gitleaks / gitleaks/gitleaks

Kubernetes secrets not found if `kind: Secret` comes after multiple base64 encoded secret data

Open
#1,933 1 comment 0 reactions 0 assignees View on GitHub
bug
Dominant language
Go
Stars
29.3k
Forks
2.2k
PR merge metrics
No merged PRs in 30d

Description

**Describe the bug**
Kubernetes secrets are not found if `kind: Secret` comes after the base64 secret data when there are more than a couple secrets.

**To Reproduce**
Steps to reproduce the behavior:

Where leaks are not found as expected when `kind: Secret` comes after the data:
```bash
/t/test $ cat k8s-secret-after.yaml
apiVersion: v1
data:
ca.pem: LS0tLS1CRUdJTiBQUklWQVRFIEtFWS0tLS0tXG5BMTBCMjBzdXBlcnNlY3JldHBlbWRhdGFcbi0tLS0tRU5EIFBSSVZBVEUgS0VZLS0tLS1cbg==
cert.pem: LS0tLS1CRUdJTiBQUklWQVRFIEtFWS0tLS0tXG5DMzBENDBzdXBlcnNlY3JldHBlbWRhdGFcbi0tLS0tRU5EIFBSSVZBVEUgS0VZLS0tLS1cbg==
key.pem: LS0tLS1CRUdJTiBQUklWQVRFIEtFWS0tLS0tXG5FNTBGNjBzdXBlcnNlY3JldHBlbWRhdGFcbi0tLS0tRU5EIFBSSVZBVEUgS0VZLS0tLS0=
kind: Secret
metadata:
name: client-certs

/t/test $ gitleaks dir --no-banner --verbose ./k8s-secret-after.yaml
5:30PM INF scanned ~433 bytes (433 bytes) in 2.46ms
5:30PM INF no leaks found
```

- After removing one or two of the 3 secrets above, gitleaks does detect as expected when the `kind` comes after the data.

Where leaks are found as expected when `kind: Secret` comes before the data:
```bash
/t/test $ cat k8s-secret-before.yaml
apiVersion: v1
kind: Secret
data:
ca.pem: LS0tLS1CRUdJTiBQUklWQVRFIEtFWS0tLS0tXG5BMTBCMjBzdXBlcnNlY3JldHBlbWRhdGFcbi0tLS0tRU5EIFBSSVZBVEUgS0VZLS0tLS1cbg==
cert.pem: LS0tLS1CRUdJTiBQUklWQVRFIEtFWS0tLS0tXG5DMzBENDBzdXBlcnNlY3JldHBlbWRhdGFcbi0tLS0tRU5EIFBSSVZBVEUgS0VZLS0tLS1cbg==
key.pem: LS0tLS1CRUdJTiBQUklWQVRFIEtFWS0tLS0tXG5FNTBGNjBzdXBlcnNlY3JldHBlbWRhdGFcbi0tLS0tRU5EIFBSSVZBVEUgS0VZLS0tLS0=
metadata:
name: client-certs

/t/test $ gitleaks dir --no-banner --verbose ./k8s-secret-before.yaml
Finding: kind: Secret
data:
ca.pem: LS0tLS1CRUdJTiBQUklWQVRFIEtFWS0tLS0tXG5BMTBCMjBzdXBlcnNlY3JldHBlbWRhdGFcbi0tLS0tRU5EIFBSSVZB...
Secret: ca.pem: LS0tLS1CRUdJTiBQUklWQVRFIEtFWS0tLS0tXG5BMTBCMjBzdXBlcnNlY3JldHBlbWRhdGFcbi0tLS0tRU5EIFBSSVZB...
RuleID: kubernetes-secret-yaml
Entropy: 5.124338
File: ./k8s-secret-before.yaml
Line: 2
Fingerprint: ./k8s-secret-before.yaml:kubernetes-secret-yaml:2

5:28PM INF scanned ~433 bytes (433 bytes) in 2.53ms
5:28PM WRN leaks found: 1
```

**Expected behavior**
The secrets should be found even if `kind: Secret` comes after the secret data even if there are more than two base64 encoded secrets.

**Basic Info (please complete the following information):**
- OS: Linux
- Gitleaks Version: 8.28.0

cc @zricethezav

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.