From c104095aa0bfb9298b220c9ff274627cd893c014 Mon Sep 17 00:00:00 2001 From: Daniel Teuchert Date: Mon, 9 Nov 2026 11:42:26 +0100 Subject: [PATCH 1/2] Exclude boolean casts from secret classification --- .../analyzer/commons/appsec/SecretClassifier.java | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/commons/src/main/java/org/sonarsource/analyzer/commons/appsec/SecretClassifier.java b/commons/src/main/java/org/sonarsource/analyzer/commons/appsec/SecretClassifier.java index 7c7bb279..c8daacb8 100644 --- a/commons/src/main/java/org/sonarsource/analyzer/commons/appsec/SecretClassifier.java +++ b/commons/src/main/java/org/sonarsource/analyzer/commons/appsec/SecretClassifier.java @@ -106,6 +106,7 @@ Set values() { "p[@a]ssw[o0]rd", // Boolean / null / scalar literals, e.g. "password = undefined", "enabled: true" "^(?:none|undefined|null|true|false|yes|no|1|0)$", + "^\\(bool\\)(?:true|false)$", // Starts with "your", e.g. "yourpassword", "your_super_secret" "^your", // Same character 4 times in a row, e.g. "abbbbc" @@ -226,7 +227,7 @@ Set values() { // Leetspeak "password" variants with "@" that the "pass" substring misses "p@ssword", "p@ssw0rd", // Boolean / null / scalar literals - "undefined", "true", "null", + "undefined", "true", "null", "(bool)True", "(bool)False", // "your..." prefix "yourpassword", // Same-character repetitions @@ -316,6 +317,8 @@ Set values() { "Xk9Lm2Qp7Rs4Tv1Wz0", "9f8e7d6c5b4a392817", "Tr0ub4dor&3xpl0!t", + // Boolean casts are matched only as whole values + "prefix(bool)True", "(bool)FalseSuffix", // Leading "__" without a closing "__" "__not_closed", // Credential words are matched only as whole values, so a value that merely contains one stays a candidate From f53c8c74cacd818ede826bf5cb6d4b8fa63aa093 Mon Sep 17 00:00:00 2001 From: Daniel Teuchert Date: Mon, 9 Nov 2026 13:31:19 +0100 Subject: [PATCH 2/2] Document CODESYS origin of boolean exclusions --- .../sonarsource/analyzer/commons/appsec/SecretClassifier.java | 1 + 1 file changed, 1 insertion(+) diff --git a/commons/src/main/java/org/sonarsource/analyzer/commons/appsec/SecretClassifier.java b/commons/src/main/java/org/sonarsource/analyzer/commons/appsec/SecretClassifier.java index c8daacb8..56eafd9f 100644 --- a/commons/src/main/java/org/sonarsource/analyzer/commons/appsec/SecretClassifier.java +++ b/commons/src/main/java/org/sonarsource/analyzer/commons/appsec/SecretClassifier.java @@ -106,6 +106,7 @@ Set values() { "p[@a]ssw[o0]rd", // Boolean / null / scalar literals, e.g. "password = undefined", "enabled: true" "^(?:none|undefined|null|true|false|yes|no|1|0)$", + // Boolean values from the CODESYS export file format, e.g. "(bool)True", "(bool)False" "^\\(bool\\)(?:true|false)$", // Starts with "your", e.g. "yourpassword", "your_super_secret" "^your",