Merge pull request #426 from blacklanternsecurity/dev

1.2.1 Release

Author: liquidsec

.github/workflows/tests.yaml

@@ -92,12 +92,8 @@ jobs:
           CURRENT_VERSION="${CURRENT_VERSION#v}"
           LATEST_VERSION="${LATEST_VERSION#v}"
 
-          # Extract major.minor for comparison
-          CURRENT_MAJOR_MINOR=$(echo "$CURRENT_VERSION" | cut -d '.' -f 1-2)
-          LATEST_MAJOR_MINOR=$(echo "$LATEST_VERSION" | cut -d '.' -f 1-2)
-
-          # Compare versions
-          if [ "$CURRENT_MAJOR_MINOR" == "$LATEST_MAJOR_MINOR" ]; then
+          # Compare full versions so patch-level bumps (e.g. 1.2.0 -> 1.2.1) also publish
+          if [ "$CURRENT_VERSION" == "$LATEST_VERSION" ]; then
             echo "VERSION_CHANGE=false" >> $GITHUB_ENV
           else
             echo "VERSION_CHANGE=true" >> $GITHUB_ENV
@@ -117,7 +113,7 @@ jobs:
         with:
           password: ${{ secrets.PYPI_API_TOKEN }}
 
-      - name: Tag the release if major or minor version changed
+      - name: Tag the release if version changed
         if: github.ref == 'refs/heads/main' && env.VERSION_CHANGE == 'true'
         run: |
           git config user.name "github-actions[bot]"

badsecrets/__version__.py

@@ -1 +1 @@
-__version__ = "1.2.0"
+__version__ = "1.2.1"

badsecrets/modules/passive/django_signedcookies.py

@@ -4,7 +4,7 @@
 
 
 class DjangoSignedCookies(BadsecretsBase):
-    identify_regex = re.compile(r"^[\.a-zA-Z_\-0-9]+:[\.a-zA-Z_\-0-9:]+$")
+    identify_regex = re.compile(r"^\.?[a-zA-Z0-9_-]+(?::[a-zA-Z0-9_-]{4,8})?:[a-zA-Z0-9_-]{27,}$")
     description = {"product": "Django Signed Cookie", "secret": "Django secret_key", "severity": "HIGH"}
     carve_locations = ("cookies",)
 

tests/carve_test.py

@@ -445,8 +445,9 @@ def test_carve_cookies_identifyonly_laravel():
 
 
 def test_carve_cookies_identifyonly_django():
-    # Django session cookie format: encoded:signature1:signature2 — matches
-    # ^[\.a-zA-z-0-9]+:[\.a-zA-z-0-9:]+$ but uses a key that isn't in the wordlist.
+    # Django session cookie format: payload:timestamp:signature — matches
+    # identify_regex (signature is a 27+ char base64url HMAC) but uses a key
+    # that isn't in the wordlist.
     _identify_only_fallback(
         Django_SignedCookies,
         "sessionid",

tests/django_signedcookies_test.py

@@ -24,3 +24,12 @@ def test_django_negative():
         ".eJxVjLsOAiEURP-F2hAuL8HSfr-BAPciq4ZNlt3K-O9KsoU2U8w5My8W4r7VsHdaw4zswoCdfrsU84PaAHiP7bbwvLRtnRMfCj9o59OC9Lwe7t9Bjb2OtbMkAEGQtQjekykmJy9JZIW-6CgUaCGsA6eSyV65s1Qya_xGKZrY-wPVYjdw:1ojOrE:bfOktjgLlUykwCBADSECRETSMM3-UypscEN57ECtXis"
     )
     assert not found_key
+
+
+def test_django_identify_false_positives():
+    x = DjangoSignedCookies()
+    assert not x.identify("abc:def")
+    assert not x.identify("a:b")
+    assert not x.identify("0000Qs-hTQlwlgXAYBlmgEFoQTR:1ffkg4vkm")
+    assert not x.identify("test:1234")
+    assert not x.identify("JSESSIONID:abcdef1234")