Private key recognition hook is not accurate

Hi Team!

I just discovered your work, and it is fantastic. Many thanks for putting this together, it is very useful.

I have a use case where code is extracting private keys, and contains lines such as

String keyContents = base64Content.VersionData.tostring();
keyContents = keyContents.replace('-----BEGIN RSA PRIVATE KEY-----', '');
keyContents = keyContents.replace('-----END RSA PRIVATE KEY-----', '');
keyContents = keyContents.replace('\n', '');

This is caught by the private key discoverer and it makes the tests fail.

Technically, private keys or certs would have a pattern that is (-----BEGIN RSA PRIVATE KEY-----)( base64 stuff)(-----END RSA PRIVATE KEY-----)

The current code seems to just check if the words “BEGIN RSA PRIVATE KEY” appears in the code, which is slightly weak.

As a result, I am using a combination of pre-commit and Talisman but I would love to have a single code base for everything.

Best, Sam

[nicain]

Thanks @asottile. Allowing .pre-commit-config.yaml to point to a different fork/sha made it very easy to test. Great design, Ill be tweeting and letting my co-workers know about your work!

[asottile]

Always open to improvements @nicain 😃