mirror of
https://github.com/pre-commit/pre-commit-hooks.git
synced 2026-04-04 19:26:52 +00:00
7a894b3c98
Implements detect-azure-credentials hook based on Microsoft AzSK credential patterns. Features: - 33 credential detection patterns aligned with official AzSK specification - Covers Azure-specific credentials (Data Factory, Storage, DevOps, etc.) - Detects generic secrets (passwords, API keys, tokens, certificates) - Comprehensive test suite with 22 test cases - Pattern name identification in output for easier debugging Patterns include (CSCAN codes): - Azure Data Factory SHIR keys (0010) - Azure Storage credentials (0020, 0040) - App Service deployment secrets (0050) - Connection strings and passwords (0090, 0100, 0120) - Machine keys and network credentials (0130, 0150) - DevOps PAT tokens (0160) - PublishSettings passwords (0030) - PEM private keys (0060) - Git credentials (0210) - JWT and refresh tokens (0250) - Ansible Vault (0260) - Azure PowerShell token cache (0270) - Default/known passwords (0140) All tests passing (22 Azure + 36 AWS = 58 total)
94 lines
3.6 KiB
Text
94 lines
3.6 KiB
Text
# Azure Data Factory SHIR Key
|
|
shir_key = IR@40040abc-b2f2-8tyg-ab39-90a490zzzaae@adf-myapp-001@we@uUY/w9WdKTdAWWPDMrEEWdAEZIgeXlrO51GtVUR1/BE=
|
|
|
|
|
|
# App Service Deployment Secret (MII prefix with 200+ chars)
|
|
publishSettings = MIIKcQIBAzCCCi0GCSqGSIb3DQEHAaCCCh4EggoaMIIKFjCCBg8GCSqGSIb3DQEHAaCCBgAEggX8MIIF-DCCBfQGCyqGSIb3DQEMCgECoIIE_jCCBPowHAYKKoZIhvcNAQwBAzAOBAhxV7RdBQMKzQICB9AEggTYJNhZHR7GBQrpJFJGGn8gNKN4SB9hqXCwHchZf5LaAbCdEfGhIjKlMnOpQrStUvWxYzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789abcdefghijklmnopqrstuvwxyz
|
|
|
|
|
|
# Azure Storage Credentials - 86 char
|
|
DefaultEndpointsProtocol=https;AccountName=mystorageaccount;AccountKey=Eby8vdM02xNOcqFlqUwJPLlmEtlCDXJ1OUzFT50uSRZ6IFsuFq2UVErCz4I6tq/K1SZFPTOtr/KBHBeksoGMGw==
|
|
|
|
|
|
# Azure Storage Credentials - 43 char
|
|
StorageKey=YXphMTIzNDU2Nzg5MGFiY2RlZmdoaWprbG1ub3BxcnM=x
|
|
|
|
|
|
# Azure Blob SAS URL
|
|
blob_url = https://myaccount.blob.core.windows.net/mycontainer/myblob.txt?sv=2020-08-04&ss=bfqt&srt=sco&sp=rwdlacupitfx&se=2025-12-31T23:59:59Z&st=2025-01-01T00:00:00Z&spr=https&sig=AbCdEfGhIjKlMnOpQrStUvWxYz0123456789%2B%2F%3D
|
|
|
|
|
|
# Connection string with userid and password
|
|
userid=admin_user;password=MySecretP@ssw0rd123!;Server=tcp:myserver.database.windows.net;Database=mydb
|
|
|
|
|
|
# Machine Key Configuration
|
|
<machineKey decryptionKey='F0D1A2B3C4E5F6071829ABCDEF0123456789ABCD' validationKey='0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF' />
|
|
|
|
|
|
# Connection String with password
|
|
connectionstring='Server=myserver.database.windows.net;Database=mydb;User Id=admin;password=MyP@ssw0rd123;'
|
|
|
|
|
|
# NetworkCredential with domain
|
|
var cred = NetworkCredential(username, password, redmond);
|
|
|
|
|
|
# DevOps Personal Access Token
|
|
access_token='a1b2c3d4e5f6g7h8i9j0k1l2m3n4o5p6q7r8s9t0u1v2w3x4y5z6'
|
|
|
|
|
|
# Multiple credential types in production config example
|
|
# Data Factory SHIR
|
|
SHIR=IR@12345678-1234-5678-1234-567890abcdef@adf-prod-001@eastus@ABC123XYZ789+/aBcDeFgHiJkLmNoPqRsTuVwXyZ01=
|
|
|
|
# Storage Account Key
|
|
STORAGE_KEY=Eby8vdM02xNOcqFlqUwJPLlmEtlCDXJ1OUzFT50uSRZ6IFsuFq2UVErCz4I6tq/K1SZFPTOtr/KBHBeksoGMGw==
|
|
|
|
# Connection string with password
|
|
DB_CONN=userid=dbadmin;password=MySecretPassword123;Server=myserver.database.windows.net
|
|
|
|
# PublishSettings Password (CSCAN0030)
|
|
<publishData publishMethod="FTP" userPWD="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456" />
|
|
|
|
# PEM Private Key (CSCAN0060)
|
|
-----BEGIN RSA PRIVATE KEY-----
|
|
MIIEpAIBAAKCAQEA1234567890abcdefghijklmnopqrstuvwxyz
|
|
-----END RSA PRIVATE KEY-----
|
|
|
|
# Security Config Password (CSCAN0080)
|
|
<securityconfig>
|
|
<password>MySecretPassword123</password>
|
|
</securityconfig>
|
|
|
|
# Script Password (CSCAN0110)
|
|
# PowerShell example:
|
|
Connect-AzAccount -Password "MyP@ssw0rd123" -Credential $cred
|
|
|
|
# General Password Pattern (CSCAN0111)
|
|
client_secret = "myappsecret12345";
|
|
app_SECRET = "anothersecret67890";
|
|
|
|
# Git Credentials (CSCAN0210)
|
|
https://username:password123@github.com/repo/project.git
|
|
|
|
# Password Context (CSCAN0220)
|
|
$securePassword = ConvertTo-SecureString "MyP@ssw0rd!" -AsPlainText -Force
|
|
$cert = new X509Certificate2("cert.pfx", "CertP@ssw0rd")
|
|
|
|
# JWT Token (CSCAN0250)
|
|
token=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiaWF0IjoxNTE2MjM5MDIyfQ.SflKxwRJSMeKKF2QT4fwpMeJf36POk6yJV_adQssw5c
|
|
|
|
# Refresh Token (CSCAN0250)
|
|
refresh_token="1/abc-def-ghi-jkl-mno-pqr"
|
|
|
|
# Ansible Vault (CSCAN0260 - corrected)
|
|
$ANSIBLE_VAULT;1.1;AES256
|
|
12345678901234567890123456789012
|
|
|
|
# Azure PowerShell Token Cache (CSCAN0270)
|
|
{"TokenCache": {"CacheData": "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789ABCDEFGHIJKLMNOPQR=="}}
|
|
|
|
# Default Known Passwords (CSCAN0140)
|
|
password = "P@ssw0rd1"
|
|
admin_password = "admin123"
|