Potential typo in Signable key regex

[rgmz]

Community Note

• Please vote on this issue by adding a 👍 reaction to the original issue to help the community and maintainers prioritize this request
• Please do not leave "+1" or other comments that do not add relevant new information or questions, they generate extra noise for issue followers and do not help prioritize the request
• If you are interested in working on this issue or have submitted a pull request, please leave a comment

TruffleHog Version

3.43.0

Trace Output

N/A

Expected Behavior

Based on my testing, the Signable API key format is 32 alphanumeric characters. I generated dozens of keys and none contained -.

Therefore, assuming my observations are correct, the correct regex should actually be the following.

-	keyPat = regexp.MustCompile(detectors.PrefixRegex([]string{"signable"}) + `\b([a-zA-Z-0-9]{32})\b`)
+	keyPat = regexp.MustCompile(detectors.PrefixRegex([]string{"signable"}) + `\b([a-zA-Z0-9]{32})\b`)

trufflehog/pkg/detectors/signable/signable.go

Line 25 in a99d89d

keyPat = regexp.MustCompile(detectors.PrefixRegex([]string{"signable"}) + `\b([a-zA-Z-0-9]{32})\b`)

Actual Behavior

TruffleHog detects things like -explode-assignable-expression-7 as a Signable API token, which ostensibly can never be a valid API key and creates needless requests to Signable's API.

Steps to Reproduce

Scan a repository with a package-lock.json that contains @babel/helper-explode-assignable-expression. This seems to be a common dependency for JavaScript projects and thus creates a lot of false-positives.

    "node_modules/@babel/helper-explode-assignable-expression": {
      "version": "7.14.5",
      "resolved": "https://registry.example.com/repository/npm/@babel/helper-explode-assignable-expression/-/helper-explode-assignable-expression-7.14.5.tgz",
      "integrity": "sha512-Htb24gnGJdIGT4vnRKMdoXiOIlqOLmdiUYpAQ0mYfgVT/GDm8GOYhgi4GL+hMKrkiPRohO4ts34ELFsGAPQLDQ==",
      "devOptional": true,
      "license": "MIT",
      "dependencies": {
        "@babel/types": "^7.14.5"
      },
      "engines": {
        "node": ">=6.9.0"
      }
    },

Environment

• OS: [e.g. iOS]
• Version [e.g. 22]

Additional Context

The number of false positives and unnecessary calls to Signable's API could also be reduced by checking Entropy. The Shannon Entropy of their API keys appears to be >4.

I'd also add that "assignable" should be a stop word, to borrow concepts from Gitleaks.

References

N / A