Improvement: PrefixRegex Function

[ankushgoel27]

currently the prefixregex function matches 40 chars before the occurrence of the token. It would be nice to also match after the presence of the token. I have seen instances where the keyword appeared after the token and not before.

func PrefixRegex(keywords []string) string {
pre := (?i)(?:
middle := strings.Join(keywords, "|")
post := )(?:.|[\n\r]){0,40}
return pre + middle + post
}

[rgmz]

This is something I've wanted to do for a long time. Basic patterns like below are not sufficiently detected with the existing code.

curl -H "Authorization: token abcd...." https://api.github.com

It requires creating a new match group, which is complicated due to trufflesecurity#2746. Hopefully that can be merged now that they've added rudimentary unit tests to most detectors...

[ankushgoel27]

hopefully if they dont merge, we can have this feature in our fork

[rgmz]

It's doable, however there will be an increased risk of merge conflicts.