Allow disabling URL redaction

[HamsterExAstris]

Currently, the importer tool from Azure DevOps is redacting URLs that it doesn't need to:

• Anything preceding the first hyphen in a URL. (e.g. https://api-test.example.com became REDACTED-test.example.com, https://dev.azure.com/<organization name part 1>-<organization name part 2>-<organization name part 3> became REDACTED-<organization name part 2>-<organization name part 3>)
• https://go.microsoft.com/fwlink/ (e.g. https://go.microsoft.com/fwlink/?linkid=2215160 became REDACTED?linkid=2215160)
• https://spsprodcus (e.g. https://spsprodcus5.vssps.visualstudio.com became REDACTED5.vssps.visualstudio.com)

gh actions-importer list-features doesn't list this as something that can be disabled or configured. It would be helpful if the importer could be stopped from mangling these (non-secret!) strings?

[er0k]

I ran into this issue as well. It looks like a misconfiguration with the trufflehog config, which is set to this:

detectors:
- name: URLs
  keywords:
    - www
    - https
    - http
    - file
    - mailto
    - ws
    - wss
    - ldap
    - .
  regex:
    url: \b(?i)(https|http|file|mailto|ws|wss|ldap|ldaps)?(:\/\/)[A-Za-z\/\.]+

and then the importer runs the scrub_secrets_from_directory() function, which includes this line:

return unless trufflehog_on_path?

so my solution was to wait for the actions-importer container to start, exec in and move trufflehog out of the $PATH. This one-liner works for me on linux. I ran it in another shell before running gh actions-importer audit azure-devops:

echo "waiting for actions-importer container to start..." && until docker ps | grep actions-importer; do : ; done && docker exec $(docker ps | grep actions-importer | awk '{print $1}') mv /usr/local/bin/trufflehog{,.bak}

This is a pretty janky workaround, but it got the job done for me, and because it modifies the running container without committing any changes, it won't have any effect on subsequent runs.

It would be nice if

1. the trufflehog config was fixed to find actual secrets, and
2. there was an option in the tool to skip secrets redaction altogether