[Sensitive Information] US Passport Number by v1ktor0t · Pull Request #58 · doyensec/osv-scalibr

v1ktor0t · 2026-07-03T10:44:31Z

Related to #57

I merged the behavior of both branches. Once this one is reviewed, the other PR/branch can be removed.

alessandro-Doyensec · 2026-07-06T09:45:58Z

    string key = 2;  // OAuth Application Secret (prefix: sq0csp-)
  }
+
+  message USPassportNumber {


I don't think you need to create a proto type for these, since the type is always sensitiveinformation.SensitiveInformation

oversight from the merge. i'll remove it now

alessandro-Doyensec · 2026-07-06T09:47:42Z

~~I think this collides with #57~~

Yes it does, beside the .proto looks ready to be merged

SzymonDrosdzol · 2026-07-06T15:22:03Z

Why are the proto changes required?

there was a letf-over proto object that was not needed, but compiled in. the new version contains the up-to-date compiled proto objects

Given that proto objects are not modified by the PR after all, can't we just leave them as-is?

i had a wrong assumption about this. reverted the file to the version in main,

SzymonDrosdzol · 2026-07-06T15:27:24Z

+		FromMatch: func(blob []byte, keywordMatch bool) (sensitiveinformation.SensitiveInformation, bool) {
+			likelihood := sensitiveinformation.LikelihoodUnlikely
+			if keywordMatch {
+				likelihood = sensitiveinformation.LikelihoodVeryLikely


I am willing to bet they'll want to downgrade it to LikelihoodLikely. VeryLikely is rather for stuff we were able to verify checksum, or something similar.

good catch.

SzymonDrosdzol · 2026-07-06T15:31:36Z

+
+var (
+	keywordsRe = simpleregex.KeywordsRe([]string{
+		`\b\w*passport\w*\b`,


How is \b\w*passport\w*\b different from just passport ?

the basic idea is to match passport within a boundary with an arbitrary prefix and/or suffix. for example, that regex will match all of these:

passport

passport_no

us_passport

us_passport_num

Makes sense. But isn't the same achieved by just using passport?
In other words: can you point out what is filtered out by this construction?

technically yes, with the exception that i'd need to remove the boundary (\b). let me see if there's any space for some optimization

@SzymonDrosdzol made some updates. i'd appreciate a look when you get the chance

alessandro-Doyensec

LGTM 🚀

Nit: you can rebase the whole PR to completely remove any changes done to the proto files inside commits, that way you don't have merge conflicts

SzymonDrosdzol

LGTM 🚀

… in extracted packages. PiperOrigin-RevId: 945701840

…nges in working directory instead of based on HEAD. Effectively, this change uses the programmatic equivalent of `git ls-tree HEAD` to determine the submodule SHA instead of the current `git submodule status`. A good explanation of the difference can be found here: https://stackoverflow.com/a/54238999 Falls back to using `git submodule status` when the SHA cannot be determined with the other method. PiperOrigin-RevId: 945863104

PiperOrigin-RevId: 948082439

Extractor was updated to parse package information & line number in a single-pass with a line-by-line scan, vs. using common MIME parsing library that doesn't have line number tracking. PiperOrigin-RevId: 948472912

The regex used to match per-requirement option was too aggressive, causing "-C" inside valid package names to be matched and trimmed into the wrong package names. Adding leading whitespace or new-line to the regex to prevent this issue PiperOrigin-RevId: 950622262

…libr. PiperOrigin-RevId: 950637626

PiperOrigin-RevId: 951144571

…PURL ID=sles now emits SUSE ecosystem and pkg:rpm/suse/ namespace. ID=azurelinux and ID=mariner now emit Azure Linux ecosystem and pkg:rpm/azurelinux/ namespace. Alpaquita (ID=alpaquita, APK) was already correctly routed. Fixes silent false-negative on OSV.dev for 20,561 SUSE advisories, 12,016 Azure Linux advisories, and 9,157 Alpaquita advisories. Routing table added: ID=sles → SUSE ecosystem, pkg:rpm/suse/ ID=azurelinux → Azure Linux ecosystem, pkg:rpm/azurelinux/ ID=mariner → Azure Linux ecosystem, pkg:rpm/azurelinux/

- Added sorting to transitivedependency (pomxml, requirements) enrichers for deterministic inventory ordering. - Add sorting to grpc queries to make it consistently snapshotable - Updated package name resolution in vulnmatch (osvdev, osvlocal) to handle GIT repo names, Go stdlib, and source/origin names for dpkg/apk packages. - Updated package version resolution to take into account redhat epochs. - Added support for purl TypeBrew and "git" ecosystem conversion in extractor. - Updated SPDX extractor to set package version from PURL and updated spdx_test.go. - Add support for the GIT ecosystem PiperOrigin-RevId: 951216522

ID=opensuse-leap from /etc/os-release fell through the rpmmeta.Metadata switch with no case, producing an empty ecosystem string and making all 12,954 openSUSE OSV advisories unreachable. Add a dedicated branch that constructs the suffix as "Leap " + VERSION_ID, matching the format used by OSV.dev (e.g. "openSUSE:Leap 15.5"). Using VERSION_ID alone ("15.5") does not match any advisory. The EcosystemOpenSUSE constant was already defined in inventory/osvecosystem/parsed.go but never referenced in ecosystem.go. Fixes: google#2203

… cookie is there

Updated package comment to include PEP 621 compliance and details about parsing specific tables.

PiperOrigin-RevId: 956018290

PiperOrigin-RevId: 958255624

… a common directory for use in other language extractors. PiperOrigin-RevId: 959048498

…ctly instead of strings. PiperOrigin-RevId: 959257339

PiperOrigin-RevId: 960018336

PiperOrigin-RevId: 960018484

PiperOrigin-RevId: 960034856

PiperOrigin-RevId: 960740927

PiperOrigin-RevId: 960888732

…kages in SCALIBR PiperOrigin-RevId: 960924505

PiperOrigin-RevId: 960924547

PiperOrigin-RevId: 962124218

PiperOrigin-RevId: 962213017

PiperOrigin-RevId: 962613611

…fests optional. PiperOrigin-RevId: 962662583

…tracted from Java manifests. PiperOrigin-RevId: 962743048

v1ktor0t requested review from SzymonDrosdzol and alessandro-Doyensec July 6, 2026 08:56

alessandro-Doyensec reviewed Jul 6, 2026

View reviewed changes

SzymonDrosdzol requested changes Jul 6, 2026

View reviewed changes

SzymonDrosdzol mentioned this pull request Jul 6, 2026

Us passport #57

Closed

alessandro-Doyensec approved these changes Jul 8, 2026

View reviewed changes

SzymonDrosdzol approved these changes Jul 8, 2026

View reviewed changes

- Added US passport number detector

0274912

v1ktor0t force-pushed the veles-us-passport-number branch from 7bd9574 to 0274912 Compare July 13, 2026 08:04

SCALIBR Team and others added 20 commits August 12, 2026 10:32

Update python/pipfilelock to support line number location information…

738abf0

… in extracted packages. PiperOrigin-RevId: 945701840

extractor/os/rpm: add Mageia ecosystem mapping

7810eee

Example implementation of the configuration redesign for scalibr.

4e37793

PiperOrigin-RevId: 948082439

Update python/wheelegg to support line numbers.

d55c77d

Extractor was updated to parse package information & line number in a single-pass with a line-by-line scan, vs. using common MIME parsing library that doesn't have line number tracking. PiperOrigin-RevId: 948472912

Respect disableGoogleAuth when initializing Google HTTP client in sca…

e5edd0d

…libr. PiperOrigin-RevId: 950637626

Add README for Guided Remediation

536a7da

PiperOrigin-RevId: 951144571

init: cookie

4d31eb0

add: properly handle double quotes

506df6e

add: client side collection testcases

3ab2c79

add: real testcases

b5d788d

edit: add more testcases

34143b6

fix: move true positive testcases into true negatives since no actual…

f181be0

… cookie is there

edit: adjust detection header size

b7c7bb8

edit: resolve false positives by splitting the regex into 2

0275622

add: newline

73f5f24

rahulhoysala and others added 29 commits August 12, 2026 10:33

fix plugger error with lint

28d0a1f

Trigger CI

e08ead2

Fix gofmt error for pyprojecttoml.go

d4369a4

revert enricher changes, add error handling

e0b18b5

fix gofmt (again)

cb97f31

Add error expectation for malformed TOML test case

7ec6bed

update table

ea53531

Enhance package comment for pyprojecttoml

5c265f3

Updated package comment to include PEP 621 compliance and details about parsing specific tables.

Trigger CI

26f8115

Fix trailing whitespace in package comment

ecef81c

Fix CRLF line endings in pyprojecttoml.go

12262da

Add depends_on relationships from SCALIBR inventory into SPDX SBOMS

9139fce

PiperOrigin-RevId: 956018290

Fix TargetOutsideRoot for Windows.

5d0bc5b

PiperOrigin-RevId: 958255624

Refactor: move Javascript linefinder package used in JS extractors to…

5b16171

… a common directory for use in other language extractors. PiperOrigin-RevId: 959048498

Refactor: update common linefinder package to accept byte slices dire…

6ed5a24

…ctly instead of strings. PiperOrigin-RevId: 959257339

Add line number support to dotnet/paketdependencies extractor.

e709469

PiperOrigin-RevId: 960018336

Add line number support for php/composerlock extractor.

7ea1cfc

PiperOrigin-RevId: 960018484

Add line number support for ruby/gemspec extractor.

9b83efb

PiperOrigin-RevId: 960034856

Add Go vendor modules extractor

b4162e8

Add support for Windows 11 25H2 and 26H1.

b6ff8b7

PiperOrigin-RevId: 960740927

Add support for DEPENDENCY_MANIFEST_OF and DESCENDANT_OF

ffe3182

PiperOrigin-RevId: 960888732

[SPDX Extractor] Support extracting external references from SPDX pac…

5535da9

…kages in SCALIBR PiperOrigin-RevId: 960924505

Add line number support for rust/cargolock extractor.

7dde282

PiperOrigin-RevId: 960924547

Bump SCALIBR version in preparation for the next release

8bd635b

PiperOrigin-RevId: 962124218

Extract direct dependency requirements from package.json manifests.

d62cc1c

PiperOrigin-RevId: 962213017

Add optional -project-root flag for guided remediation

6aa982f

PiperOrigin-RevId: 962613611

Make the extraction of dependency requirements from package.json mani…

62c4798

…fests optional. PiperOrigin-RevId: 962662583

Add protos and matching Go structs to store dependency information ex…

b526551

…tracted from Java manifests. PiperOrigin-RevId: 962743048

- Removed redundant keywords

63dfa19

alessandro-Doyensec closed this Aug 12, 2026

Uh oh!

Conversation

v1ktor0t commented Jul 3, 2026

Uh oh!

alessandro-Doyensec Jul 6, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

alessandro-Doyensec commented Jul 6, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

alessandro-Doyensec left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

SzymonDrosdzol left a comment

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

14 participants

alessandro-Doyensec Jul 6, 2026 •

edited

Loading

alessandro-Doyensec commented Jul 6, 2026 •

edited

Loading

alessandro-Doyensec left a comment •

edited

Loading