Documentation

Secrets extends DataObject
in package
uses UpdateTidyTrait

Identify secrets in strings.

Mask or remove them. Whatever you like.

This comes preloaded with a set of rules to help you tidy up your mess.

Best use case:

$safe = Secrets::create()->mask($_POST);
Tags
link
https://github.com/Yelp/detect-secrets/

Table of Contents

Constants

RULE_AWS  : mixed = '^AKIA[0-9A-Z]{16}'
RULE_AWS_KEY  : mixed = '^aws.{0,20}(?:key|pwd|pw|password|pass|token)'
RULE_BYCRYPT_HASH  : mixed = '^\$2[aby]\$.*\$'
RULE_GITHUB  : mixed = '^(?:ghp|github_pat|gho|ghu|ghs|ghr)'
RULE_HTTP_AUTH  : mixed = '^(?i:basic|bearer)\w(.*)'
RULE_HTTP_INLINE  : mixed = ':\/\/[^:\/]+:[^@\/]+@'
RULE_JWT  : mixed = '^eyJ[^.]+\..'
RULE_KEY_CVV  : mixed = '(?i:cvv|cvn|ccv)'
RULE_KEY_PASSWORD  : mixed = '(?i:password|passwd)'
RULE_KEY_SECRET  : mixed = '(?i:key|secret)'
RULE_KEY_TOKEN  : mixed = '(?i:token|salt|nonce|jwt)'
RULE_KEYS  : mixed = [self::RULE_KEY_PASSWORD, self::RULE_KEY_SECRET...
RULE_SENDGRID  : mixed = '^SG\..{22}\..{43}'
RULE_SQUARE  : mixed = '^sq0csp-'
RULE_SSH_PGP  : mixed = '^BEGIN.*PRIVATE KEY'
RULE_STRIPE  : mixed = '^[rs]k_live'
RULE_VALUES  : mixed = [self::RULE_HTTP_AUTH, self::RULE_HTTP_INLINE,...

Properties

$base64  : bool
Whether to treat _all_ base64 strings as secrets.
$hex  : bool
Whether to treat _all_ hex strings as secrets.
$key_pattern  : string
$key_rules  : array<string|int, string>
$mask_length  : int|null
Create masks with fixed sizes.
$value_pattern  : string
$value_rules  : array<string|int, string>

Methods

__construct()  : mixed
addKeyRule()  : void
Add a new key rule.
addValueRule()  : void
Add a new value rule.
clean()  : array<string|int, mixed>
Remove any secrets in the given array.
create()  : Secrets
Shorthand, create a sanitizer using the builtin rules.
isSecret()  : bool
Does this item look like a secret, either key or value?
isSecretKey()  : bool
Does this key identify a secret?
isSecretValue()  : bool
Does this value look like a secret?
mask()  : array<string|int, mixed>
Mask any secrets in the given array.
maskValue()  : string
Mask a string value if it looks like a secret.
update()  : void
Update the object with a new configuration.
buildPattern()  : string
Build a regex pattern from a list of rules.
getMask()  : string
Create a masked version of the value.
hasSecret()  : bool
Does this array contain a secret?

Constants

RULE_AWS

public mixed RULE_AWS = '^AKIA[0-9A-Z]{16}'

RULE_AWS_KEY

public mixed RULE_AWS_KEY = '^aws.{0,20}(?:key|pwd|pw|password|pass|token)'

RULE_BYCRYPT_HASH

public mixed RULE_BYCRYPT_HASH = '^\$2[aby]\$.*\$'

RULE_GITHUB

public mixed RULE_GITHUB = '^(?:ghp|github_pat|gho|ghu|ghs|ghr)'

RULE_HTTP_AUTH

public mixed RULE_HTTP_AUTH = '^(?i:basic|bearer)\w(.*)'

RULE_HTTP_INLINE

public mixed RULE_HTTP_INLINE = ':\/\/[^:\/]+:[^@\/]+@'

RULE_JWT

public mixed RULE_JWT = '^eyJ[^.]+\..'

RULE_KEY_CVV

public mixed RULE_KEY_CVV = '(?i:cvv|cvn|ccv)'

RULE_KEY_PASSWORD

public mixed RULE_KEY_PASSWORD = '(?i:password|passwd)'

RULE_KEY_SECRET

public mixed RULE_KEY_SECRET = '(?i:key|secret)'

RULE_KEY_TOKEN

public mixed RULE_KEY_TOKEN = '(?i:token|salt|nonce|jwt)'

RULE_KEYS

public mixed RULE_KEYS = [self::RULE_KEY_PASSWORD, self::RULE_KEY_SECRET, self::RULE_KEY_TOKEN, self::RULE_KEY_CVV]

RULE_SENDGRID

public mixed RULE_SENDGRID = '^SG\..{22}\..{43}'

RULE_SQUARE

public mixed RULE_SQUARE = '^sq0csp-'

RULE_SSH_PGP

public mixed RULE_SSH_PGP = '^BEGIN.*PRIVATE KEY'

RULE_STRIPE

public mixed RULE_STRIPE = '^[rs]k_live'

RULE_VALUES

public mixed RULE_VALUES = [self::RULE_HTTP_AUTH, self::RULE_HTTP_INLINE, self::RULE_JWT, self::RULE_SSH_PGP, self::RULE_BYCRYPT_HASH, self::RULE_GITHUB, self::RULE_AWS, self::RULE_AWS_KEY, self::RULE_SENDGRID, self::RULE_SQUARE, self::RULE_STRIPE]

Properties

$base64

Whether to treat _all_ base64 strings as secrets.

public bool $base64 = false

If not enabled, base64 strings that contain matching patterns are still removed.

If enabled, all base64 strings are removed.

Default: false.

$hex

Whether to treat _all_ hex strings as secrets.

public bool $hex = false

If not enabled, hex strings that contain matching patterns are still removed.

If enabled, all hex strings are removed.

Default: false.

$key_pattern

public string $key_pattern

$key_rules

public array<string|int, string> $key_rules

$mask_length

Create masks with fixed sizes.

public int|null $mask_length = 16

$value_pattern

public string $value_pattern

$value_rules

public array<string|int, string> $value_rules

Methods

__construct()

public __construct([iterable<string|int, mixed> $config = [] ]) : mixed
Parameters
$config : iterable<string|int, mixed> = []

addKeyRule()

Add a new key rule.

public addKeyRule(string $pattern) : void
Parameters
$pattern : string

regex

addValueRule()

Add a new value rule.

public addValueRule(string $pattern) : void
Parameters
$pattern : string

regex

clean()

Remove any secrets in the given array.

public clean(array<string|int, mixed> $item[, bool $recursive = true ]) : array<string|int, mixed>

Note, recursive mode cannot dive into objects.

Parameters
$item : array<string|int, mixed>
$recursive : bool = true
  • process nested arrays
Return values
array<string|int, mixed>

create()

Shorthand, create a sanitizer using the builtin rules.

public static create([array<string|int, mixed> $config = [] ]) : Secrets
Parameters
$config : array<string|int, mixed> = []

override settings

Return values
Secrets

isSecret()

Does this item look like a secret, either key or value?

public isSecret(mixed $item) : bool
Parameters
$item : mixed
Return values
bool

isSecretKey()

Does this key identify a secret?

public isSecretKey(mixed $item) : bool
Parameters
$item : mixed
Return values
bool

isSecretValue()

Does this value look like a secret?

public isSecretValue(mixed $item[, bool $recursive = true ]) : bool
Parameters
$item : mixed
$recursive : bool = true
  • process url/json strings
Return values
bool

mask()

Mask any secrets in the given array.

public mask(array<string|int, mixed> $item[, bool $recursive = true ]) : array<string|int, mixed>

Note, recursive mode cannot dive into objects.

Parameters
$item : array<string|int, mixed>
$recursive : bool = true
Return values
array<string|int, mixed>

maskValue()

Mask a string value if it looks like a secret.

public maskValue(string $value) : string
Parameters
$value : string
Return values
string

update()

Update the object with a new configuration.

public update(iterable<string|int, mixed> $config) : void
Parameters
$config : iterable<string|int, mixed>
Tags
inheritdoc

buildPattern()

Build a regex pattern from a list of rules.

protected buildPattern(array<string|int, mixed> $rules[, string $delimiter = '/' ]) : string
Parameters
$rules : array<string|int, mixed>
$delimiter : string = '/'
Return values
string

getMask()

Create a masked version of the value.

protected getMask(mixed $value) : string

TODO use php8 sensitive attributes here.

Values arrive from arbitrary logged data (sessions, exception properties), so anything non-string masks as an empty value rather than raising a type error inside the logger.

Parameters
$value : mixed
Return values
string

hasSecret()

Does this array contain a secret?

protected hasSecret(array<string|int, mixed> $array) : bool

Note, this will recursively search all nodes (including leaves) but will not recurse into decoded URL/JSON strings.

For that reason, this isn't a public method because it's confusing outside of this internal context and not particularly useful otherwise.

Parameters
$array : array<string|int, mixed>
Return values
bool
On this page

Search results