Sean P. KaneandGitHub
f14ab8177d
* chore: rename workbench to FreecadRobustMCPBridge * fix: stdio cleanup and bug fix for JSON RPC * fix: update FreeCAD MCP bridge and tests * test: Fix GUI Integration tests and other issues * fix: unit tests in CI and a few other things * docs: generate GitHub pages site and link to it. * fix: General code improvements and DRY refactoring * chore: General cleanup * chore: small fixes * docs: cleanup * docs: fixes * docs: small corrections * docs: fix * test: release check * bump: workbench v0.6.0 * chore: bump macros to 0.6.0 * docs: Release improvements * refactor: improve DRYness of code
126 lines
4.0 KiB
TOML
126 lines
4.0 KiB
TOML
# Gitleaks Configuration
|
|
# https://github.com/gitleaks/gitleaks
|
|
#
|
|
# This configuration extends the default rules with project-specific settings.
|
|
|
|
title = "FreeCAD Robust MCP Gitleaks Configuration"
|
|
|
|
[extend]
|
|
# Extend the default gitleaks configuration
|
|
useDefault = true
|
|
|
|
# ============================================================================
|
|
# Custom Rules
|
|
# ============================================================================
|
|
|
|
[[rules]]
|
|
id = "freecad-api-key"
|
|
description = "FreeCAD or related API key"
|
|
regex = '''(?i)(freecad|fcstd|fc)[-_]?(api)?[-_]?(key|token|secret)[\s]*[=:]\s*['"]?([a-zA-Z0-9_\-]{16,})['"]?'''
|
|
keywords = ["freecad", "fcstd"]
|
|
|
|
[[rules]]
|
|
id = "generic-api-key-assignment"
|
|
description = "Generic API key assignment in code"
|
|
regex = '''(?i)(api[_-]?key|apikey|api[_-]?secret|api[_-]?token)[\s]*[=:]\s*['"]([a-zA-Z0-9_\-]{20,})['"]'''
|
|
keywords = ["api_key", "apikey", "api-key", "api_secret", "api_token"]
|
|
|
|
[[rules]]
|
|
id = "jwt-token"
|
|
description = "JSON Web Token"
|
|
regex = '''eyJ[a-zA-Z0-9_-]*\.eyJ[a-zA-Z0-9_-]*\.[a-zA-Z0-9_-]*'''
|
|
keywords = ["eyJ"]
|
|
|
|
[[rules]]
|
|
id = "base64-encoded-secret"
|
|
description = "Base64 encoded secret (high entropy)"
|
|
regex = '''(?i)(secret|password|token|key)[\s]*[=:]\s*['"]([A-Za-z0-9+/]{40,}={0,2})['"]'''
|
|
keywords = ["secret", "password", "token", "key"]
|
|
entropy = 4.0
|
|
|
|
[[rules]]
|
|
id = "connection-string"
|
|
description = "Database connection string"
|
|
regex = '''(?i)(mongodb|postgres|mysql|redis|amqp|mssql)://[^\s'"]+'''
|
|
keywords = ["mongodb://", "postgres://", "mysql://", "redis://", "amqp://", "mssql://"]
|
|
|
|
[[rules]]
|
|
id = "private-key-header"
|
|
description = "Private key file content"
|
|
regex = '''-----BEGIN (RSA |EC |DSA |OPENSSH |PGP )?PRIVATE KEY( BLOCK)?-----'''
|
|
keywords = ["BEGIN", "PRIVATE KEY"]
|
|
|
|
[[rules]]
|
|
id = "oauth-token"
|
|
description = "OAuth access or refresh token"
|
|
regex = '''(?i)(oauth|access|refresh)[-_]?token[\s]*[=:]\s*['"]([a-zA-Z0-9_\-\.]{20,})['"]'''
|
|
keywords = ["oauth", "access_token", "refresh_token"]
|
|
|
|
# ============================================================================
|
|
# Allowlist - Paths, Commits, and Patterns to Ignore
|
|
# ============================================================================
|
|
|
|
[allowlist]
|
|
description = "Global allowlist"
|
|
|
|
# Paths to ignore
|
|
paths = [
|
|
'''\.gitleaks\.toml$''',
|
|
'''\.pre-commit-config\.yaml$''',
|
|
'''(^|/)tests?/''',
|
|
'''(^|/)test_.*\.py$''',
|
|
'''(^|/).*_test\.py$''',
|
|
'''(^|/)conftest\.py$''',
|
|
'''(^|/)fixtures/''',
|
|
'''(^|/)mocks?/''',
|
|
'''\.md$''', # Documentation files
|
|
'''go\.sum$''',
|
|
'''package-lock\.json$''',
|
|
'''yarn\.lock$''',
|
|
'''uv\.lock$''',
|
|
'''poetry\.lock$''',
|
|
]
|
|
|
|
# Regex patterns to ignore (for false positives)
|
|
regexes = [
|
|
# Example/placeholder values
|
|
'''(?i)(example|sample|placeholder|dummy|fake|test|mock)''',
|
|
# Documentation patterns
|
|
'''your[-_]?(api)?[-_]?(key|token|secret)[-_]?here''',
|
|
'''<.*?(key|token|secret|password).*?>''',
|
|
'''xxx+''',
|
|
'''CHANGE[-_]?ME''',
|
|
# Common false positives
|
|
'''(?i)public[-_]?key''', # Public keys are not secrets
|
|
'''sk-\.\.\.''', # Truncated keys in docs
|
|
]
|
|
|
|
# Specific strings to ignore
|
|
stopwords = [
|
|
"AKIAIOSFODNN7EXAMPLE", # AWS example key
|
|
"wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY", # AWS example secret
|
|
"ghp_xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx", # GitHub placeholder
|
|
]
|
|
|
|
# ============================================================================
|
|
# Rule-specific Allowlists
|
|
# ============================================================================
|
|
|
|
# Allow specific patterns for certain rules
|
|
[[rules]]
|
|
id = "generic-api-key"
|
|
[rules.allowlist]
|
|
regexes = [
|
|
'''(?i)example''',
|
|
'''(?i)placeholder''',
|
|
'''(?i)your[-_]key[-_]here''',
|
|
]
|
|
|
|
# ============================================================================
|
|
# Entropy Settings
|
|
# ============================================================================
|
|
|
|
# Minimum entropy threshold for entropy-based detection
|
|
# Higher values = fewer false positives but may miss some secrets
|
|
# Default is 3.5, we use 4.0 for fewer false positives
|