security: rust-secrets — require assignment to a literal, and cover static#523
Merged
Merged
Conversation
…static` Follow-up to #518, from triaging every remaining rust-secrets failure in the estate. THE FALSE POSITIVES. The patterns matched `= ... "` — a quote ANYWHERE after an equals. That flags code which hardcodes nothing at all: let api_key = request["api_key"].as_str().unwrap_or("") a lookup let api_key_file = temp_dir.path().join("config.js") a path Query::new("Here's my api_key=sk-12345") a demo string A hardcoded secret is an assignment DIRECTLY to a string literal, so each pattern now requires the quote to follow the `=`, with a minimum value length of 8 (a credential shorter than that is not a credential). THE MISSED DETECTION. `const.*KEY.*=` never matched `static AUTH_KEY: &str = "abcdef0123456789abcdef0123456789"` — a genuine hardcoded secret the job was silently passing. Found by canary, not by reading the regex: a 5-secret fixture detected only 4. `static` and `mut` are now accepted alongside `const`/`let`. Verified, not assumed: - 7/7 canary cases against the script extracted from THIS yaml (not a copy), including 5/5 real hardcoded secrets detected. - Replayed over all 64 Rust repos at both 2026-07-21 and post-cutoff 2026-09-01: 0 regressions, 3 verdicts fixed (aerie, and heterogenous-mobile-computing post-cutoff). Remaining after this: conative-gating, echidnabot and filesoup carry deliberately secret-shaped fixtures (a fuzz corpus, and two secret-scanners' own detection test data inside r#"…"# raw strings). Those are real matches on real secret-shaped literals, so they take the explicit `// scanner-allow: rust-secrets` pragma rather than a pattern loophole — separate one-line PRs. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Follow-up to #518, from triaging every remaining
rust-secretsfailure in the estate.The false positives
The patterns matched
= ... "— a quote anywhere after an equals. That flags code which hardcodes nothing at all:A hardcoded secret is an assignment directly to a string literal. Each pattern now requires the quote to follow the
=, with a minimum value length of 8 — a credential shorter than that is not a credential.The missed detection (the more important half)
const.*KEY.*=never matched:That is a genuine hardcoded secret the job was silently passing. I found it because a 5-secret canary fixture detected only 4 — not by reading the regex.
staticandmutare now accepted alongsideconst/let.Verified, not assumed
Canary run against the script extracted from this YAML (
yaml.safe_load→ execute), not a hand-copy:Replayed over all 64 Rust repos at both
2026-07-21and post-cutoff2026-09-01: 0 regressions, 3 verdicts fixed (aerie, andheterogenous-mobile-computingpost-cutoff).What deliberately still fails
conative-gating,echidnabot,filesoupcarry genuinely secret-shaped fixtures — a fuzz corpus, and two secret-scanners' own detection test data insider#"…"#raw strings. Those are real matches on real secret-shaped literals, so they get the explicit// scanner-allow: rust-secretspragma rather than a pattern loophole that would weaken the gate for everyone. Separate one-line PRs.🤖 Generated with Claude Code