feat: add new function key value masking

Author: SATYAsasini

common-lib/utils/secretScanner/rules.go

@@ -15,6 +15,10 @@ const (
 	aws = `aws_?`
 )
 
+// credentialAssignmentRegex matches a value assigned to a credential-named key, capturing the
+// key+separator+quote as `pre` so it can be kept while only the value is masked.
+var credentialAssignmentRegex = regexp.MustCompile(`(?i)(?P<pre>(password|passwd|pwd|secret|credential|token|api[_-]?key)["']?\s*(:|=>|=)\s*["']?)[^"',}\s]{3,}`)
+
 // create rule struct
 type Rule struct {
 	ID              string
@@ -667,12 +671,4 @@ var BuiltinRules = []Rule{
 		SecretGroupName: "secret",
 		Keywords:        []string{"dockerc"},
 	},
-	{
-		ID:              "generic-credential-assignment",
-		Title:           "Generic credential assignment",
-		Severity:        "HIGH",
-		Regex:           regexp.MustCompile(`(?i)(password|passwd|pwd|secret|credential|token|api[_-]?key)["']?\s*(:|=>|=)\s*["']?(?P<secret>[^"',}\s]{3,})`),
-		SecretGroupName: "secret",
-		Keywords:        []string{"password", "passwd", "pwd", "secret", "credential", "token", "key"},
-	},
 }

common-lib/utils/secretScanner/scanner.go

@@ -22,6 +22,12 @@ func MaskSecretsOnString(input string) string {
 	return maskedInput
 }
 
+// MaskCredentialKeyValues masks values assigned to credential-named keys, keeping the surrounding
+// structure intact so the result stays parseable (e.g. valid JSON).
+func MaskCredentialKeyValues(input string) string {
+	return credentialAssignmentRegex.ReplaceAllString(input, "${pre}******")
+}
+
 // MaskSecretsOnStream processes an input stream, masking secrets according to built-in rules.
 func MaskSecretsOnStream(input io.Reader) (io.Reader, error) {
 	pr, pw := io.Pipe()