fix(query): ensures 'passwords and secrets' queries do not flag fields in 'Proto' files (.proto)

[cx-andre-pereira]

Reason for Proposed Changes

• Currently passwords and secrets queries will wrongfully flag ".proto" files. These files cannot hold any sensitive values within their set fields since they serve as schema definitions only and do not store any actual values associated with the defined fields.
• It is true, however, that commented lines are allowed in said files and could include secrets, as such the way to avoid False Positives will be by the use of new "Avoiding Proto File fields" allow rules.

Proposed Changes

• Added 4 new allow rules one for each of the following queries :

  • "Generic Password" - 487f4be7-3fd9-4506-a07a-eae252180c08
    • regex : (?i)password\\s*=\\s*[1-9][0-9]{0,8}\\s*;

  ---

  • "Generic Private Key" - 2f665079-c383-4b33-896e-88268c1fa258
    • regex : (?i)private[_]?key\\s*=\\s*[1-9][0-9]{0,8}\\s*;

  ---

  • "Generic Token" - baee238e-1921-4801-9c3f-79ae1d7b2cbc
    • regex : (?i)token(_)?(key)?\\s*=\\s*[1-9][0-9]{0,8}\\s*;

  ---

  • "Encryption Key" - 9fb1cd65-7a07-4531-9bcf-47589d0f82d6
    • regex : (?i)encryption[_]?key\\s*=\\s*[1-9][0-9]{0,8}\\s*;

  ---

• The regex associated with the queries all follow a very similar pattern designed to ensure as little headroom for False Negatives as possible. The prefix to each regex is purely based on the main regex pattern associated with each query, then the suffix is identical between all regex : \\s*=\\s*[1-9][0-9]{0,8}\\s*;

• The suffix enforces the use of "=" and at least 1 integer value, additionally up to 8 more digits can be caught by the regex and finally there must be a semicolon at the end. All this is based on the ".proto" files syntax since it:

  • Does not support the use of ":" over "=" or any other value;
  • Only supports "field numbers" up to 536,870,911;
  • Must have a semicolon at the end of each statement, note that there can be an arbitrary number of whitespaces before said semicolon.

• A new negative and positive test sample was added, along with those the "inspector_test" was expanded to include a sample of type "PROTO".

I submit this contribution under the Apache-2.0 license.