Add support for GitLab Runner Tokens (Routable) (gitleaks#1820)

nwittstruck · web-flow · commit 107a41827bb6 · 2025-04-09T09:35:56.000-05:00
This commit adds support for GitLabs routable runner tokens. For the specification see: https://handbook.gitlab.com/handbook/engineering/architecture/design-documents/cells/routable_tokens/#proposal Issue: gitleaks#1819 Co-authored-by: Nicholas Wittstruck <1283061+nwittstruck@users.noreply.github.com>
diff --git a/cmd/generate/config/main.go b/cmd/generate/config/main.go
@@ -111,6 +111,7 @@ func main() {
 		rules.GitlabPipelineTriggerToken(),
 		rules.GitlabRunnerRegistrationToken(),
 		rules.GitlabRunnerAuthenticationToken(),
+		rules.GitlabRunnerAuthenticationTokenRoutable(),
 		rules.GitlabScimToken(),
 		rules.GitlabSessionCookie(),
 		rules.GitterAccessToken(),
diff --git a/cmd/generate/config/rules/gitlab.go b/cmd/generate/config/rules/gitlab.go
@@ -177,6 +177,23 @@ func GitlabRunnerAuthenticationToken() *config.Rule {
 	return utils.Validate(r, tps, nil)
 }
 
+func GitlabRunnerAuthenticationTokenRoutable() *config.Rule {
+	r := config.Rule{
+		RuleID:      "gitlab-runner-authentication-token-routable",
+		Description: "Discovered a GitLab Runner Authentication Token (Routable), posing a risk to CI/CD pipeline integrity and unauthorized access.",
+		Regex:       regexp.MustCompile(`\bglrt-t\d_[0-9a-zA-Z_\-]{27,300}\.[0-9a-z]{2}[0-9a-z]{7}\b`),
+		Entropy:     4,
+		Keywords:    []string{"glrt-"},
+	}
+
+	tps := utils.GenerateSampleSecrets("gitlab", "glrt-t"+secrets.NewSecret(utils.Numeric("1"))+"_"+secrets.NewSecret(utils.AlphaNumeric("27"))+"."+secrets.NewSecret(utils.AlphaNumeric("2"))+secrets.NewSecret(utils.AlphaNumeric("7")))
+	fps := []string{
+		"glrt-tx_xxxxxxxxxxxxxxxxxxxxxxxxxxx.xxxxxxxxx",
+	}
+
+	return utils.Validate(r, tps, fps)
+}
+
 func GitlabScimToken() *config.Rule {
 	r := config.Rule{
 		RuleID:      "gitlab-scim-token",
diff --git a/config/gitleaks.toml b/config/gitleaks.toml
@@ -2220,6 +2220,13 @@ regex = '''glrt-[0-9a-zA-Z_\-]{20}'''
 entropy = 3
 keywords = ["glrt-"]
 
+[[rules]]
+id = "gitlab-runner-authentication-token-routable"
+description = "Discovered a GitLab Runner Authentication Token (Routable), posing a risk to CI/CD pipeline integrity and unauthorized access."
+regex = '''\bglrt-t\d_[0-9a-zA-Z_\-]{27,300}\.[0-9a-z]{2}[0-9a-z]{7}\b'''
+entropy = 4
+keywords = ["glrt-"]
+
 [[rules]]
 id = "gitlab-scim-token"
 description = "Discovered a GitLab SCIM Token, posing a risk to unauthorized access for a organization or instance."
