Skip to content

MondoDB Detector silently discards valid secrets #5276

Description

@steeve85

The placeholderPasswordPat regex might discard valid passwords that start with xX or ends with *

When testing trufflehog on some mongodb credentials, I noticed that some potential secrets were not properly being identified. This was tested on fake data, but real passwords could also be missed.

At mongodb.go:34:

placeholderPasswordPat = regexp.MustCompile(`^[xX]+|\*+$`)

Using ^[xX]+$|^\*+$ should fix the issue.

I did not have the time to create a PR for this but happy to do it if needed

Activity

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions