From c6a3804c803584a63fbb6ccc41700f17c51a50e3 Mon Sep 17 00:00:00 2001
From: Rylen Anil <rylen.anil@gmail.com>
Date: Thu, 30 Jul 2026 05:05:32 +0000
Subject: [PATCH] detect basic-auth credentials in URLs

---
 cmd/generate/config/main.go                 |  1 +
 cmd/generate/config/rules/basic_auth_url.go | 42 +++++++++++++++++++++
 config/gitleaks.toml                        | 18 +++++++++
 3 files changed, 61 insertions(+)
 create mode 100644 cmd/generate/config/rules/basic_auth_url.go

diff --git a/cmd/generate/config/main.go b/cmd/generate/config/main.go
index f5a9b96b8..d67c070ec 100644
--- a/cmd/generate/config/main.go
+++ b/cmd/generate/config/main.go
@@ -48,6 +48,7 @@ func main() {
 		rules.Authress(),
 		rules.AWS(),
 		rules.AzureActiveDirectoryClientSecret(),
+		rules.BasicAuthURL(),
 		rules.BitBucketClientID(),
 		rules.BitBucketClientSecret(),
 		rules.BittrexAccessKey(),
diff --git a/cmd/generate/config/rules/basic_auth_url.go b/cmd/generate/config/rules/basic_auth_url.go
new file mode 100644
index 000000000..0c88640e4
--- /dev/null
+++ b/cmd/generate/config/rules/basic_auth_url.go
@@ -0,0 +1,42 @@
+package rules
+
+import (
+	"github.com/zricethezav/gitleaks/v8/cmd/generate/config/utils"
+	"github.com/zricethezav/gitleaks/v8/config"
+	"github.com/zricethezav/gitleaks/v8/regexp"
+)
+
+func BasicAuthURL() *config.Rule {
+	r := config.Rule{
+		RuleID:      "basic-auth-url",
+		Description: "Discovered credentials embedded in a URL, which may compromise the URL-accessed resource.",
+		Regex:       regexp.MustCompile(`(?i)\bhttps?://([^:/@\s]{3,}:(?:%[0-9a-f]{2}|[\w=~.+!$&'()*+,;\-]){8,})@`),
+		Keywords:    []string{"http://", "https://"},
+		Entropy:     2,
+		Allowlists: []*config.Allowlist{
+			{
+				Regexes: []*regexp.Regexp{
+					regexp.MustCompile(`(?i)[^:]+:(?:change(?:it|me)|pass(?:word)?|pwd|test|token|\*+|x+)`),
+					regexp.MustCompile(`[^:]+:\[[^]]+]`),
+					regexp.MustCompile(`<[^:>]+:[^>]+>`),
+					regexp.MustCompile(`[^:]+:\$\{?\w+}?`),
+					regexp.MustCompile(`\$\{?\w+}?:\$\{?\w+}?`),
+				},
+			},
+		},
+	}
+
+	tps := []string{
+		`baseurl = https://PSVC-ART-RO:abc123SECRET456D@repo.example.invalid/artifactory/unit-agent-prod-rpm/shared/`,
+		`baseurl = https://PSVC-ART-RO:abc123%2BSECRET456D@repo.example.invalid/artifactory/unit-agent-prod-rpm/shared/`,
+		`proxy = "http://deploy-user:pQ9wTxu4Fg@proxy.example.invalid:8080"`,
+	}
+	fps := []string{
+		`baseurl = https://username:password@repo.example.invalid/artifactory/unit-agent-prod-rpm/shared/`,
+		`baseurl = https://<user:password>@repo.example.invalid/artifactory/unit-agent-prod-rpm/shared/`,
+		`proxy = "http://${PROXY_USER}:${PROXY_PASSWORD}@proxy.example.invalid:8080"`,
+		`proxy = "http://user:[PASSWORD]@proxy.example.invalid:8080"`,
+		`https://example.com/path?not=basic-auth`,
+	}
+	return utils.Validate(r, tps, fps)
+}
diff --git a/config/gitleaks.toml b/config/gitleaks.toml
index 256f64790..cfd268d10 100644
--- a/config/gitleaks.toml
+++ b/config/gitleaks.toml
@@ -240,6 +240,24 @@ regex = '''(?:^|[\\'"\x60\s>=:(,)])([a-zA-Z0-9_~.]{3}\dQ~[a-zA-Z0-9_~.-]{31,34})
 entropy = 3
 keywords = ["q~"]
 
+[[rules]]
+id = "basic-auth-url"
+description = "Discovered credentials embedded in a URL, which may compromise the URL-accessed resource."
+regex = '''(?i)\bhttps?://([^:/@\s]{3,}:(?:%[0-9a-f]{2}|[\w=~.+!$&'()*+,;\-]){8,})@'''
+entropy = 2
+keywords = [
+    "http://",
+    "https://",
+]
+[[rules.allowlists]]
+regexes = [
+    '''(?i)[^:]+:(?:change(?:it|me)|pass(?:word)?|pwd|test|token|\*+|x+)''',
+    '''[^:]+:\[[^]]+]''',
+    '''<[^:>]+:[^>]+>''',
+    '''[^:]+:\$\{?\w+}?''',
+    '''\$\{?\w+}?:\$\{?\w+}?''',
+]
+
 [[rules]]
 id = "beamer-api-token"
 description = "Detected a Beamer API token, potentially compromising content management and exposing sensitive notifications and updates."