trufflesecurity/trufflehog
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

[Feature] Updated Dotmailer Detector To Dotdigital (#4331)

Browse Source 
* updated dotmailer detector; renamed to dotdigital

* temp

* temp

* updated dotmailer name, verification method and tests

---------

Co-authored-by: Amaan Ullah <[email protected]>
This commit is contained in:
Nabeel Alam
2025-08-19 16:18:25 +05:00
committed by GitHub
co-authored by Amaan Ullah
parent 9005cf9826
commit e819d90e6b
7 changed files with 908 additions and 865 deletions
Download Patch File Download Diff File Expand all files Collapse all files
pkg/detectors/dotdigital/dotdigital.go
+123
View File
@@ -0,0 +1,123 @@
package dotdigital
import (
"context"
"fmt"
"io"
"net/http"
"time"
regexp "github.com/wasilibs/go-re2"
"github.com/trufflesecurity/trufflehog/v3/pkg/common"
"github.com/trufflesecurity/trufflehog/v3/pkg/detectors"
"github.com/trufflesecurity/trufflehog/v3/pkg/pb/detectorspb"
)
type Scanner struct {
client *http.Client
detectors.DefaultMultiPartCredentialProvider
}
// Ensure the Scanner satisfies the interface at compile time.
var _ detectors.Detector = (*Scanner)(nil)
var (
defaultClient = common.SaneHttpClient()
// Make sure that your group is surrounded in boundary characters such as below to reduce false positives.
emailPat = regexp.MustCompile(`\b(apiuser-[a-z0-9]{12}@apiconnector.com)\b`)
passPat = regexp.MustCompile(detectors.PrefixRegex([]string{"pw", "pass"}) + `\b([a-zA-Z0-9\S]{8,24})\b`)
)
// Keywords are used for efficiently pre-filtering chunks.
// Use identifiers in the secret preferably, or the provider name.
func (s Scanner) Keywords() []string {
return []string{"@apiconnector.com"}
}
func (s Scanner) getClient() *http.Client {
if s.client != nil {
return s.client
}
return defaultClient
}
// FromData will find and optionally verify Dotdigital secrets in a given set of bytes.
func (s Scanner) FromData(ctx context.Context, verify bool, data []byte) (results []detectors.Result, err error) {
dataStr := string(data)
var uniqueEmails, uniquePasswords = make(map[string]struct{}), make(map[string]struct{})
for _, matches := range emailPat.FindAllStringSubmatch(dataStr, -1) {
uniqueEmails[matches[1]] = struct{}{}
}
for _, matches := range passPat.FindAllStringSubmatch(dataStr, -1) {
uniquePasswords[matches[1]] = struct{}{}
}
for email := range uniqueEmails {
for password := range uniquePasswords {
s1 := detectors.Result{
DetectorType: detectorspb.DetectorType_Dotdigital,
Raw: []byte(email),
RawV2: []byte(email + password),
}
if verify {
client := s.getClient()
isVerified, verificationErr := verifyMatch(ctx, client, email, password)
s1.Verified = isVerified
s1.SetVerificationError(verificationErr)
}
results = append(results, s1)
if s1.Verified {
// Once the email is verified, we can stop checking other passwords for it.
break
}
}
}
return results, nil
}
func verifyMatch(ctx context.Context, client *http.Client, email, pass string) (bool, error) {
// Reference: https://developer.dotdigital.com/reference/get-account-information
timeout := 10 * time.Second
client.Timeout = timeout
url := "https://r1-api.dotdigital.com/v2/account-info"
req, err := http.NewRequestWithContext(ctx, http.MethodGet, url, http.NoBody)
if err != nil {
return false, err
}
req.SetBasicAuth(email, pass)
res, err := client.Do(req)
if err != nil {
return false, err
}
defer func() {
_, _ = io.Copy(io.Discard, res.Body)
_ = res.Body.Close()
}()
switch res.StatusCode {
case http.StatusOK:
return true, nil
case http.StatusUnauthorized:
return false, nil
default:
return false, fmt.Errorf("unexpected status code: %d", res.StatusCode)
}
}
func (s Scanner) Type() detectorspb.DetectorType {
return detectorspb.DetectorType_Dotdigital
}
func (s Scanner) Description() string {
return "Dotdigital is an email marketing automation platform. API keys can be used to access and manage email campaigns and related data."
}
pkg/detectors/dotmailer/dotmailer_integration_test.go → pkg/detectors/dotdigital/dotdigital_integration_test.go
+28 -16
View File
@@ -1,7 +1,7 @@
//go:build detectors
// +build detectors
package dotmailer
package dotdigital
import (
"context"
@@ -9,23 +9,24 @@ import (
"testing"
"time"
"github.com/kylelemons/godebug/pretty"
"github.com/google/go-cmp/cmp"
"github.com/google/go-cmp/cmp/cmpopts"
"github.com/trufflesecurity/trufflehog/v3/pkg/detectors"
"github.com/trufflesecurity/trufflehog/v3/pkg/common"
"github.com/trufflesecurity/trufflehog/v3/pkg/pb/detectorspb"
)
func TestDotmailer_FromChunk(t *testing.T) {
func TestDotdigital_FromChunk(t *testing.T) {
ctx, cancel := context.WithTimeout(context.Background(), time.Second*5)
defer cancel()
testSecrets, err := common.GetSecret(ctx, "trufflehog-testing", "detectors1")
testSecrets, err := common.GetSecret(ctx, "trufflehog-testing", "detectors6")
if err != nil {
t.Fatalf("could not get test secrets from GCP: %s", err)
}
secret := testSecrets.MustGetField("DOTMAILER")
pass := testSecrets.MustGetField("DOTMAILER_PASS")
inactiveSecret := testSecrets.MustGetField("DOTMAILER_INACTIVE")
email := testSecrets.MustGetField("DOTDIGITAL_EMAIL")
password := testSecrets.MustGetField("DOTDIGITAL_PASSWORD")
inactivePassword := testSecrets.MustGetField("DOTDIGITAL_INACTIVE")
type args struct {
ctx context.Context
@@ -44,12 +45,12 @@ func TestDotmailer_FromChunk(t *testing.T) {
s: Scanner{},
args: args{
ctx: context.Background(),
data: []byte(fmt.Sprintf("You can find a dotmailer secret %s within dotmailer pass %s", secret, pass)),
data: []byte(fmt.Sprintf("You can find a dotdigital user %s within dotdigital pass %s", email, password)),
verify: true,
},
want: []detectors.Result{
{
DetectorType: detectorspb.DetectorType_Dotmailer,
DetectorType: detectorspb.DetectorType_Dotdigital,
Verified: true,
},
},
@@ -60,12 +61,12 @@ func TestDotmailer_FromChunk(t *testing.T) {
s: Scanner{},
args: args{
ctx: context.Background(),
data: []byte(fmt.Sprintf("You can find a dotmailer secret %s within dotmailer pass %s but not valid ", inactiveSecret, pass)), // the secret would satisfy the regex but not pass validation
data: []byte(fmt.Sprintf("You can find a dotdigital user %s within dotdigital pass %s but not valid ", email, inactivePassword)), // the secret would satisfy the regex but not pass validation
verify: true,
},
want: []detectors.Result{
{
DetectorType: detectorspb.DetectorType_Dotmailer,
DetectorType: detectorspb.DetectorType_Dotdigital,
Verified: false,
},
},
@@ -88,17 +89,28 @@ func TestDotmailer_FromChunk(t *testing.T) {
s := Scanner{}
got, err := s.FromData(tt.args.ctx, tt.args.verify, tt.args.data)
if (err != nil) != tt.wantErr {
t.Errorf("Dotmailer.FromData() error = %v, wantErr %v", err, tt.wantErr)
t.Errorf("Dotdigital.FromData() error = %v, wantErr %v", err, tt.wantErr)
return
}
for i := range got {
if len(got[i].Raw) == 0 {
t.Fatal("no raw secret present")
t.Fatalf("no raw secret present: \n %+v", got[i])
}
gotErr := ""
if got[i].VerificationError() != nil {
gotErr = got[i].VerificationError().Error()
}
wantErr := ""
if tt.want[i].VerificationError() != nil {
wantErr = tt.want[i].VerificationError().Error()
}
if gotErr != wantErr {
t.Fatalf("wantVerificationError = %v, verification error = %v", tt.want[i].VerificationError(), got[i].VerificationError())
}
got[i].Raw = nil
}
if diff := pretty.Compare(got, tt.want); diff != "" {
t.Errorf("Dotmailer.FromData() %s diff: (-got +want)\n%s", tt.name, diff)
ignoreOpts := cmpopts.IgnoreFields(detectors.Result{}, "Raw", "RawV2", "verificationError", "primarySecret")
if diff := cmp.Diff(got, tt.want, ignoreOpts); diff != "" {
t.Errorf("Dotdigital.FromData() %s diff: (-got +want)\n%s", tt.name, diff)
}
})
}
pkg/detectors/dotmailer/dotmailer_test.go → pkg/detectors/dotdigital/dotdigital_test.go
+5 -13
View File
@@ -1,4 +1,4 @@
package dotmailer
package dotdigital
import (
"context"
@@ -16,29 +16,21 @@ var (
database:
host: $DB_HOST
port: $DB_PORT
username: $DB_USERNAME
password: $DB_PASS # IMPORTANT: Do not share this password publicly
api:
auth_type: "Basic"
in: "Path"
api_version: v1
dotmailer_key: "apiuser-trq6zw9mmdlt@apiconnector@com"
dotmailer_secret: "N{w44mqa'2si(zY8"
dotdigital_email: "[email protected]"
dotdigital_password: "N{w44mqa'2si(zY8"
base_url: "https://api.example.com/$api_version/example"
response_code: 200
# Notes:
# - Remember to rotate the secret every 90 days.
# - The above credentials should only be used in a secure environment.
`
secrets = []string{
"apiuser-trq6zw9mmdlt@apiconnector@comN{w44mqa'2si(zY8",
"apiuser-trq6zw9mmdlt@apiconnector@comapiuser-trq6zw9mmdlt@",
}
secrets = []string{"[email protected]{w44mqa'2si(zY8"}
)
func TestDotMailer_Pattern(t *testing.T) {
func TestDotdigital_Pattern(t *testing.T) {
d := Scanner{}
ahoCorasickCore := ahocorasick.NewAhoCorasickCore([]detectors.Detector{d})
pkg/detectors/dotmailer/dotmailer.go
-84
View File
@@ -1,84 +0,0 @@
package dotmailer
import (
"context"
"net/http"
"strings"
"time"
regexp "github.com/wasilibs/go-re2"
"github.com/trufflesecurity/trufflehog/v3/pkg/common"
"github.com/trufflesecurity/trufflehog/v3/pkg/detectors"
"github.com/trufflesecurity/trufflehog/v3/pkg/pb/detectorspb"
)
type Scanner struct {
detectors.DefaultMultiPartCredentialProvider
}
// Ensure the Scanner satisfies the interface at compile time.
var _ detectors.Detector = (*Scanner)(nil)
var (
client = common.SaneHttpClient()
// Make sure that your group is surrounded in boundary characters such as below to reduce false positives.
keyPat = regexp.MustCompile(detectors.PrefixRegex([]string{"dotmailer"}) + `\b(apiuser-[a-z0-9]{12}@apiconnector.com)\b`)
passPat = regexp.MustCompile(detectors.PrefixRegex([]string{"dotmailer"}) + `\b([a-zA-Z0-9\S]{8,24})\b`)
)
// Keywords are used for efficiently pre-filtering chunks.
// Use identifiers in the secret preferably, or the provider name.
func (s Scanner) Keywords() []string {
return []string{"dotmailer"}
}
// FromData will find and optionally verify Dotmailer secrets in a given set of bytes.
func (s Scanner) FromData(ctx context.Context, verify bool, data []byte) (results []detectors.Result, err error) {
dataStr := string(data)
matches := keyPat.FindAllStringSubmatch(dataStr, -1)
passMatches := passPat.FindAllStringSubmatch(dataStr, -1)
for _, match := range matches {
resMatch := strings.TrimSpace(match[1])
for _, idMatch := range passMatches {
resPassMatch := strings.TrimSpace(idMatch[1])
s1 := detectors.Result{
DetectorType: detectorspb.DetectorType_Dotmailer,
Raw: []byte(resMatch),
RawV2: []byte(resMatch + resPassMatch),
}
if verify {
timeout := 10 * time.Second
client.Timeout = timeout
req, err := http.NewRequestWithContext(ctx, "GET", "https://r3-api.dotmailer.com/v2/account-info", nil)
if err != nil {
continue
}
req.SetBasicAuth(resMatch, resPassMatch)
res, err := client.Do(req)
if err == nil {
defer res.Body.Close()
if res.StatusCode >= 200 && res.StatusCode < 300 {
s1.Verified = true
}
}
}
results = append(results, s1)
}
}
return results, nil
}
func (s Scanner) Type() detectorspb.DetectorType {
return detectorspb.DetectorType_Dotmailer
}
func (s Scanner) Description() string {
return "Dotmailer is an email marketing automation platform. API keys can be used to access and manage email campaigns and related data."
}
pkg/engine/defaults/defaults.go
+2 -2
View File
@@ -237,7 +237,7 @@ import (
"github.com/trufflesecurity/trufflehog/v3/pkg/detectors/documo"
"github.com/trufflesecurity/trufflehog/v3/pkg/detectors/docusign"
"github.com/trufflesecurity/trufflehog/v3/pkg/detectors/doppler"
"github.com/trufflesecurity/trufflehog/v3/pkg/detectors/dotmailer"
"github.com/trufflesecurity/trufflehog/v3/pkg/detectors/dotdigital"
"github.com/trufflesecurity/trufflehog/v3/pkg/detectors/dovico"
"github.com/trufflesecurity/trufflehog/v3/pkg/detectors/dronahq"
"github.com/trufflesecurity/trufflehog/v3/pkg/detectors/droneci"
@@ -1101,7 +1101,7 @@ func buildDetectorList() []detectors.Detector {
&documo.Scanner{},
&docusign.Scanner{},
&doppler.Scanner{},
&dotmailer.Scanner{},
&dotdigital.Scanner{},
&dovico.Scanner{},
&dronahq.Scanner{},
&droneci.Scanner{},
pkg/pb/detectorspb/detectors.pb.go
+749 -749
View File
File diff suppressed because it is too large Load Diff
proto/detectors.proto
+1 -1
View File
@@ -335,7 +335,7 @@ enum DetectorType {
Appcues = 322;
Autoklose = 323;
Cloudplan = 324;
Dotmailer = 325;
Dotdigital = 325;
GetEmail = 326;
GetEmails = 327;
Kontent = 328;