Kubernetes secrets not found if `kind: Secret` comes after multiple base64 encoded secret data
- Dominant language
- Go
- Stars
- 29.3k
- Forks
- 2.2k
- PR merge metrics
- No merged PRs in 30d
Description
**Describe the bug**
Kubernetes secrets are not found if `kind: Secret` comes after the base64 secret data when there are more than a couple secrets.
**To Reproduce**
Steps to reproduce the behavior:
Where leaks are not found as expected when `kind: Secret` comes after the data:
```bash
/t/test $ cat k8s-secret-after.yaml
apiVersion: v1
data:
ca.pem: LS0tLS1CRUdJTiBQUklWQVRFIEtFWS0tLS0tXG5BMTBCMjBzdXBlcnNlY3JldHBlbWRhdGFcbi0tLS0tRU5EIFBSSVZBVEUgS0VZLS0tLS1cbg==
cert.pem: LS0tLS1CRUdJTiBQUklWQVRFIEtFWS0tLS0tXG5DMzBENDBzdXBlcnNlY3JldHBlbWRhdGFcbi0tLS0tRU5EIFBSSVZBVEUgS0VZLS0tLS1cbg==
key.pem: LS0tLS1CRUdJTiBQUklWQVRFIEtFWS0tLS0tXG5FNTBGNjBzdXBlcnNlY3JldHBlbWRhdGFcbi0tLS0tRU5EIFBSSVZBVEUgS0VZLS0tLS0=
kind: Secret
metadata:
name: client-certs
/t/test $ gitleaks dir --no-banner --verbose ./k8s-secret-after.yaml
5:30PM INF scanned ~433 bytes (433 bytes) in 2.46ms
5:30PM INF no leaks found
```
- After removing one or two of the 3 secrets above, gitleaks does detect as expected when the `kind` comes after the data.
Where leaks are found as expected when `kind: Secret` comes before the data:
```bash
/t/test $ cat k8s-secret-before.yaml
apiVersion: v1
kind: Secret
data:
ca.pem: LS0tLS1CRUdJTiBQUklWQVRFIEtFWS0tLS0tXG5BMTBCMjBzdXBlcnNlY3JldHBlbWRhdGFcbi0tLS0tRU5EIFBSSVZBVEUgS0VZLS0tLS1cbg==
cert.pem: LS0tLS1CRUdJTiBQUklWQVRFIEtFWS0tLS0tXG5DMzBENDBzdXBlcnNlY3JldHBlbWRhdGFcbi0tLS0tRU5EIFBSSVZBVEUgS0VZLS0tLS1cbg==
key.pem: LS0tLS1CRUdJTiBQUklWQVRFIEtFWS0tLS0tXG5FNTBGNjBzdXBlcnNlY3JldHBlbWRhdGFcbi0tLS0tRU5EIFBSSVZBVEUgS0VZLS0tLS0=
metadata:
name: client-certs
/t/test $ gitleaks dir --no-banner --verbose ./k8s-secret-before.yaml
Finding: kind: Secret
data:
ca.pem: LS0tLS1CRUdJTiBQUklWQVRFIEtFWS0tLS0tXG5BMTBCMjBzdXBlcnNlY3JldHBlbWRhdGFcbi0tLS0tRU5EIFBSSVZB...
Secret: ca.pem: LS0tLS1CRUdJTiBQUklWQVRFIEtFWS0tLS0tXG5BMTBCMjBzdXBlcnNlY3JldHBlbWRhdGFcbi0tLS0tRU5EIFBSSVZB...
RuleID: kubernetes-secret-yaml
Entropy: 5.124338
File: ./k8s-secret-before.yaml
Line: 2
Fingerprint: ./k8s-secret-before.yaml:kubernetes-secret-yaml:2
5:28PM INF scanned ~433 bytes (433 bytes) in 2.53ms
5:28PM WRN leaks found: 1
```
**Expected behavior**
The secrets should be found even if `kind: Secret` comes after the secret data even if there are more than two base64 encoded secrets.
**Basic Info (please complete the following information):**
- OS: Linux
- Gitleaks Version: 8.28.0
cc @zricethezav
Contributor guide
Assessment
This issue has not been assessed yet.