doris/.gitleaks.toml at master · apache/doris · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
title = "Doris gitleaks config"

[extend]
useDefault = true

[[rules]]
id = "generic-api-key"

[[rules.allowlists]]
description = "Ignore generated random-string fixtures in selected regression outputs"
condition = "AND"
regexTarget = "match"
paths = [
    '''^regression-test/data/datatype_p0/nested_types/query/test_nested_types_insert_into_with_s3\.out$''',
    '''^regression-test/data/datatype_p0/nested_types/query/test_nestedtypes_csv_insert_into_with_s3\.out$''',
    '''^regression-test/data/external_table_p0/tvf/test_http_tvf\.out$''',
    '''^regression-test/data/external_table_p0/tvf/test_local_tvf_with_complex_type_element_at\.out$''',
]
regexes = ['''[A-Za-z0-9]{6}-[A-Za-z0-9]{7}-[A-Za-z0-9]{3}-[A-Za-z0-9]{4}''']

[[rules.allowlists]]
description = "Ignore prose 'version token: iceberg/paimon' in code comments/plan-doc — a cache version-token discussion, not a credential (generic-api-key false positive: 'iceberg/paimon' entropy 3.52 barely clears the 3.5 threshold)"
condition = "AND"
regexTarget = "match"
regexes = ['''token:\s*iceberg/paimon''']

[[rules.allowlists]]
description = "Ignore the fake OIDC token fixture in AuthenticatorManagerTest"
condition = "AND"
regexTarget = "line"
paths = ['''^fe/fe-core/src/test/java/org/apache/doris/mysql/authenticate/AuthenticatorManagerTest\.java$''']
regexes = ['''OIDC_ID_TOKEN\s*=\s*"eyJhbGciOiJub25lIn0\.eyJzdWIiOiJhbGljZSJ9\.signature"''']

[[rules.allowlists]]
description = "Ignore fake ETag hash fixture in StageUtilTest"
condition = "AND"
regexTarget = "line"
paths = ['''^fe/fe-core/src/test/java/org/apache/doris/cloud/stage/StageUtilTest\.java$''']
regexes = ['''RemoteObject\(.*"[A-F0-9]{32}-\d+"''']

[[rules.allowlists]]
description = "Ignore fake test credentials in S3ObjStorageTest"
condition = "AND"
regexTarget = "line"
paths = ['''^fe/fe-filesystem/fe-filesystem-s3/src/test/java/org/apache/doris/filesystem/s3/S3ObjStorageTest\.java$''']
regexes = ['''(access_key|secret_key).*"(ak-|sk-|canonical|sess-tok)''']

[[rules.allowlists]]
description = "Ignore the GPG signing-key fingerprint in the release-tools config template (a public key id, not a secret)"
condition = "AND"
regexTarget = "line"
paths = ['''^tools/release-tools/release\.env$''']
regexes = ['''SIGNING_KEY="[A-F0-9]{40}"''']

[[rules]]
id = "jwt"

[[rules.allowlists]]
description = "Ignore the fake JWT fixture in DelegatedCredentialTest"
condition = "AND"
regexTarget = "line"
paths = ['''^fe/fe-core/src/test/java/org/apache/doris/datasource/DelegatedCredentialTest\.java$''']
regexes = ['''"eyJhbGciOiJub25lIn0\.eyJleHAiOjE3MDAwMDAwMDB9\."''']

[[rules]]
id = "private-key"

[[rules.allowlists]]
description = "Ignore test-only TLS private key used by MySQL docker-compose fixtures"
paths = ['''^docker/thirdparties/docker-compose/mysql/certs/server\.key$''']