Updated ExchangeRate Detector (#4278)

pkg/detectors/exchangerateapi/exchangerateapi.go

@@ -3,6 +3,7 @@ package exchangerateapi
 import (
 	"context"
 	"fmt"
+	"io"
 	"net/http"
 	"strings"
 
@@ -22,13 +23,21 @@ var (
 	client = common.SaneHttpClient()
 
 	// Make sure that your group is surrounded in boundary characters such as below to reduce false positives.
-	keyPat = regexp.MustCompile(detectors.PrefixRegex([]string{"exchangerate"}) + `\b([a-z0-9]{24})\b`)
+	keyPat = regexp.MustCompile(detectors.PrefixRegex([]string{"exchangerate", "exchange-rate"}) + `\b([a-f0-9]{24})\b`)
 )
 
 // Keywords are used for efficiently pre-filtering chunks.
 // Use identifiers in the secret preferably, or the provider name.
 func (s Scanner) Keywords() []string {
-	return []string{"exchangerate"}
+	return []string{"exchangerate", "exchange-rate"}
+}
+
+func (s Scanner) Type() detectorspb.DetectorType {
+	return detectorspb.DetectorType_ExchangeRateAPI
+}
+
+func (s Scanner) Description() string {
+	return "An API key for determining the exchange rate of currencies"
 }
 
 // FromData will find and optionally verify ExchangeRateAPI secrets in a given set of bytes.
@@ -46,19 +55,9 @@ func (s Scanner) FromData(ctx context.Context, verify bool, data []byte) (result
 		}
 
 		if verify {
-			req, err := http.NewRequestWithContext(ctx, "GET", fmt.Sprintf("https://v6.exchangerate-api.com/v6/%s/latest/USD", resMatch), nil)
-			if err != nil {
-				continue
-			}
-			req.Header.Add("Accept", "application/vnd.exchangerateapi+json; version=3")
-			req.Header.Add("Authorization", fmt.Sprintf("Bearer %s", resMatch))
-			res, err := client.Do(req)
-			if err == nil {
-				defer res.Body.Close()
-				if res.StatusCode >= 200 && res.StatusCode < 300 {
-					s1.Verified = true
-				}
-			}
+			isVerified, verificationErr := verifyExchangeRateKey(ctx, client, resMatch)
+			s1.Verified = isVerified
+			s1.SetVerificationError(verificationErr, resMatch)
 		}
 
 		results = append(results, s1)
@@ -67,10 +66,30 @@ func (s Scanner) FromData(ctx context.Context, verify bool, data []byte) (result
 	return results, nil
 }
 
-func (s Scanner) Type() detectorspb.DetectorType {
-	return detectorspb.DetectorType_ExchangeRateAPI
-}
+func verifyExchangeRateKey(ctx context.Context, client *http.Client, key string) (bool, error) {
+	req, err := http.NewRequestWithContext(ctx, http.MethodGet, "https://v6.exchangerate-api.com/v6/latest/USD", http.NoBody)
+	if err != nil {
+		return false, err
+	}
 
-func (s Scanner) Description() string {
-	return "An API key for determining the exchange rate of currencies"
+	// authentication docs: https://www.exchangerate-api.com/docs/authentication
+	req.Header.Add("Authorization", fmt.Sprintf("Bearer %s", key))
+	resp, err := client.Do(req)
+	if err != nil {
+		return false, nil
+	}
+
+	defer func() {
+		_, _ = io.Copy(io.Discard, resp.Body)
+		_ = resp.Body.Close()
+	}()
+
+	switch resp.StatusCode {
+	case http.StatusOK:
+		return true, nil
+	case http.StatusForbidden:
+		return false, nil
+	default:
+		return false, fmt.Errorf("unexpected status code: %d", resp.StatusCode)
+	}
 }

pkg/detectors/exchangerateapi/exchangerateapi_test.go

@@ -10,31 +10,6 @@ import (
 	"github.com/trufflesecurity/trufflehog/v3/pkg/engine/ahocorasick"
 )
 
-var (
-	validPattern = `
-		# Configuration File: config.yaml
-		database:
-			host: $DB_HOST
-			port: $DB_PORT
-			username: $DB_USERNAME
-			password: $DB_PASS  # IMPORTANT: Do not share this password publicly
-
-		api:
-			auth_type: "Bearer"
-			in: "Header"
-			api_version: v1
-			exchangerate_secret: "gi77wx50yrynzt6tdyh9ugh3"
-			base_url: "https://api.example.com/$api_version/example"
-			query: ""
-			response_code: 200
-
-		# Notes:
-		# - Remember to rotate the secret every 90 days.
-		# - The above credentials should only be used in a secure environment.
-	`
-	secret = "gi77wx50yrynzt6tdyh9ugh3"
-)
-
 func TestExchangeRateAPI_Pattern(t *testing.T) {
 	d := Scanner{}
 	ahoCorasickCore := ahocorasick.NewAhoCorasickCore([]detectors.Detector{d})
@@ -45,9 +20,29 @@ func TestExchangeRateAPI_Pattern(t *testing.T) {
 		want  []string
 	}{
 		{
-			name:  "valid pattern",
-			input: validPattern,
-			want:  []string{secret},
+			name: "valid pattern",
+			input: `
+				# Configuration File: config.yaml
+				database:
+					host: $DB_HOST
+					port: $DB_PORT
+					username: $DB_USERNAME
+					password: $DB_PASS  # IMPORTANT: Do not share this password publicly
+
+				api:
+					auth_type: "Bearer"
+					in: "Header"
+					api_version: v1
+					exchangerate_secret: "a1039cd66170a7bf214199d4"
+					base_url: "https://api.example.com/$api_version/example"
+					query: ""
+					response_code: 200
+
+				# Notes:
+				# - Remember to rotate the secret every 90 days.
+				# - The above credentials should only be used in a secure environment.
+			`,
+			want: []string{"a1039cd66170a7bf214199d4"},
 		},
 	}