From 2b1c42ceb17595fd68e183e881d9b70d84e9d3c1 Mon Sep 17 00:00:00 2001 From: trufflesteeeve <94936258+trufflesteeeve@users.noreply.github.com> Date: Fri, 10 Mar 2023 17:01:10 -0500 Subject: [PATCH] Make slack webhook detector regex more specific (#1168) * Make slack webhook detector regex more specific * fixup - add better body contains check --- pkg/detectors/slackwebhook/slackwebhook.go | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/pkg/detectors/slackwebhook/slackwebhook.go b/pkg/detectors/slackwebhook/slackwebhook.go index 0496ae438..5cd82887c 100644 --- a/pkg/detectors/slackwebhook/slackwebhook.go +++ b/pkg/detectors/slackwebhook/slackwebhook.go @@ -21,7 +21,7 @@ var ( client = common.SaneHttpClient() // Make sure that your group is surrounded in boundary characters such as below to reduce false positives. - keyPat = regexp.MustCompile(`(https://hooks\.slack\.com/services/[A-Za-z0-9+/]{44,46})`) + keyPat = regexp.MustCompile(`(https://hooks\.slack\.com/services/T[A-Z0-9]+/B[A-Z0-9]+/[A-Za-z0-9]{23,25})`) ) // Keywords are used for efficiently pre-filtering chunks. @@ -62,7 +62,7 @@ func (s Scanner) FromData(ctx context.Context, verify bool, data []byte) (result continue } body := string(bodyBytes) - if (res.StatusCode >= 200 && res.StatusCode < 300) || (res.StatusCode == 400 && strings.Contains(body, "text")) { + if (res.StatusCode >= 200 && res.StatusCode < 300) || (res.StatusCode == 400 && strings.Contains(body, "no_text")) { s1.Verified = true } }