Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

proposal: SqlServer connection string detector #867

Merged
merged 5 commits into from Oct 26, 2022

Conversation

mac2000
Copy link
Contributor

@mac2000 mac2000 commented Oct 26, 2022

Closes #866

The problem: at moment trufflehog does not see SQL Server connection strings at all 🤷‍♂️

e.g. here is part of Program.cs:

var builder = WebApplication.CreateBuilder(args);

builder.Services
  .AddDbContext<Database>(optionsBuilder => optionsBuilder
    .UseSqlServer("Server=some.domain.com;Initial Catalog=Demo;User ID=sa;Password=PASSWORD_HERE"));

var app = builder.Build();

Proposal: this pull request adds dedicated SQLServer connection string detector to prevent such leaks

How it works

Because connection string itself is a set of case-insensitive key-value pairs delimited by a semicolon with regexp we are looking for something that may be a connection string

To prevent false positives we then try to parse it with msdn.Parse

And if everything fine as a last step we are trying to connect to server with connection string we have found

Also there is an TestSQLServer_pattern with few pattern dedicated tests to see if regexp will match desired strings

@mac2000 mac2000 requested a review from a team as a code owner October 26, 2022 08:06
Copy link
Contributor

@dustin-decker dustin-decker left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thank you for the contribution!

@dustin-decker dustin-decker merged commit 60464da into trufflesecurity:main Oct 26, 2022
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Development

Successfully merging this pull request may close these issues.

SQLServer connection string detector
2 participants