-
-
Notifications
You must be signed in to change notification settings - Fork 1.8k
Description
Describe the bug
The regex https://github.com/gitleaks/gitleaks/blob/v8.25.0/config/gitleaks.toml#L2380 imposes high performance issues when used in MegaLinter's log sanitization.
I've not reproduced the issue with Gitleaks yet, but following the steps from
oxsecurity/megalinter#5283 (comment)
this might also impose performance issues when used in GitLeaks.
To Reproduce
Steps to reproduce the behavior: ref
Expected behavior
No performance issues when executing the regex against actual data. I'm unsure how a general threshold of execution time against test data could be defined for that, but >1 minute for a 4KB JSON file seems to be unintended.
Basic Info (please complete the following information):
- OS:
- Gitleaks Version: 8.25.0
Additional context
I think potential catastrophic backtracking might occur when executing the regex.
Updating the non-capturing groups (?:.|\s)
to (?:[^\s]|\s)
seems to resolve this for the given data.
'''(?i)(?:\bkind:[ \t]*["']?\bsecret\b["']?(?:[^\s]|\s){0,200}?\bdata:(?:[^\s]|\s){0,100}?\s+([\w.-]+:(?:[ \t]*(?:\||>[-+]?)\s+)?[ \t]*(?:["']?[a-z0-9+/]{10,}={0,3}["']?|\{\{[ \t\w"|$:=,.-]+}}|""|''))|\bdata:(?:[^\s]|\s){0,100}?\s+([\w.-]+:(?:[ \t]*(?:\||>[-+]?)\s+)?[ \t]*(?:["']?[a-z0-9+/]{10,}={0,3}["']?|\{\{[ \t\w"|$:=,.-]+}}|""|''))(?:[^\s]|\s){0,200}?\bkind:[ \t]*["']?\bsecret\b["']?)'''
cc @zricethezav