Change AWS regex to match only allowed characters
- Dominant language
- Go
- Stars
- 29.3k
- Forks
- 2.2k
- PR merge metrics
- No merged PRs in 30d
Description
**Is your feature request related to a problem? Please describe.**
The AWS access token rule matches some strings that cannot be a valid AWS token and should be modified.
**Describe the solution you'd like**
It was recently discovered that the 16 characters of the token after the 4 character prefix are base32 encoded and include among other things the AWS account number.
https://trufflesecurity.com/blog/research-uncovers-aws-account-numbers-hidden-in-access-keys/
The characters used in base32 encoding are letters A-Z and digits 2-7. The regular expression should be modified to only match on these characters, since any that contain 0, 8, or 9 are not valid.
**Describe alternatives you've considered**
Not applicable, I think.
**Additional context**
None.
cc @zricethezav
Contributor guide
Research direction
Search for the AWS access-token rule and its existing tests; verify the current regex and related fixtures before changing anything. Done means the rule rejects tokens containing 0, 8, or 9 in the 16-character suffix while continuing to match valid base32 characters, with regression coverage if the repository provides it.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- go
- Domain
- security
- Issue type
- Bug
- Difficulty
- 2/5
- Estimated time
- 1-3 hours
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 48/100