Incorrect detection of SBOM SPDX manifest as sendgrid secrets

[BernieWhite]

When using vsce package command, errors are returned for manifest.spdx.json files claiming they are Send Grid secrets, however they are just hashes as per SPDX SBOM spec.

Example file with false positive: https://www.powershellgallery.com/packages/PSRule.Rules.Azure/1.41.0/Content/_manifest%5Cspdx_2.2%5Cmanifest.spdx.json

[benibenj]

Seems to be an issue with secretlint which we use for scanning secrets, I created an issue upstream and provided a PR to fix the issue.

[cdietrich-everest]

we have a similar problem with esbuild producing SG.languages.registerInlineValuesProvider

[benibenj]

The change was merged some weeks ago upstream: secretlint/secretlint#1078
We updated our dependencies to point to it. @cdietrich-everest are you seeing this on the latest version of vsce (3.6.0)?

[cdietrich-everest]

yes

yarn why @vscode/vsce
└─ lotse-language-vscode@workspace:packages/lotse-language-vscode
   └─ @vscode/vsce@npm:3.6.0 (via npm:3.6.0)

[benibenj]

it seems like SG.languages.registerInlineValuesProvider follows the send grid api token format which is why it's being flagged. We could be able to figure out that this is a false positive as a send grid api token tends to be 69 characters long which does not apply in your case.

[benibenj]

Fix has been merged upstream secretlint/secretlint#1132 and an update has been released. Will adopt the new version.