Stuck on an issue?

Lightrun Answers was designed to reduce the constant googling that comes with debugging 3rd party libraries. It collects links to all the places you might be looking at while hunting down a tough bug.

And, if you’re still stuck at the end, we’re happy to hop on a call to see how we can help out.

Replace the `scope` values in the recordings to suppress credscan warnings

See original GitHub issue

Example:

.post('/aaaaa/oauth2/v2.0/token', "response_type=token&grant_type=client_credentials&client_id=aaaaa&scope=https%3A%2F%2Fstorage.azure.com%2F.default"

Scope value is not sensitive data, but replacing it with a common place holder value could help us in suppressing credscan warnings using regex pattern match.

_Originally posted by @jeremymeng in https://github.com/Azure/azure-sdk-for-js/pull/12759#discussion_r596434526_

Suppressing the credscan warnings will help us reduce the noise. https://github.com/Azure/azure-sdk-for-js/pull/12759 can be used as a reference to consider replacements through the recorder.

Issue Analytics

State:
Created 3 years ago
Comments:5 (5 by maintainers)

Top GitHub Comments

1reaction

kurtzeborncommented, Apr 26, 2021

Hey @HarshaNalluru, I’m assigning this back to you because Sima is out on leave and you’ve begun working with @scbedd on a more general solution to JS recordings. I’m hoping this can be something you work into that project.

0reactions

HarshaNallurucommented, Jun 16, 2021

https://github.com/Azure/azure-sdk-for-js/pull/14954

Top Results From Across the Web

Microsoft Azure Security Code Analysis task customization guide

This article describes lists YAML configuration options for customizing all tasks in the Microsoft Security Code Analysis extension.

Getting started with Credential Scanner (CredScan)

Credential Scanner (aka CredScan) is a tool developed and maintained by Microsoft to identify credential leaks such as those in source code and ......

[Aggregate Reports] - CredScan failing due to recorded secret ...

azure/communication-network-traversal has a secret that is not being properly sanitized and causing CredScan errors.

Using CredScan suppression files to ignore False Positives ...

Currently we are using a Credscan suppression file in Register and WKS service to suppress warnings raised by Credscan task enabled in ADO ......

cbq: The Command Line Shell for N1QL | Couchbase Docs

To unset the values from a parameter's stack, you can use the UNSET command to remove all the values from the stack and...