mirror of
https://github.com/trufflesecurity/trufflehog.git
synced 2024-11-14 00:47:21 +00:00
2f7029bc4d
This PR: Creates an optional interface that detectors can use to customize their false positive detection Implements this interface on detectors that have custom logic In most cases this "custom logic" is simply a no-op because the detector does not participate in false positive detection Eliminates inline (old-style) false positive exclusion in a few detectors that #2643 missed
100 lines
2.8 KiB
Go
100 lines
2.8 KiB
Go
package onfleet
|
|
|
|
import (
|
|
"context"
|
|
b64 "encoding/base64"
|
|
"fmt"
|
|
"io"
|
|
"net/http"
|
|
|
|
regexp "github.com/wasilibs/go-re2"
|
|
|
|
"github.com/trufflesecurity/trufflehog/v3/pkg/common"
|
|
"github.com/trufflesecurity/trufflehog/v3/pkg/detectors"
|
|
"github.com/trufflesecurity/trufflehog/v3/pkg/pb/detectorspb"
|
|
)
|
|
|
|
type Scanner struct {
|
|
client *http.Client
|
|
}
|
|
|
|
// Ensure the Scanner satisfies the interface at compile time.
|
|
var _ detectors.Detector = (*Scanner)(nil)
|
|
|
|
var (
|
|
defaultClient = common.SaneHttpClient()
|
|
// Make sure that your group is surrounded in boundary characters such as below to reduce false positives.
|
|
keyPat = regexp.MustCompile(detectors.PrefixRegex([]string{"onfleet"}) + `\b([a-z0-9]{32})\b`)
|
|
)
|
|
|
|
// Keywords are used for efficiently pre-filtering chunks.
|
|
// Use identifiers in the secret preferably, or the provider name.
|
|
func (s Scanner) Keywords() []string {
|
|
return []string{"onfleet"}
|
|
}
|
|
|
|
// FromData will find and optionally verify Onfleet secrets in a given set of bytes.
|
|
func (s Scanner) FromData(ctx context.Context, verify bool, data []byte) (results []detectors.Result, err error) {
|
|
dataStr := string(data)
|
|
|
|
uniqueMatches := make(map[string]struct{})
|
|
for _, match := range keyPat.FindAllStringSubmatch(dataStr, -1) {
|
|
uniqueMatches[match[1]] = struct{}{}
|
|
}
|
|
|
|
for match := range uniqueMatches {
|
|
s1 := detectors.Result{
|
|
DetectorType: detectorspb.DetectorType_Onfleet,
|
|
Raw: []byte(match),
|
|
}
|
|
|
|
if verify {
|
|
client := s.client
|
|
if client == nil {
|
|
client = defaultClient
|
|
}
|
|
|
|
isVerified, extraData, verificationErr := verifyMatch(ctx, client, match)
|
|
s1.Verified = isVerified
|
|
s1.ExtraData = extraData
|
|
s1.SetVerificationError(verificationErr, match)
|
|
}
|
|
|
|
results = append(results, s1)
|
|
}
|
|
|
|
return
|
|
}
|
|
|
|
func verifyMatch(ctx context.Context, client *http.Client, token string) (bool, map[string]string, error) {
|
|
req, err := http.NewRequestWithContext(ctx, http.MethodGet, "https://onfleet.com/api/v2/organization", nil)
|
|
if err != nil {
|
|
return false, nil, nil
|
|
}
|
|
data := fmt.Sprintf("%s:", token)
|
|
encoded := b64.StdEncoding.EncodeToString([]byte(data))
|
|
req.Header.Add("Authorization", fmt.Sprintf("Basic %s", encoded))
|
|
res, err := client.Do(req)
|
|
if err != nil {
|
|
return false, nil, err
|
|
}
|
|
defer func() {
|
|
_, _ = io.Copy(io.Discard, res.Body)
|
|
_ = res.Body.Close()
|
|
}()
|
|
|
|
if res.StatusCode >= 200 && res.StatusCode < 300 {
|
|
// If the endpoint returns useful information, we can return it as a map.
|
|
return true, nil, nil
|
|
} else if res.StatusCode == 401 {
|
|
// The secret is determinately not verified (nothing to do)
|
|
return false, nil, nil
|
|
} else {
|
|
err = fmt.Errorf("unexpected HTTP response status %d", res.StatusCode)
|
|
return false, nil, err
|
|
}
|
|
}
|
|
|
|
func (s Scanner) Type() detectorspb.DetectorType {
|
|
return detectorspb.DetectorType_Onfleet
|
|
}
|