fix(security): vulnerabilities found in cactus-rust-compiler

This fix will ignore AsymmetricPrivateKey (private-key) Fixes #2042 Signed-off-by: zondervancalvez <[email protected]>
hyperledger-cacti · Sep 19, 2023 · bc0b919 · bc0b919
1 parent b3a508c
commit bc0b919
Showing 1 changed file with 6 additions and 0 deletions.
diff --git a/trivy-secret.yaml b/trivy-secret.yaml
@@ -0,0 +1,6 @@
+rules:
+  - id: private-key
+    category: CategoryAsymmetricPrivateKey
+    title: Asymmetric Private Key
+    severity: HIGH
+    regex: (?i)-----\s*?BEGIN[ A-Z0-9_-]*?PRIVATE KEY( BLOCK)?\s*?-----(?P<secret>[A-Za-z0-9=+/\s]*?)-----\s*?END[ A-Z0-9_-]*? PRIVATE KEY( BLOCK)?\s*?-----