Reason for Proposed Changes

• Currently the regex_rules from passwords and secrets are flagging the following fields :

"HTTP_-_Get_OAuth_Token" : ...
"Parse_JSON_-_OAuth_Token": ...
"Try_-_Get_OAuth_Token": ...
"Catch_-_Get_OAuth_Token": ...

• These should be assumed as "Microsoft.Logic workflows" actions since they follow a specific naming convention and can only have preset values (7 possible) and not sensitive information.
• These False Positives are happening when "actions" with "runAfter" triggers define said triggers as such:

"runAfter_164": {
       "HTTP_-_Get_OAuth_Token": [
                                     "Succeeded"
                               ]
        }

or

"runAfter_164": {
       "HTTP_-_Get_OAuth_Token": ["Succeeded"]
        }

• Given the limitations of the passwords_and_secrets's queries it is impossible to distinguish these cases in scenarios that rely on different naming schemes that also finish with "token". An action like "HTTP2_-_Get_OAuth_Token" would also be flagged even after this fix because it is impossible to predict how a user will name an action.

• Considering the first example it is also impossible to filter by value associated with the field like "Succeeded". Since the scan will be line by line it is likely that said value is not available; otherwise , knowing the 7 possible values, the filtering process could be applicable to many more samples and still safe enough to not cause new False Negatives.

Proposed Changes

• Added a new "allowRules" rule to the "Generic Token" query:

{
   "description": "Avoiding Run After Triggers",
   "regex": "(?i)['\"](HTTP|Parse_JSON|Try|Catch)_-_(Get_)?OAuth_Token['\"]?\\s*[:=]\\s*['\"]?([[A-Za-z0-9/~^_!@&%()=?*+-]+)['\"]?"
}

• Added a test "negative56.json" with all 4 fields to be ignored.

• Finally, after fix(query): added two new allowRules on "Generic Secret" and "Generic Token" queries from Passwords and Secrets #7698 was merged some negative test naming isues were apparent, there were 2 negative54 tests (from previous PRs) and 2 negative56 tests, these did not cause issues because their file types were different but the naming was now corrected so that there are 58 tests in total finishing with negative58.bicep.

I submit this contribution under the Apache-2.0 license.