API Key not detected - what am I doing wrong?

[TomHuesler]

Dear all

I'm just evaluating GitLeaks and testing with some API keys as they're used by Confluent Cloud.

I have a ".properties" file that contains an API Key & Secret as a config parameter but it's not detected (sanitized example):
sasl.jaas.config=org.apache.kafka.common.security.plain.PlainLoginModule required username="KL5HGO52LEPNUUQU" password="MIqPFf/LKig6qs1zL21N2RL9wTGv7NHKsKTmYBkUyweqtm3Gg9czF0qfdJxBqpnL";

I can't figure out if the file is not scanned or if the pattern is not recognized... Adding the log-level option seems to have no effect also:
docker run -v c:\javasource\my-project:/path zricethezav/gitleaks:latest detect --source="/path" --no-git -v --log-level debug

Any help would be greatly appreciated

Kind Regards,
tom

[SubOptimal]

The rule "Generic API Key" does not detect the password, as it contains a /.

Amending the regex, as shown below, for that rule would catch it

-regex = '''(?i)((key|api|token|secret|password)[a-z0-9_ .\-,]{0,25})(=|>|:=|\|\|:|<=|=>|:).{0,5}['\"]([0-9a-zA-Z\-_=]{8,64})['\"]'''
+regex = '''(?i)((key|api|token|secret|password)[a-z0-9_ .\-,]{0,25})(=|>|:=|\|\|:|<=|=>|:).{0,5}['\"]([0-9a-zA-Z\-_=/]{8,64})['\"]'''

[TomHuesler]

Hi there

Thanks a lot for your fast help... I'm unfortunately still stuck and hope you can help me again:

• I created a custom configuration with a new rule, with the regex presented by you. This configuration shall extend the default config
• I use the docker image
• I try to pass the configuration but fail with that....

I tried many versions to specify the config file but none seems to work:

PS C:\javasource\my-source\scripts>  docker run -v c:\javasource\my-source/:/path zricethezav/gitleaks:latest detect --source="/path" --no-git -v --config /path/gitleaks-config.toml

    ○
    │╲
    │ ○
    ○ ░
    ░    gitleaks

12:05PM FTL unable to load gitleaks config, err: open /path/gitleaks-config.toml: no such file or directory
PS C:\javasource\my-source\scripts>

My configuration file (gitleaks-config.toml) lies in the folder my-source and has the following contents:
`# we only extend the default rules
useDefault = true

Livit extensions

###################
[[rules]]
description = "Confluent API Key"
id = "confluent-api-key"
regex = '''(?i)((key|api|token|secret|password)[a-z0-9_ .-,]{0,25})(=|>|:=|||:|<=|=>|:).{0,5}'"['"]'''
keywords = [
"confluent-api-key",
]`

I don't see any way to specify the config-file path. Whatever I try, it tells me it can't find it... What do I miss?

Regards,
tom

[weineran]

@TomHuesler Are you able to specify the --config option when running gitleaks locally without docker?

[w0rmr1d3r]

The rule "Generic API Key" does not detect the password, as it contains a /.

Amending the regex, as shown below, for that rule would catch it

-regex = '''(?i)((key|api|token|secret|password)[a-z0-9_ .\-,]{0,25})(=|>|:=|\|\|:|<=|=>|:).{0,5}['\"]([0-9a-zA-Z\-_=]{8,64})['\"]'''
+regex = '''(?i)((key|api|token|secret|password)[a-z0-9_ .\-,]{0,25})(=|>|:=|\|\|:|<=|=>|:).{0,5}['\"]([0-9a-zA-Z\-_=/]{8,64})['\"]'''

Thanks @SubOptimal ! This actually really help to fix some issues I was having in a project of mine doing some tests.
@zricethezav , do you know if there's any plan to update such rule, or does it need to be configured manually?

Thank you both!

[SubOptimal]

@TomHuesler Maybe it's because your Windows path has a typo in it. Remove the trailing slash.

instead

-v c:\javasource\my-source/:/path

try

-v c:\javasource\my-source:/path