mirror of
https://github.com/apache/doris.git
synced 2026-11-04 07:31:17 +00:00
Dongyang Li
b944e5203c
Related PR: #67627 Problem Summary: Gitleaks 8.30.0 reports the deterministic UUID map golden output as 33 generic API keys. This change adds a rule-scoped allowlist that requires both the exact regression output path and the exact UUID match, preserving detection for every other file and value.
84 lines
3.3 KiB
TOML
84 lines
3.3 KiB
TOML
title = "Doris gitleaks config"
|
|
|
|
[extend]
|
|
useDefault = true
|
|
|
|
[[rules]]
|
|
id = "generic-api-key"
|
|
|
|
[[rules.allowlists]]
|
|
description = "Ignore generated random-string fixtures in selected regression outputs"
|
|
condition = "AND"
|
|
regexTarget = "match"
|
|
paths = [
|
|
'''^regression-test/data/datatype_p0/nested_types/query/test_nested_types_insert_into_with_s3\.out$''',
|
|
'''^regression-test/data/datatype_p0/nested_types/query/test_nestedtypes_csv_insert_into_with_s3\.out$''',
|
|
'''^regression-test/data/external_table_p0/tvf/test_http_tvf\.out$''',
|
|
'''^regression-test/data/external_table_p0/tvf/test_local_tvf_with_complex_type_element_at\.out$''',
|
|
]
|
|
regexes = ['''[A-Za-z0-9]{6}-[A-Za-z0-9]{7}-[A-Za-z0-9]{3}-[A-Za-z0-9]{4}''']
|
|
|
|
[[rules.allowlists]]
|
|
description = "Ignore prose 'version token: iceberg/paimon' in code comments/plan-doc — a cache version-token discussion, not a credential (generic-api-key false positive: 'iceberg/paimon' entropy 3.52 barely clears the 3.5 threshold)"
|
|
condition = "AND"
|
|
regexTarget = "match"
|
|
regexes = ['''token:\s*iceberg/paimon''']
|
|
|
|
[[rules.allowlists]]
|
|
description = "Ignore Doris internal hidden-column names; these deterministic identifiers are not credentials"
|
|
condition = "AND"
|
|
regexTarget = "match"
|
|
regexes = ['''__DORIS_[A-Z0-9_]+_COL__''']
|
|
|
|
[[rules.allowlists]]
|
|
description = "Ignore a deterministic UUID map fixture; this test value is not a credential"
|
|
condition = "AND"
|
|
regexTarget = "match"
|
|
paths = ['''^regression-test/data/datatype_p0/uuid/test_uuid_map_matrix\.out$''']
|
|
regexes = ['''key":"018f0f59-1010-7abc-9234-001122334455"''']
|
|
|
|
[[rules.allowlists]]
|
|
description = "Ignore the fake OIDC token fixture in AuthenticatorManagerTest"
|
|
condition = "AND"
|
|
regexTarget = "line"
|
|
paths = ['''^fe/fe-core/src/test/java/org/apache/doris/mysql/authenticate/AuthenticatorManagerTest\.java$''']
|
|
regexes = ['''OIDC_ID_TOKEN\s*=\s*"eyJhbGciOiJub25lIn0\.eyJzdWIiOiJhbGljZSJ9\.signature"''']
|
|
|
|
[[rules.allowlists]]
|
|
description = "Ignore fake ETag hash fixture in StageUtilTest"
|
|
condition = "AND"
|
|
regexTarget = "line"
|
|
paths = ['''^fe/fe-core/src/test/java/org/apache/doris/cloud/stage/StageUtilTest\.java$''']
|
|
regexes = ['''RemoteObject\(.*"[A-F0-9]{32}-\d+"''']
|
|
|
|
[[rules.allowlists]]
|
|
description = "Ignore fake test credentials in S3ObjStorageTest"
|
|
condition = "AND"
|
|
regexTarget = "line"
|
|
paths = ['''^fe/fe-filesystem/fe-filesystem-s3/src/test/java/org/apache/doris/filesystem/s3/S3ObjStorageTest\.java$''']
|
|
regexes = ['''(access_key|secret_key).*"(ak-|sk-|canonical|sess-tok)''']
|
|
|
|
[[rules.allowlists]]
|
|
description = "Ignore the GPG signing-key fingerprint in the release-tools config template (a public key id, not a secret)"
|
|
condition = "AND"
|
|
regexTarget = "line"
|
|
paths = ['''^tools/release-tools/release\.env$''']
|
|
regexes = ['''SIGNING_KEY="[A-F0-9]{40}"''']
|
|
|
|
[[rules]]
|
|
id = "jwt"
|
|
|
|
[[rules.allowlists]]
|
|
description = "Ignore the fake JWT fixture in DelegatedCredentialTest"
|
|
condition = "AND"
|
|
regexTarget = "line"
|
|
paths = ['''^fe/fe-core/src/test/java/org/apache/doris/datasource/DelegatedCredentialTest\.java$''']
|
|
regexes = ['''"eyJhbGciOiJub25lIn0\.eyJleHAiOjE3MDAwMDAwMDB9\."''']
|
|
|
|
[[rules]]
|
|
id = "private-key"
|
|
|
|
[[rules.allowlists]]
|
|
description = "Ignore test-only TLS private key used by MySQL docker-compose fixtures"
|
|
paths = ['''^docker/thirdparties/docker-compose/mysql/certs/server\.key$''']
|