files

eslint config.json

2. Config

Decrease the tolerance for entropy

{
   "plugins":["no-secrets"],
   "rules":{
       "no-secrets/no-secrets":["error",{"tolerance":3.2}]
   }
}

Add additional patterns to check for certain token formats.
Standard patterns can be found here

{
 "plugins": ["no-secrets"],
 "rules": {
   "no-secrets/no-secrets": [
     "error",
     { "additionalRegexes": { "Basic Auth": "Authorization: Basic [A-Za-z0-9+/=]*" } }
   ]
 }
}

3. When it's really not a secret

3.1. Either disable it with a comment

// Set of potential base64 characters
// eslint-disable-next-line no-secrets/no-secrets
const BASE64_CHARS = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/=";

This will tell future maintainers of the codebase that this suspicious string isn't an oversight

3.2. use the ignoreContent to ignore certain content

{
   "plugins":["no-secrets"],
   "rules":{
       "no-secrets/no-secrets":["error",{"ignoreContent":"^ABCD"}]
   }
}

3.3. Use ignoreIdentifiers to ignore certain variable/property names

{
   "plugins":["no-secrets"],
   "rules":{
       "no-secrets/no-secrets":["error",{"ignoreIdentifiers":["BASE64_CHARS"]}]
   }
}

3.4. Use additionalDelimiters to further split up tokens

Tokens will always be split up by whitespace within a string. However, sometimes words that are delimited by something else (e.g. dashes, periods, camelcase words). You can use additionalDelimiters to handle these cases.

For example, if you want to split words up by the character . and by camelcase, you could use this configuration:

{
   "plugins":["no-secrets"],
   "rules":{
       "no-secrets/no-secrets":["error",{"additionalDelimiters":[".","(?=[A-Z][a-z])"]}]
   }
}

4. Options

OptionDescriptionDefaultType
toleranceMaximum "randomness"/entropy allowed4number
additionalRegexesObject of additional patterns to check. Key is check name and value is corresponding pattern{}{[regexCheckName:string]:string | RegExp}
ignoreContentWill ignore the entire string if matched. Expects either a pattern or an array of patterns. This option takes precedent over additionalRegexes and the default regular expressions[]string | RegExp | (string|RegExp)[]
ignoreModulesIgnores strings that are an argument in import() and require() or is the path in an import statement.trueboolean
ignoreIdentifiersIgnores the values of properties and variables that match a pattern or an array of patterns.[]string | RegExp | (string|RegExp)[]
ignoreCaseIgnores character case when calculating entropy. This could lead to some false negativesfalseboolean
additionalDelimitersIn addition to splitting the string by whitespace, tokens will be further split by these delimiters[](string|RegExp)[]

5. Acknowledgements

Huge thanks to truffleHog for the inspiration, the regexes, and the measure of entropy.

Keywords

FAQs

Package last updated on 20 Feb 2021

Did you know?

Socket

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Install

Related posts

SocketSocket SOC 2 Logo

Product

  • Package Alerts
  • Integrations
  • Docs
  • Pricing
  • FAQ
  • Roadmap
  • Changelog

Packages

npm

Stay in touch

Get open source security insights delivered straight into your inbox.


  • Terms
  • Privacy
  • Security

Made with ⚡️ by Socket Inc