-
-
Notifications
You must be signed in to change notification settings - Fork 44
Closed
Labels
Status: PR WelcomeWelcome to Pull RequestWelcome to Pull RequestStatus: ProposalRequest for commentsRequest for comments
Description
Summary
How about to support Makfile variable patter $(VAR)
in database-connection-string rule?
This must improve compatibility with Make-based projects.
Basic example
My Makefile includes DB connection information like this:
DB_URL = postgres://$(PGUSER):$(PGPASSWORD)@$(PGHOST)/$(PGDATABASE)
This Makefile is warned by secretlint. It seems such variable string like $(PGPASSWORD)
is not included in isVariableLikeString function.
secretlint/packages/@secretlint/secretlint-rule-database-connection-string/src/index.ts
Lines 62 to 70 in ce6ac7d
function isVariableLikeString(str: string): boolean { | |
// Check for common variable patterns with length limits to prevent ReDoS | |
const variablePatterns = [ | |
/\$\{[^}]{1,50}\}/, // ${var} | |
/\{\{[^}]{1,50}\}\}/, // {{var}} | |
/\{[^}]{1,50}\}/, // {var} | |
/%[A-Z_]{1,30}%/, // %VAR% | |
/\$[A-Z_]{1,30}/, // $VAR | |
]; |
I'm glad if this is allowed as another variables pattern.
Here's example.
function isVariableLikeString(str: string): boolean {
const variablePatterns = [
/\$\{[^}]{1,50}\}/, // ${var}
/\{\{[^}]{1,50}\}\}/, // {{var}}
/\{[^}]{1,50}\}/, // {var}
/%[A-Z_]{1,30}%/, // %VAR%
/\$[A-Z_]{1,30}/, // $VAR
/\$\([^)]{1,50}\)/, // $(var) - *** Add line like this? ***
];
return variablePatterns.some((pattern) => pattern.test(str));
}
Motivation
- I think it is common to have database connection strings in a Makefile.
- Supporting common variable patterns would make secretlint even more useful.
- Of course, it helps my project, I would be happy, too.
Copilot
Metadata
Metadata
Assignees
Labels
Status: PR WelcomeWelcome to Pull RequestWelcome to Pull RequestStatus: ProposalRequest for commentsRequest for comments