gitleaks / gitleaks/gitleaks

Change AWS regex to match only allowed characters

Open
#1,324 0 comments 0 reactions 0 assignees View on GitHub
enhancement
Dominant language
Go
Stars
29.3k
Forks
2.2k
PR merge metrics
No merged PRs in 30d

Description

**Is your feature request related to a problem? Please describe.**
The AWS access token rule matches some strings that cannot be a valid AWS token and should be modified.

**Describe the solution you'd like**
It was recently discovered that the 16 characters of the token after the 4 character prefix are base32 encoded and include among other things the AWS account number.

https://trufflesecurity.com/blog/research-uncovers-aws-account-numbers-hidden-in-access-keys/

The characters used in base32 encoding are letters A-Z and digits 2-7. The regular expression should be modified to only match on these characters, since any that contain 0, 8, or 9 are not valid.

**Describe alternatives you've considered**
Not applicable, I think.

**Additional context**
None.

cc @zricethezav

Contributor guide

Open the contributing guide

Research direction

Search for the AWS access-token rule and its existing tests; verify the current regex and related fixtures before changing anything. Done means the rule rejects tokens containing 0, 8, or 9 in the 16-character suffix while continuing to match valid base32 characters, with regression coverage if the repository provides it.

Written by the indexing model from the issue text.

Assessment

Tech stack
go
Domain
security
Issue type
Bug
Difficulty
2/5
Estimated time
1-3 hours
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
48/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.