Skip to content

Conversation

Copilot
Copy link

@Copilot Copilot AI commented Oct 8, 2025

Add support for detecting Certificate Signing Requests (CSR) in secret scanning patterns.

Implementation complete and validated:

  • Create a test file with the sample CSR from the issue (csr_sample.txt)
  • Add CSR pattern to rsa/patterns.yml following the existing pattern structure
  • Update README.md files to include the new CSR pattern
  • Fix pattern to use standard PEM format (5 dashes, not 2)
  • Improve pattern to handle multi-line base64 content properly
  • Validate YAML syntax
  • Run security checks
  • Test pattern against multiple CSR formats

The pattern successfully detects CSR blocks with the standard PEM format:

-----BEGIN CERTIFICATE REQUEST-----
[base64 encoded content with line breaks]
-----END CERTIFICATE REQUEST-----

Pattern validation:

  • ✓ Matches full multi-line CSR sample (1150 characters)
  • ✓ Matches single-line CSR (164 characters)
  • ✓ Matches simple test case (74 characters)

The pattern uses [a-zA-Z0-9+/=\s]+ to match base64 content, where \s includes all whitespace characters (spaces, tabs, newlines, carriage returns), ensuring it properly handles CSRs formatted with line breaks.

As noted in the issue, CSRs are not inherently secret leaks, but they may expose sensitive metadata or non-public information.

Original prompt

This section details on the original issue you should resolve

<issue_title>Pattern Request - csr</issue_title>
<issue_description>### Name / Description

A certificate signing request. These are not inherently secret leaks, but they might expose some metadata that is either sensitive or non-public.

Sample Snippets

True Positives

-----BEGIN CERTIFICATE REQUEST-----
MIIDGDCCAgACAQAwgakxCzAJBgNVBAYTAlVTMRMwEQYDVQQIEwpDYWxpZm9ybmlh
MRYwFAYDVQQHEw1Nb3VudGFpbiBWaWV3MRYwFAYDVQQKEw1Hb29nbGUsIEluYy4g
MRcwFQYDVQQLEw5JVCBEZXB0YXJ0bWVudDEXMBUGA1UEAxMOd3d3Lmdvb2dsZS5j
b20xIzAhBgkqhkiG9w0BCQEWFHdlYm1hc3RlckBnb29nbGUuY29tMIIBIjANBgkq
hkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAq3NT5DBBDql5gTB4/6Zsq/C1iwO4yBD2
nThaNfO1qHKUjnFz0oua+54x97TjmHItRH5H+jPJvmzzb4TUJ274CRFhquOOMZVM
dVIG9FUjogJstMqv4GtBC4C/ype0ilAcPEBjRi9bFiR/g43qPCnlRAJNo4cJko7n
W7erAJsRPNiQMr5UJN9h3GuQMPw6uaI/0OWuWjSTLzEBMujHhPySgZIv1SurVXDz
iFC6S6qvc9XQ1z6tkmrttdoOfDI+eT75QxysHmctgAvkZaFEoRASqcqf3iYyl9Qw
mh0xuLSoR9HTvaD9DhxAIa4/1+l6D9MGb/01+lip7AjqdnTTzSBfcQIDAQABoCkw
JwYJKoZIhvcNAQkOMRowGDAJBgNVHRMEAjAAMAsGA1UdDwQEAwIF4DANBgkqhkiG
9w0BAQsFAAOCAQEAZyMkFtElkS3vQoCPVHevrFcPgrx/Fqx0UdQdnf2RyoJ3jqiU
yPo5+5BHA9kY0TuJLhgMIq0QWAbzZYNL0+J8UUcx8EvMK6DqPpKteyYFCMw6GEzu
diq4RE/8Ea9UpGbw8GH1oEsUksBTwrs06OSOVgDXkJ1XY4VaRkMPflgQWGULgKYO
2P/zcFowENruGLJO7ynyUkm5idKdYzDqk7c7bqyLywOEPxSRKVyblmzqiFCOlCqp
HozZ9+5TmrMPD/hO1uHVECcL08RMGXoGMajojI8CE+cmkaWLq3PZt08Sv0F/Itop
O8XAZ2bYTK4HQfPm+Fud22SD+DkSwt8vN8Lu2g==
-----END CERTIFICATE REQUEST-----

False Positives

[snippet]

[optional] Propose Solution

See RSA key samples for similar pattern, add CSR pattern to that section.
</issue_description>

Comments on the Issue (you are @copilot in this section)

Fixes #103

💡 You can make Copilot smarter by setting up custom instructions, customizing its development environment and configuring Model Context Protocol (MCP) servers. Learn more Copilot coding agent tips in the docs.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Pattern Request - csr

2 participants