eslint-plugin-no-secrets

An eslint rule that searches for potential secrets/keys in code and JSON files.

1. Usage
- 1.1. Flat config
- 1.2. eslintrc
- 1.3. Include JSON files
  - 1.3.1. Include JSON files with in "flat configs"
1. Config
1. When it's really not a secret
1. Options
1. Acknowledgements

1. Usage

npm i -D eslint-plugin-no-secrets

1.1. Flat config

eslint.config.js

import noSecrets from "eslint-plugin-no-secrets";

export default [
  {
    files: ["**/*.js"],
    plugins: {
      "no-secrets": noSecrets,
    },
    rules: {
      "no-secrets/no-secrets": "error",
    },
  },
];

1.2. eslintrc

.eslintrc

{
  "plugins": ["no-secrets"],
  "rules": {
    "no-secrets/no-secrets": "error"
  }
}

//Found a string with entropy 4.3 : "ZWVTjPQSdhwRgl204Hc51YCsritMIzn8B=/p9UyeX7xu6KkAGqfm3FJ+oObLDNEva"
const A_SECRET =
  "ZWVTjPQSdhwRgl204Hc51YCsritMIzn8B=/p9UyeX7xu6KkAGqfm3FJ+oObLDNEva";
//Found a string that matches "AWS API Key" : "AKIAIUWUUQQN3GNUA88V"
const AWS_TOKEN = "AKIAIUWUUQQN3GNUA88V";

1.3. Include JSON files

To include JSON files, install eslint-plugin-jsonc

npm install --save-dev eslint-plugin-jsonc

Then in your .eslint configuration file, extend the jsonc base config

{
  "extends": ["plugin:jsonc/base"]
}

1.3.1. Include JSON files with in "flat configs"

eslint.config.js

import noSecrets from "eslint-plugin-no-secrets";
import jsoncExtend from "eslint-plugin-jsonc";

export default [
  ...jsoncExtend.configs["flat/recommended-with-jsonc"],
  {
    languageOptions: { ecmaVersion: 6 },
    plugins: {
      "no-secrets": noSecret,
    },
    rules: {
      "no-secrets/no-secrets": "error",
    },
  },
];

2. Config

Decrease the tolerance for entropy

{
  "plugins": ["no-secrets"],
  "rules": {
    "no-secrets/no-secrets": ["error", { "tolerance": 3.2 }]
  }
}

Add additional patterns to check for certain token formats.
Standard patterns can be found here

{
  "plugins": ["no-secrets"],
  "rules": {
    "no-secrets/no-secrets": [
      "error",
      {
        "additionalRegexes": {
          "Basic Auth": "Authorization: Basic [A-Za-z0-9+/=]*"
        }
      }
    ]
  }
}

3. When it's really not a secret

3.1. Either disable it with a comment

// Set of potential base64 characters
// eslint-disable-next-line no-secrets/no-secrets
const BASE64_CHARS =
  "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/=";

This will tell future maintainers of the codebase that this suspicious string isn't an oversight

3.2. use the `ignoreContent` to ignore certain content

{
  "plugins": ["no-secrets"],
  "rules": {
    "no-secrets/no-secrets": ["error", { "ignoreContent": "^ABCD" }]
  }
}

3.3. Use `ignoreIdentifiers` to ignore certain variable/property names

{
  "plugins": ["no-secrets"],
  "rules": {
    "no-secrets/no-secrets": [
      "error",
      { "ignoreIdentifiers": ["BASE64_CHARS"] }
    ]
  }
}

3.4. Use `additionalDelimiters` to further split up tokens

Tokens will always be split up by whitespace within a string. However, sometimes words that are delimited by something else (e.g. dashes, periods, camelcase words). You can use additionalDelimiters to handle these cases.

For example, if you want to split words up by the character . and by camelcase, you could use this configuration:

{
  "plugins": ["no-secrets"],
  "rules": {
    "no-secrets/no-secrets": [
      "error",
      { "additionalDelimiters": [".", "(?=[A-Z][a-z])"] }
    ]
  }
}

4. Options

Option	Description	Default	Type
tolerance	Minimum "randomness"/entropy allowed. Only strings above this threshold will be shown.	`4`	`number`
additionalRegexes	Object of additional patterns to check. Key is check name and value is corresponding pattern	`{}`	{[regexCheckName:string]:string \| RegExp}
ignoreContent	Will ignore the entire string if matched. Expects either a pattern or an array of patterns. This option takes precedent over `additionalRegexes` and the default regular expressions	`[]`	string \| RegExp \| (string\|RegExp)[]
ignoreModules	Ignores strings that are an argument in `import()` and `require()` or is the path in an `import` statement.	`true`	`boolean`
ignoreIdentifiers	Ignores the values of properties and variables that match a pattern or an array of patterns.	`[]`	string \| RegExp \| (string\|RegExp)[]
ignoreCase	Ignores character case when calculating entropy. This could lead to some false negatives	`false`	`boolean`
additionalDelimiters	In addition to splitting the string by whitespace, tokens will be further split by these delimiters	`[]`	(string\|RegExp)[]

5. Acknowledgements

Huge thanks to truffleHog for the inspiration, the regexes, and the measure of entropy.

nickdeis / eslint-plugin-no-secrets Goto Github PK