Repository navigation
Expand file tree
/
Copy path.gitleaks.toml
More file actions
83 lines (69 loc) · 3.26 KB
/
Copy path.gitleaks.toml
File metadata and controls
83 lines (69 loc) · 3.26 KB
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
title = "Doris gitleaks config"
[extend]
useDefault = true
[[rules]]
id = "generic-api-key"
[[rules.allowlists]]
description = "Ignore generated random-string fixtures in selected regression outputs"
condition = "AND"
regexTarget = "match"
paths = [
'''^regression-test/data/datatype_p0/nested_types/query/test_nested_types_insert_into_with_s3\.out$''',
'''^regression-test/data/datatype_p0/nested_types/query/test_nestedtypes_csv_insert_into_with_s3\.out$''',
'''^regression-test/data/external_table_p0/tvf/test_http_tvf\.out$''',
'''^regression-test/data/external_table_p0/tvf/test_local_tvf_with_complex_type_element_at\.out$''',
]
regexes = ['''[A-Za-z0-9]{6}-[A-Za-z0-9]{7}-[A-Za-z0-9]{3}-[A-Za-z0-9]{4}''']
[[rules.allowlists]]
description = "Ignore prose 'version token: iceberg/paimon' in code comments/plan-doc — a cache version-token discussion, not a credential (generic-api-key false positive: 'iceberg/paimon' entropy 3.52 barely clears the 3.5 threshold)"
condition = "AND"
regexTarget = "match"
regexes = ['''token:\s*iceberg/paimon''']
[[rules.allowlists]]
description = "Ignore Doris internal hidden-column names; these deterministic identifiers are not credentials"
condition = "AND"
regexTarget = "match"
regexes = ['''__DORIS_[A-Z0-9_]+_COL__''']
[[rules.allowlists]]
description = "Ignore a deterministic UUID map fixture; this test value is not a credential"
condition = "AND"
regexTarget = "match"
paths = ['''^regression-test/data/datatype_p0/uuid/test_uuid_map_matrix\.out$''']
regexes = ['''key":"018f0f59-1010-7abc-9234-001122334455"''']
[[rules.allowlists]]
description = "Ignore the fake OIDC token fixture in AuthenticatorManagerTest"
condition = "AND"
regexTarget = "line"
paths = ['''^fe/fe-core/src/test/java/org/apache/doris/mysql/authenticate/AuthenticatorManagerTest\.java$''']
regexes = ['''OIDC_ID_TOKEN\s*=\s*"eyJhbGciOiJub25lIn0\.eyJzdWIiOiJhbGljZSJ9\.signature"''']
[[rules.allowlists]]
description = "Ignore fake ETag hash fixture in StageUtilTest"
condition = "AND"
regexTarget = "line"
paths = ['''^fe/fe-core/src/test/java/org/apache/doris/cloud/stage/StageUtilTest\.java$''']
regexes = ['''RemoteObject\(.*"[A-F0-9]{32}-\d+"''']
[[rules.allowlists]]
description = "Ignore fake test credentials in S3ObjStorageTest"
condition = "AND"
regexTarget = "line"
paths = ['''^fe/fe-filesystem/fe-filesystem-s3/src/test/java/org/apache/doris/filesystem/s3/S3ObjStorageTest\.java$''']
regexes = ['''(access_key|secret_key).*"(ak-|sk-|canonical|sess-tok)''']
[[rules.allowlists]]
description = "Ignore the GPG signing-key fingerprint in the release-tools config template (a public key id, not a secret)"
condition = "AND"
regexTarget = "line"
paths = ['''^tools/release-tools/release\.env$''']
regexes = ['''SIGNING_KEY="[A-F0-9]{40}"''']
[[rules]]
id = "jwt"
[[rules.allowlists]]
description = "Ignore the fake JWT fixture in DelegatedCredentialTest"
condition = "AND"
regexTarget = "line"
paths = ['''^fe/fe-core/src/test/java/org/apache/doris/datasource/DelegatedCredentialTest\.java$''']
regexes = ['''"eyJhbGciOiJub25lIn0\.eyJleHAiOjE3MDAwMDAwMDB9\."''']
[[rules]]
id = "private-key"
[[rules.allowlists]]
description = "Ignore test-only TLS private key used by MySQL docker-compose fixtures"
paths = ['''^docker/thirdparties/docker-compose/mysql/certs/server\.key$''']