config

Documentation

Index

• Constants
• type AllowList
• type Config
  • func NewConfig(options options.Options) (Config, error)
• type Entropy
• type Rule
• type TomlAllowList
• type TomlLoader
  • func (tomlLoader TomlLoader) Parse() (Config, error)

Constants

const DefaultConfig = `` /* 3494-byte string literal not displayed */

DefaultConfig is the default gitleaks configuration. If --config={path-to-config} is set than the config located at {path-to-config} will be used. Alternatively, if --repo-config is set then gitleaks will attempt to use the config set in a gitleaks.toml or .gitleaks.toml file in the repo that is run with --repo-config set.

Types

type AllowList

type AllowList struct {
	Description string
	Regexes     []*regexp.Regexp
	Commits     []string
	Files       []*regexp.Regexp
	Paths       []*regexp.Regexp
	Repos       []*regexp.Regexp
}

AllowList is struct containing items that if encountered will allowlist a commit/line of code that would be considered a leak.

type Config

type Config struct {
	Rules     []Rule
	Allowlist AllowList
}

Config is a composite struct of Rules and Allowlists Each Rule contains a description, regular expression, tags, and allowlists if available

func NewConfig

func NewConfig(options options.Options) (Config, error)

NewConfig will create a new config struct which contains rules on how gitleaks will proceed with its scan. If no options are passed via cli then NewConfig will return a default config which can be seen in config.go

type Entropy

type Entropy struct {
	Min   float64
	Max   float64
	Group int
}

Entropy represents an entropy range

type Rule

type Rule struct {
	Description string
	Regex       *regexp.Regexp
	File        *regexp.Regexp
	Path        *regexp.Regexp
	ReportGroup int
	Tags        []string
	AllowList   AllowList
	Entropies   []Entropy
}

Rule is a struct that contains information that is loaded from a gitleaks config. This struct is used in the Config struct as an array of Rules and is iterated over during an scan. Each rule will be checked. If a regex match is found AND that match is not allowlisted (globally or locally), then a leak will be appended to the final scan report.

type TomlAllowList

type TomlAllowList struct {
	Description string
	Regexes     []string
	Commits     []string
	Files       []string
	Paths       []string
	Repos       []string
}

TomlAllowList is a struct used in the TomlLoader that loads in allowlists from specific rules or globally at the top level config

type TomlLoader

type TomlLoader struct {
	AllowList TomlAllowList
	Rules     []struct {
		Description string
		Regex       string
		File        string
		Path        string
		ReportGroup int
		Tags        []string
		Entropies   []struct {
			Min   string
			Max   string
			Group string
		}
		AllowList TomlAllowList
	}
}

TomlLoader gets loaded with the values from a gitleaks toml config see the config in config/defaults.go for an example. TomlLoader is used to generate Config values (compiling regexes, etc).

func (TomlLoader) Parse

func (tomlLoader TomlLoader) Parse() (Config, error)

Parse will parse the values set in a TomlLoader and use those values to create compiled regular expressions and rules used in scans