Repository navigation
Release v2.16.0 - #571
Merged
Merged
Release v2.16.0#571
Conversation
Contributor
There was a problem hiding this comment.
🟡 Changes recommended
The greedy context pattern skips the first password when multiple connection strings share a line; it needs non-greedy matching, a regression test, and a regenerated bundle.
1 open issue
What changed in this PR
Prepares Kingfisher v2.16.0 with expanded secret detection, more reliable reported commands, and scanning and viewer fixes. The connection-string rules restore focused coverage requested in #558 without enabling broad generic detectors.
Changes:
- Expands the catalog to 501 rules with Betterleaks rc.5 and five first-party connection-string detectors.
- Improves private-key filtering, AWS credential handling, generated commands, PDF diagnostics, and investigation-dialog visibility.
- Updates release versions, regression coverage, benchmarks, and documentation.
| File | Description |
|---|---|
tools/rule-bundle/src/main.rs |
Updates upstream pin and bundles first-party rules with provenance. |
tests/viewer_investigation.cjs |
Tests dialog visibility, scrolling, and focus restoration. |
tests/smoke_pdf.rs |
Tests debug-only PDF diagnostics. |
tests/reported_commands.rs |
Adds command replay and quoting integration tests. |
tests/int_placeholder_credentials.rs |
Tests private-key placeholder rejection and subsequent detection. |
tests/int_aws_dependency_context.rs |
Tests standalone AWS IDs and omitted commands. |
src/scanner/enumerate.rs |
Moves recoverable PDF diagnostics to DEBUG. |
src/rule_loader.rs |
Tests first-party rule loading and selection. |
src/reporter/commands.rs |
Trims command context and corrects credential bindings. |
src/reporter.rs |
Centralizes revocation bindings and tests serialized commands. |
src/main.rs |
Filters PDF and access-map diagnostics by verbosity. |
src/direct_revoke.rs |
Tests reported AWS revocation inputs. |
src/cli/commands/rules.rs |
Updates built-in rule help text. |
scripts/benchmarks/README.md |
Documents connection-string benchmark methodology and results. |
scripts/benchmarks/connection_string_password.py |
Adds paired detection and coverage comparisons. |
README.md |
Updates catalog sources and Betterleaks comparison. |
python/tests/test_private_key_fixtures.py |
Adds SDK private-key fixture regressions. |
python/tests/test_connection_string_password.py |
Tests embedded password detection and redaction. |
python/README.md |
Updates prepared SDK release information. |
python/examples/connection_string_password.py |
Demonstrates offline scanning with redacted output. |
llms.txt |
Simplifies comparison links and descriptions. |
docs/viewer/index.html |
Moves shared dialog outside hidden tab panels. |
docs/TOKEN_REVOCATION_SUPPORT.md |
Updates the upstream revocation reference. |
docs/RULES.md |
Documents catalog additions and filtering behavior. |
docs/PYPI.md |
Updates SDK version and publication examples. |
docs/PUBLISHING.md |
Updates prepared package versions and release commands. |
docs/LIBRARY.md |
Updates Rust dependency and installation examples. |
docs/INSTALLATION.md |
Updates the embedded rule count. |
docs/COMPARISON.md |
Refreshes Betterleaks references and removes mapping comparison. |
docs/ADVANCED.md |
Documents expanded catalog and source filtering. |
docs-site/scripts/prepare-docs.py |
Revises comparison-page metadata. |
docs-site/docs/usage/advanced.md |
Synchronizes advanced usage documentation. |
docs-site/docs/rules/overview.md |
Synchronizes rule coverage and filtering documentation. |
docs-site/docs/rules/imported-capabilities.md |
Explains private-key boundary and structural checks. |
docs-site/docs/rules/builtin-rules.md |
Updates generated catalog and capability counts. |
docs-site/docs/reference/python-bindings.md |
Synchronizes SDK release guidance. |
docs-site/docs/reference/library.md |
Synchronizes Rust library version examples. |
docs-site/docs/reference/comparison.md |
Synchronizes revised capability comparisons. |
docs-site/docs/llms.txt |
Synchronizes comparison links. |
docs-site/docs/getting-started/installation.md |
Synchronizes the embedded rule count. |
docs-site/docs/features/token-revocation-support.md |
Synchronizes the upstream revocation reference. |
docs-site/docs/changelog.md |
Adds v2.16.0 release notes. |
crates/kingfisher-scanner/tests/betterleaks_detection.rs |
Tests private-key boundaries and numbered source lines. |
crates/kingfisher-scanner/src/validation/validator.rs |
Updates incomplete AWS binding expectations. |
crates/kingfisher-scanner/src/scanner.rs |
Extends private-key source-wrapper regression tests. |
crates/kingfisher-scanner/README.md |
Updates scanner dependency examples. |
crates/kingfisher-scanner/Cargo.toml |
Bumps scanner and rules dependency versions. |
crates/kingfisher-rules/src/defaults.rs |
Tests catalog additions and private-key filtering. |
crates/kingfisher-rules/README.md |
Documents the expanded bundle and release version. |
crates/kingfisher-rules/generated/rules/kingfisher.yml |
Adds generated connection-string rules. |
crates/kingfisher-rules/generated/NOTICES.txt |
Updates upstream attribution and first-party licensing. |
crates/kingfisher-rules/data/kingfisher-rules.yml |
Defines five password detectors and exception metadata. |
crates/kingfisher-rules/data/kingfisher-rules.md |
Documents detector rationale, coverage, and retirement conditions. |
crates/kingfisher-rules/data/imported-rules-capabilities.md |
Documents revised private-key filtering. |
crates/kingfisher-rules/data/betterleaks-words.md |
Updates wordlist provenance reference. |
crates/kingfisher-rules/data/AGENTS.md |
Documents first-party rule maintenance requirements. |
crates/kingfisher-rules/Cargo.toml |
Bumps the rules crate to 3.0.1. |
crates/kingfisher-rules/build_support/builtin_docs.rs |
Includes first-party sources in generated documentation. |
crates/kingfisher-rules/build_support/betterleaks.rs |
Bounds private-key matches and parses predicate programs. |
crates/kingfisher-rules/AGENTS.md |
Adds first-party exception and pipeline guidance. |
crates/kingfisher-python/Cargo.toml |
Bumps the Python SDK to 1.6.1. |
CHANGELOG.md |
Adds v2.16.0 release notes. |
Cargo.toml |
Bumps CLI dependencies and adds a quoting-test dependency. |
Cargo.lock |
Synchronizes package versions and dependencies. |
AGENTS.md |
Updates logging and first-party catalog guidance. |
Review effort: Balanced
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
Contributor
There was a problem hiding this comment.
🔵 Needs a closer look
Native scanning, ZIP, and cryptographic dependency upgrades require build, packaging, and runtime validation for CLI binaries and Python wheels, especially on Windows x64/ARM64, which this source-only review cannot establish.
No open issues 🎉
1 resolved since last review
Review effort: Balanced
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Added
by default in the CLI,
kingfisher-rules, and Python SDK, including PostgreSQL/MySQL/MariaDBJDBC query passwords and SQL Server JDBC properties. The catalog now has 501 rules;
broad generic Betterleaks rules remain excluded.
#558
Changed
content detectors. Filename-only rules remain excluded;
selected Veles rules are unchanged.
still require a matching secret.
Fixed
letdeclarations and expression sequences inside Betterleakspredicates, including rc.5's generic XML filters. Existing rules need no edits.
component values and named captures, including AWS access-key revocation bindings.
Omit AWS validation commands when the matching secret component is absent.
stop private-key findings at their END marker without consuming nearby source or keys.
Preserve real private keys pasted with
cat -nor editor line-number prefixes.structural checks shared by the CLI and SDKs, without matching placeholder or method names.
Hide
lopdfreader warnings and errors unless--debug/--verboseis enabled.Queue, and restore page scrolling and focus when closing the dialog.