Merge pull request #99 from blacklanternsecurity/dev

Improved Flask Module Regex
blacklanternsecurity · Oct 12, 2023 · af868d0 · af868d0
2 parents 6d56304 + 03fab63
commit af868d0
Show file tree

Hide file tree

Showing 2 changed files with 5 additions and 1 deletion.
diff --git a/badsecrets/modules/flask_signedcookies.py b/badsecrets/modules/flask_signedcookies.py
@@ -6,7 +6,7 @@
 
 
 class Flask_SignedCookies(BadsecretsBase):
-    identify_regex = re.compile(r"eyJ(?:[\w-]*\.)(?:[\w-]*\.)[\w-]*")
+    identify_regex = re.compile(r"\.?e[Jy](?:[\w-]*\.)(?:[\w-]*\.)[\w-]*")
     description = {"product": "Flask Signed Cookie", "secret": "Flask Password", "severity": "HIGH"}
 
     def check_secret(self, flask_cookie):

diff --git a/tests/flask_signedcookies_test.py b/tests/flask_signedcookies_test.py
@@ -5,6 +5,10 @@
 tests = [
     ("CHANGEME", "eyJoZWxsbyI6IndvcmxkIn0.XDtqeQ.1qsBdjyRJLokwRzJdzXMVCSyRTA"),
     ("Attack at dawn!", "eyJsb2dnZWRfaW4iOnRydWV9.ZCONag.j2PHXgeT2B62qlYH72PKVuqjPvE"),
+    (
+        "secret",
+        ".eJwNyTEOgzAMBdC7eO6QGNskXCZKrG8hgVqJdEPcvX3ru6n5vKJ9PwfetFHCiCqwtYopo4NLiPOo4jYMuhizpJLV8oicilQF_qOeF_a104taXJg7bdHPiecHfX8ccg.ZFCriA.99lOhq3pO8yBWM7XjBshaKjqPKU",
+    ),
 ]