Skip to content

ios_hardcoded_secret produces too many false positives #111

@biovolt

Description

@biovolt

This detects any string keys that is used just to store random values like "APP_VERSION_KEY"
It is a common pattern to put key in the name when storing string kys that are used for value lookups

I believe this part of the regex "(key\s*=\s*[\'|\"].{1,100}[\'|\"]\s{0,5})" does more harm than good since it will cause most teams to disable the rule, or am I missing something?

e.g.

 private static let APP_VERSION_KEY = "AppVersionStringKey"
 private static let languageKey = "languageKey"
 private let leadsLoggedKey = "leadsLogged_Key"

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type
    No fields configured for issues without a type.

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions