detecting email addresses?

[ethoms-usgs]

I would like to find email addresses with a custom rule I have added to .gitleaks.toml. I have a regex that works at Regex101, but I get no reports when running gitleaks.

My rule

[[rules]]
id = "emailwarning"
description = "find email addresses"
regex = '''[a-z0-9._%+\-]+@[a-z0-9.\-]+\.[a-z]{2,4}$'''
max_severity = "low"

which detects a couple fake addresses at Regex101

user@company.com
user@agency.gov

I have other custom rules in .gitleaks.toml which DO trigger warnings, so it's clear that the file is getting evaluated.

[rgmz]

The $ character means "end of line", so your pattern won't work if there is anything after it. It also won't detect emails that contain upper-case characters (the fix is https://stackoverflow.com/a/34219588).

email = "User@agency.gov";

As an aside, I would recommend adding keywords to make your rule more efficient.

keywords = ["@"]

[ethoms-usgs]

Geez, rookie mistake right there. I pasted, saw it worked at Regex101, but didn't read the explanation. I guess it works there because of a difference in new line characters?
Anyway, thanks again.

[rgmz]

It happens to the best of us. :)

Regex101 also uses the flag m by default, which is the opposite of Go's regexp package, meaning that patterns that work on Regex101 by default may not necessarily work with GitLeaks by default.

m multi-line mode: ^ and $ match begin/end line in addition to begin/end text (default false)