diff --git a/pkg/detectors/fibery/fibery.go b/pkg/detectors/fibery/fibery.go index cb8b22a6c..adc981abe 100644 --- a/pkg/detectors/fibery/fibery.go +++ b/pkg/detectors/fibery/fibery.go @@ -3,8 +3,8 @@ package fibery import ( "context" "fmt" + "io" "net/http" - "strings" "time" regexp "github.com/wasilibs/go-re2" @@ -14,6 +14,7 @@ import ( ) type Scanner struct { + client *http.Client detectors.DefaultMultiPartCredentialProvider } @@ -21,17 +22,17 @@ type Scanner struct { var _ detectors.Detector = (*Scanner)(nil) var ( - client = detectors.DetectorHttpClientWithNoLocalAddresses + defaultClient = detectors.DetectorHttpClientWithNoLocalAddresses // Make sure that your group is surrounded in boundary characters such as below to reduce false positives. - keyPat = regexp.MustCompile(detectors.PrefixRegex([]string{"fibery"}) + `\b([0-9a-f]{8}.[0-9a-f]{35})\b`) - domainPat = regexp.MustCompile(detectors.PrefixRegex([]string{"fibery", "domain"}) + `\b([0-9A-Za-z]{2,40})\b`) + keyPat = regexp.MustCompile(detectors.PrefixRegex([]string{"fibery"}) + `\b([0-9a-f]{8}\.[0-9a-f]{35})\b`) + domainPat = regexp.MustCompile(`(?:https?:\/\/)?([a-zA-Z0-9-]{1,63})\.fibery\.io(?:\/.*)?`) ) // Keywords are used for efficiently pre-filtering chunks. // Use identifiers in the secret preferably, or the provider name. func (s Scanner) Keywords() []string { - return []string{"fibery"} + return []string{".fibery.io"} } // Description returns a description for the result being detected @@ -39,41 +40,38 @@ func (s Scanner) Description() string { return "Fibery is a work management platform that combines various tools for project management, knowledge management, and software development. Fibery API tokens can be used to access and modify data within a Fibery workspace." } +func (s Scanner) getClient() *http.Client { + if s.client != nil { + return s.client + } + return defaultClient +} + // FromData will find and optionally verify Fibery secrets in a given set of bytes. func (s Scanner) FromData(ctx context.Context, verify bool, data []byte) (results []detectors.Result, err error) { dataStr := string(data) - matches := keyPat.FindAllStringSubmatch(dataStr, -1) - domainMatches := domainPat.FindAllStringSubmatch(dataStr, -1) + uniqueSecrets := make(map[string]struct{}) + uniqueDomains := make(map[string]struct{}) - for _, match := range matches { - resMatch := strings.TrimSpace(match[1]) - - for _, domainMatch := range domainMatches { - - resDomainMatch := strings.TrimSpace(domainMatch[1]) + for _, match := range keyPat.FindAllStringSubmatch(dataStr, -1) { + uniqueSecrets[match[1]] = struct{}{} + } + for _, match := range domainPat.FindAllStringSubmatch(dataStr, -1) { + uniqueDomains[match[1]] = struct{}{} + } + for secret := range uniqueSecrets { + for domain := range uniqueDomains { s1 := detectors.Result{ DetectorType: detectorspb.DetectorType_Fibery, - Raw: []byte(resMatch), + Raw: []byte(secret), } if verify { - timeout := 10 * time.Second - client.Timeout = timeout - req, err := http.NewRequestWithContext(ctx, "POST", fmt.Sprintf("https://%s.fibery.io/api/commands", resDomainMatch), nil) - if err != nil { - continue - } - req.Header.Add("Content-Type", "application/json") - req.Header.Add("Authorization", fmt.Sprintf("Token %s", resMatch)) - res, err := client.Do(req) - if err == nil { - defer res.Body.Close() - if res.StatusCode >= 200 && res.StatusCode < 300 { - s1.Verified = true - } - } + isVerified, verificationErr := verifyMatch(ctx, s.getClient(), secret, domain) + s1.Verified = isVerified + s1.SetVerificationError(verificationErr, secret, domain) } results = append(results, s1) @@ -83,6 +81,37 @@ func (s Scanner) FromData(ctx context.Context, verify bool, data []byte) (result return results, nil } +func verifyMatch(ctx context.Context, client *http.Client, secret, domain string) (bool, error) { + timeout := 10 * time.Second + client.Timeout = timeout + url := fmt.Sprintf("https://%s.fibery.io/api/commands", domain) + req, err := http.NewRequestWithContext(ctx, http.MethodPost, url, http.NoBody) + if err != nil { + return false, err + } + + req.Header.Add("Content-Type", "application/json") + req.Header.Add("Authorization", fmt.Sprintf("Token %s", secret)) + res, err := client.Do(req) + if err != nil { + return false, err + } + + defer func() { + _, _ = io.Copy(io.Discard, res.Body) + _ = res.Body.Close() + }() + + switch res.StatusCode { + case http.StatusOK: + return true, nil + case http.StatusUnauthorized: + return false, nil + default: + return false, fmt.Errorf("unexpected status code: %d", res.StatusCode) + } +} + func (s Scanner) Type() detectorspb.DetectorType { return detectorspb.DetectorType_Fibery } diff --git a/pkg/detectors/fibery/fibery_integration_test.go b/pkg/detectors/fibery/fibery_integration_test.go index be9dd20d4..e1c6d46af 100644 --- a/pkg/detectors/fibery/fibery_integration_test.go +++ b/pkg/detectors/fibery/fibery_integration_test.go @@ -19,11 +19,11 @@ import ( func TestFibery_FromChunk(t *testing.T) { ctx, cancel := context.WithTimeout(context.Background(), time.Second*5) defer cancel() - testSecrets, err := common.GetSecret(ctx, "trufflehog-testing", "detectors3") + testSecrets, err := common.GetSecret(ctx, "trufflehog-testing", "detectors6") if err != nil { t.Fatalf("could not get test secrets from GCP: %s", err) } - secret := testSecrets.MustGetField("FIBERY") + secret := testSecrets.MustGetField("FIBERY_SECRET") domain := testSecrets.MustGetField("FIBERY_DOMAIN") inactiveSecret := testSecrets.MustGetField("FIBERY_INACTIVE") diff --git a/pkg/detectors/fibery/fibery_test.go b/pkg/detectors/fibery/fibery_test.go index b94fad9ee..e918400a3 100644 --- a/pkg/detectors/fibery/fibery_test.go +++ b/pkg/detectors/fibery/fibery_test.go @@ -17,22 +17,16 @@ var ( "type": "Detector", "api": true, "authentication_type": "", - "verification_url": "https://%s.fibery.io/example", + "verification_url": "https://detector.fibery.io/example", "domain": "nonprod", "test_secrets": { - "fibery_secret": "42b2eda8{3fe6b086bb21be7e3548368626d01aaf2cd" + "fibery_secret": "42b2eda8.3fe6b086bb21be7e3548368626d01aaf2cd" }, "expected_response": "200", "method": "GET", "deprecated": false }]` - secrets = []string{ - // TODO: Domain pattern matches more than expected and the current logic create result for each secret&domain combination - "42b2eda8{3fe6b086bb21be7e3548368626d01aaf2cd", - "42b2eda8{3fe6b086bb21be7e3548368626d01aaf2cd", - "42b2eda8{3fe6b086bb21be7e3548368626d01aaf2cd", - "42b2eda8{3fe6b086bb21be7e3548368626d01aaf2cd", - } + secret = "42b2eda8.3fe6b086bb21be7e3548368626d01aaf2cd" ) func TestFibery_Pattern(t *testing.T) { @@ -47,7 +41,7 @@ func TestFibery_Pattern(t *testing.T) { { name: "valid pattern", input: validPattern, - want: secrets, + want: []string{secret}, }, }