Repository navigation
FIX Detect postgresql://, mongodb+srv://, rediss:// and amqps:// connection strings in CredentialLeakScorer - #3639
Open
Shivam Sharma (ShivamSharma43) wants to merge 1 commit into
Conversation
…ection strings in CredentialLeakScorer The "Connection String" pattern matched only the mongodb, postgres, mysql, redis and amqp schemes, so URIs that embed a password under the canonical postgresql:// scheme, MongoDB Atlas's mongodb+srv:// or the TLS variants rediss:// and amqps:// were scored as no leak. GARAK_PATTERNS leaves out mongodb+srv://, which its MongoDB Cloud pattern already matches. Fixes microsoft#3638 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
This branch has not been deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
Fixes #3638.
CredentialLeakScorer's "Connection String" pattern matched only the schemesmongodb,postgres,mysql,redisandamqp. URIs that embed a password under the scheme variants these services document were scored as no leak: the canonicalpostgresql://, MongoDB Atlas'smongodb+srv://, and the TLS variantsrediss://andamqps://._DEFAULT_PATTERNS: the scheme group is nowmongodb(?:\+srv)?|postgres(?:ql)?|mysql|rediss?|amqps?.GARAK_PATTERNS: the scheme group is nowmongodb|postgres(?:ql)?|mysql|rediss?|amqps?.mongodb+srv://is left out because the existing "MongoDB Cloud Connection String" pattern already matches it, and adding it here would report one leak under two pattern names.The rest of each pattern is unchanged: user,
:password@host, and thecredentialcapture group thatGARAK_PATTERNSexclusions rely on. A URI without credentials still doesn't match.Tests and Documentation
New tests in
tests/unit/score/regex/test_credential_leak_scorer.py:test_connection_string_scheme_variants_detected: the four scheme variants match "Connection String" with the default patterns, and the score is True.test_garak_connection_string_scheme_variants_detected:postgresql://,rediss://andamqps://match "Connection String" withGARAK_PATTERNS.test_garak_mongodb_srv_reported_once: withGARAK_PATTERNS,mongodb+srv://is reported only as "MongoDB Cloud Connection String".test_connection_string_scheme_variant_without_credentials_not_detected:postgresql://andrediss://URIs without credentials are not reported.7 of the 10 new cases fail on
main(7facfdb). The other 3 are the "reported once" and "no credentials" guards, which pass onmaintoo. With the fix, the whole file passes (201 tests).ruff check,ruff format --checkandty checkare clean on both changed files.No documentation changes: the scorer's docstring doesn't list the supported schemes. I didn't run JupyText because no notebooks are affected.
This change was prepared with the help of Claude Code (an AI coding assistant). I reviewed the change and the tests.
🤖 Generated with Claude Code