Skip to content

Potential performance issues with regex for rule kubernetes-secret-yaml #1843

@raphaelzoellner

Description

@raphaelzoellner

Describe the bug

The regex https://github.com/gitleaks/gitleaks/blob/v8.25.0/config/gitleaks.toml#L2380 imposes high performance issues when used in MegaLinter's log sanitization.

I've not reproduced the issue with Gitleaks yet, but following the steps from
oxsecurity/megalinter#5283 (comment)
this might also impose performance issues when used in GitLeaks.

To Reproduce
Steps to reproduce the behavior: ref

Expected behavior
No performance issues when executing the regex against actual data. I'm unsure how a general threshold of execution time against test data could be defined for that, but >1 minute for a 4KB JSON file seems to be unintended.

Basic Info (please complete the following information):

  • OS:
  • Gitleaks Version: 8.25.0

Additional context

I think potential catastrophic backtracking might occur when executing the regex.
Updating the non-capturing groups (?:.|\s) to (?:[^\s]|\s) seems to resolve this for the given data.

'''(?i)(?:\bkind:[ \t]*["']?\bsecret\b["']?(?:[^\s]|\s){0,200}?\bdata:(?:[^\s]|\s){0,100}?\s+([\w.-]+:(?:[ \t]*(?:\||>[-+]?)\s+)?[ \t]*(?:["']?[a-z0-9+/]{10,}={0,3}["']?|\{\{[ \t\w"|$:=,.-]+}}|""|''))|\bdata:(?:[^\s]|\s){0,100}?\s+([\w.-]+:(?:[ \t]*(?:\||>[-+]?)\s+)?[ \t]*(?:["']?[a-z0-9+/]{10,}={0,3}["']?|\{\{[ \t\w"|$:=,.-]+}}|""|''))(?:[^\s]|\s){0,200}?\bkind:[ \t]*["']?\bsecret\b["']?)'''

cc @zricethezav

Metadata

Metadata

Assignees

No one assigned

    Labels

    bugSomething isn't working

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions