Skip to content

Add rule for microsoft teams webhooks#918

Closed
maltemorgenstern wants to merge 19 commits intogitleaks:masterfrom
maltemorgenstern:add-microsoft-teams-webhook-rule
Closed

Add rule for microsoft teams webhooks#918
maltemorgenstern wants to merge 19 commits intogitleaks:masterfrom
maltemorgenstern:add-microsoft-teams-webhook-rule

Conversation

@maltemorgenstern
Copy link
Contributor

@maltemorgenstern maltemorgenstern commented Jul 16, 2022 •
edited
Loading

Description:

This MR adds a new rule for Microsoft Teams Webhooks.

The regex is based on the one suggested in #626. The only other information about the URL format I was able to find is from this stackoverflow article.

I confirmed the format locally in our Teams instance and tested the new rule:
$ gitleaks detect --config gitleaks.toml --no-git

Log 
{
        "Description": "Microsoft Teams Webhook",
        "StartLine": 2,
        "EndLine": 2,
        "StartColumn": 12,
        "EndColumn": 223,
        "Match": "https://[redacted].webhook.office.com/webhookb2/50koqw9j-e63t-pbul-7rtz-r7hd8jwzhc2l@yj49lqsq-ydkp-xwwv-v0et-6jmvc301riid/IncomingWebhook/aruuzufctr6c5m27tg5ramvhw8jkisdn/v9azwg44-z1m5-9zfl-00rf-1h260d1wnre2",
        "Secret": "https://[redacted].webhook.office.com/webhookb2/50koqw9j-e63t-pbul-7rtz-r7hd8jwzhc2l@yj49lqsq-ydkp-xwwv-v0et-6jmvc301riid/IncomingWebhook/aruuzufctr6c5m27tg5ramvhw8jkisdn/v9azwg44-z1m5-9zfl-00rf-1h260d1wnre2",
        "File": "README.txt",
        "Commit": "",
        "Entropy": 4.68221,
        "Author": "",
        "Email": "",
        "Date": "",
        "Message": "",
        "Tags": [],
        "RuleID": "microsoft-teams-webhook"
}
scan completed in 11.5429ms
leaks found: 1

This closes #626

Checklist:

  • Does your PR pass tests?
  • Have you written new tests for your changes?
  • Have you lint your code locally prior to submission?

@jit-ci
Copy link

jit-ci bot commented Jul 16, 2022

Hi, I’m Jit, a friendly security platform designed to help developers build secure applications from day zero with an MVS (Minimal viable security) mindset.

All security workflows are defined in a centralized repository named .jit.
In case there are security findings, they will be communicated to you as a comment inside the PR.

Hope you’ll enjoy using Jit.

Questions? Comments? Want to learn more? Get in touch with us.

@maltemorgenstern
Copy link
Contributor Author

maltemorgenstern commented Jul 16, 2022

I don't know why the Jit Security checks failed - can you retry them?

@electriquo electriquo mentioned this pull request Jul 25, 2022
Closed
@maltemorgenstern
Copy link
Contributor Author

maltemorgenstern commented Jul 29, 2022

Hey @zricethezav, could you give this PR a review?
Same issue here - the gitleaks (pull_request) job fails. If I should add a gitleaks:allow for this line please let me know 😃

weineran and others added 17 commits August 3, 2022 07:31
@weineran
Feature/add sidekiq rules (gitleaks#933)
cd52267 
* Add sidekiq rules

* Added two new rules for sidekiq
* Other: Add keywords to square rules per Zach's instructions

* Validate now works, but test suite is failing

* Tests are now passing

* Add Sidekiq Rules: Ran go fmt

* * After resolving conflicts, had to rerun the rule generator to add back the semicolon char
* After running tests, had to fix one line in testdata/expected/report/sarif_simple.sarif

* * Added keywords to simple.toml for sidekiq-sensitive-url so that the rule matches what is in gitleaks.toml

Co-authored-by: Andrew Weiner <aweiner@frontrush.com>
@maltemorgenstern
Add new rules for vault tokens (gitleaks#919)
b1853bd 
* add new rules for vault tokens

* Configure max length for vault rules
@zricethezav
gitleaks allow docs (gitleaks#941)
31a8e9d 
* gitleaks allow docs

* reorder
@zricethezav
bump golang test version (gitleaks#942)
49b0b09
@zricethezav
add jwt rule (gitleaks#943)
e890a8e 
* add jwt support

* ignore sample secrets
@zricethezav
Feat/ignore finding (gitleaks#938)
3bace4c
@zricethezav
add two test findings to gitleaksignore
c5fc080
@zricethezav
Explicit fingerprint (gitleaks#944)
b8f236c
@zricethezav
Update README.md
6f6e057
@zricethezav
safe file checking (gitleaks#946)
6748a89
@zricethezav
Feat/add fingerprint no git (gitleaks#952)
1b3f10c 
* no-git support fingerprint support

* updating gitleaksignore w/ no-git false positives

* fix test
@zricethezav
draft: bump gitdiff, add git.Err state, better log messages (gitleaks…
b6b7cfb 
…#954)

* bump gitdiff, add git.Err state, better log messages

* remove cmd.Start

* forgot to start...
@zricethezav
add prefect and readme rules (gitleaks#961)
e35cb67
@jmatosgrafana
Add grafana tokens rules (gitleaks#959)
adf512e 
* Add grafana tokens rules

* Adding upper bound limits to Grafana tokens
@zricethezav
ignore empty files (gitleaks#965)
e47867d
@maltemorgenstern
add rule for microsoft teams webhooks
c974394
@maltemorgenstern
Merge branch 'add-microsoft-teams-webhook-rule' of https://github.com…
a112def 
…/maltemorgenstern/gitleaks into add-microsoft-teams-webhook-rule
jit-ci[bot]
jit-ci bot reviewed Aug 29, 2022
View reviewed changes
Copy link

@jit-ci jit-ci bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

❌ Jit has detected 1 important finding in this PR that you should review.
The finding is detailed below as a comment.
It’s highly recommended that you fix this security issue before merge.

cmd/generate/config/rules/rule.go
secretPrefixUnique = `\b(`
secretPrefix = `(?:'|\"|\s|=|\x60){0,5}(`
secretSuffix = `)(?:['|\"|\n|\r|\s|\x60]|$)`
secretSuffix = `)(?:['|\"|\n|\r|\s|\x60|;]|$)`
Copy link

@jit-ci jit-ci bot Aug 29, 2022

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Security control: Static Code Analysis Go

Type: Potential Hardcoded Credentials

Description: Potential hardcoded credentials

Severity: HIGH

Learn more about this issue

Jit Bot commands and options (e.g., ignore issue)

You can trigger Jit actions by commenting on this PR review:

  • #jit_ignore_finding Ignore this specific single instance of finding
  • #jit_undo_ignore Undo ignore command

@maltemorgenstern maltemorgenstern mentioned this pull request Aug 29, 2022
Merged
3 tasks
@maltemorgenstern
Copy link
Contributor Author

maltemorgenstern commented Aug 29, 2022

Closing this in favour of #970 - the pipeline in this PR does not pass.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

1 more reviewer

@jit-ci jit-ci[bot] jit-ci[bot] left review comments

Reviewers whose approvals may not affect merge requirements

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

Support for Microsoft Webhooks

4 participants

@maltemorgenstern @weineran @zricethezav @jmatosgrafana