Skip to content

secret heuristic flags well-known charset constants (base64 alphabet) #96

Description

@mdavistffhrtporg

Found scanning Apple's WebInspectorUI (AttackMap 0.3.1).

The high-entropy secret heuristic flagged
base64Digits = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"
in UserInterface/Models/SourceMap.js as a hard-coded secret. That's the
standard base64 VLQ alphabet, not a secret.

Fix

Guard the high-entropy detector: skip values that look like a well-known
charset/alphabet constant (sequential ABCDEFGH…/abcdefgh…/0123456789abcdef
runs → base64/base32/base16 alphabets).

Metadata

Metadata

Assignees

No one assigned

    Labels

    Type

    No type

    Fields

    No fields configured for issues without a type.

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions