Show HN: Bearer – Open-source code security scanning solution (SAST) • Hacker News Board

Post by spmurrayzzz » Fri, Mar 10, 2023, 1:22 AM UTC

_elsapet wrote: post #57

spmurrayzzz wrote: post #50

Earlier quoted context omitted.

I'll cherry pick an example: the default cookie config rule( https://github.com/bearer/bearer/blob/main//pkg/commands/pro... ). We have many places where `cookie: ` is used in our code and it triggers that rule. There are a few issues with this: - Most of the expressions where we use that pattern are used to send a full encrypted cookie string. The use of `cookie` is not the name of a key in the cookie string, its th…

Thanks for the feedback here; it is much appreciated :) I do know your point around catching encryption is more general than this example, but I’ve made a small improvement to the default cookie config rule regex to address one of the false positive cases mentioned https://github.com/Bearer/bearer/pull/754

This still generates the same false positive for me, in all of the previous repos I tested on.

Post by _elsapet » Sat, Mar 11, 2023, 8:42 AM UTC

spmurrayzzz wrote: post #61

_elsapet wrote: post #57

Earlier quoted context omitted.

Thanks for the feedback here; it is much appreciated :) I do know your point around catching encryption is more general than this example, but I’ve made a small improvement to the default cookie config rule regex to address one of the false positive cases mentioned https://github.com/Bearer/bearer/pull/754

This still generates the same false positive for me, in all of the previous repos I tested on.

Thanks for the report back; that's interesting. Perhaps I misunderstood your example. Feel free to write an issue if you like, and I can investigate further.

Show HN: Bearer – Open-source code security scanning solution (SAST)

Re: Show HN: Bearer – Open-source code security scanning solution (SAST)

Re: Show HN: Bearer – Open-source code security scanning solution (SAST)