trufflesecurity/trufflehog
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

[INS-241] Datadogapikey detector (#4627)

Browse Source 
* [INS-241] New detector (datadogapikey) for datadog apikeys

* Analyzer updated to cater endpoint

* Added new tests for anlyzers

* Removed print statement

* resolved comments and fixed integration tests.

* resolved comments

* changed cli prompt

* Fixed the comments and added app key validation in analyzer

* renamed regex variable

* Added found verified endpoint to ExtraData

* Clean up Analyze function by removing comments

Removed commented-out code for appKey and endpoint.

* [INS-286] Added support to analyze just the apikey in datadog's analyzer

* fixed linter issue

* fixed comment and introduced snake case to make analyzer code cosistent and also fixed flaky tests

* resolved bugbot comment

* updated protos

* resolve conflicts

* updated protobuffs and resolved bugbot comments

* made regex idiomatic

* fixed ssrf vulnerability

* fixed string formatting
This commit is contained in:
Muneeb Ullah Khan
2026-03-11 16:04:51 +05:00
committed by GitHub
parent 16d6dcf000
commit f9d1850dad
13 changed files with 1812 additions and 1063 deletions
Download Patch File Download Diff File Expand all files Collapse all files
pkg/analyzer/analyzers/datadog/datadog.go
+65 -18
View File
@@ -4,6 +4,7 @@ package datadog
import (
"errors"
"fmt"
"net/url"
"os"
"github.com/fatih/color"
@@ -26,47 +27,79 @@ func (a Analyzer) Type() analyzers.AnalyzerType {
// Analyze performs the analysis of the Datadog API key and returns the analyzer result.
func (a Analyzer) Analyze(ctx context.Context, credInfo map[string]string) (*analyzers.AnalyzerResult, error) {
apiKey, exist := credInfo["apiKey"]
if !exist {
return nil, errors.New("API key not found in credentials info")
}
apiKey := credInfo["api_key"]
appKey := credInfo["app_key"]
endpoint := credInfo["endpoint"]
// Get appKey if provided
appKey := credInfo["appKey"]
info, err := AnalyzePermissions(a.Cfg, apiKey, appKey)
info, err := AnalyzePermissions(a.Cfg, apiKey, appKey, endpoint)
if err != nil {
return nil, err
}
return secretInfoToAnalyzerResult(info), nil
}
func AnalyzeAndPrintPermissions(cfg *config.Config, apiKey string, appKey string) {
info, err := AnalyzePermissions(cfg, apiKey, appKey)
func AnalyzeAndPrintPermissions(cfg *config.Config, apiKey, appKey, endpoint string) {
info, err := AnalyzePermissions(cfg, apiKey, appKey, endpoint)
if err != nil {
// just print the error in cli and continue as a partial success
color.Red("[x] Error : %s", err.Error())
}
color.Green("[i] Valid Datadog API Key\n")
if info == nil {
color.Red("[x] No information retrieved")
return
}
color.Green("[i] Valid Datadog API Key\n")
printUser(info.User)
printResources(info.Resources)
printPermissions(info.Permissions)
}
// AnalyzePermissions will collect all the scopes assigned to token along with resource it can access
func AnalyzePermissions(cfg *config.Config, apiKey string, appKey string) (*SecretInfo, error) {
func AnalyzePermissions(cfg *config.Config, apiKey, appKey, endpoint string) (*SecretInfo, error) {
if apiKey == "" {
return nil, errors.New("api key not found in credentials info")
}
// create the http client
client := analyzers.NewAnalyzeClient(cfg)
var secretInfo = &SecretInfo{}
// First detect which DataDog domain works with this API key
baseURL, err := DetectDomain(client, apiKey, appKey)
if err != nil {
return nil, fmt.Errorf("[x] %v", err)
var baseURL string
var err error
// If endpoint is provided, use it directly; otherwise detect domain
if endpoint != "" {
baseURL, err = url.JoinPath(endpoint, "api")
if err != nil {
return nil, fmt.Errorf("failed to join path: %w", err)
}
} else {
baseURL, err = DetectDomain(client, apiKey, appKey)
if err != nil {
return nil, fmt.Errorf("[x] %v", err)
}
}
if appKey == "" {
// If no application key is provided, we can only validate the API key
if endpoint != "" {
// If endpoint is empty we don't need to validate again because DetectDomain would have already validated the API key against detected domain
// But if endpoint is provided, we should validate the API key against the provided endpoint to ensure it's valid before proceeding
isValidApiKey, err := ValidateApiKey(client, baseURL, apiKey)
if err != nil {
return nil, fmt.Errorf("failed to validate api key: %v", err)
}
if !isValidApiKey {
return nil, errors.New("invalid api key provided")
}
}
if err := CaptureApiKeyPermissions(secretInfo); err != nil {
return nil, fmt.Errorf("failed to fetch permissions: %v", err)
}
return secretInfo, nil
}
// capture user information in secretInfo
@@ -85,6 +118,10 @@ func AnalyzePermissions(cfg *config.Config, apiKey string, appKey string) (*Secr
return nil, fmt.Errorf("failed to fetch permissions: %v", err)
}
// Capture API key permissions
if err := CaptureApiKeyPermissions(secretInfo); err != nil {
return nil, fmt.Errorf("failed to fetch permissions: %v", err)
}
return secretInfo, nil
}
@@ -114,7 +151,17 @@ func secretInfoToAnalyzerResult(info *SecretInfo) *analyzers.AnalyzerResult {
}
permissionBindings := secretInfoPermissionsToAnalyzerPermission(info.Permissions)
result.Bindings = analyzers.BindAllPermissions(*userResource, *permissionBindings...)
if userResource != nil && len(*permissionBindings) > 0 {
result.Bindings = analyzers.BindAllPermissions(*userResource, *permissionBindings...)
}
if userResource == nil && len(*permissionBindings) > 0 {
result.Bindings = analyzers.BindAllPermissions(analyzers.Resource{
FullyQualifiedName: "Unknown User",
Name: "Unknown User",
Type: "User",
Metadata: map[string]any{},
}, *permissionBindings...)
}
// Extract information from resources to create bindings
for _, resource := range info.Resources {
pkg/analyzer/analyzers/datadog/datadog_test.go
+110 -8
View File
@@ -17,6 +17,9 @@ import (
//go:embed expected_output.json
var expectedOutput []byte
//go:embed expected_output_apikey.json
var expectedOutputAPIKey []byte
func TestAnalyzer_Analyze(t *testing.T) {
ctx, cancel := context.WithTimeout(context.Background(), time.Minute*2)
defer cancel()
@@ -38,11 +41,12 @@ func TestAnalyzer_Analyze(t *testing.T) {
}
tests := []struct {
name string
apiKey string
appKey string
want []byte // JSON string
wantErr bool
name string
apiKey string
appKey string
endpoint string
want []byte // JSON string
wantErr bool
}{
{
name: "valid datadog credentials",
@@ -51,6 +55,27 @@ func TestAnalyzer_Analyze(t *testing.T) {
want: expectedOutput,
wantErr: false,
},
{
name: "valid datadog credentials with endpoint",
apiKey: apiKey,
appKey: appKey,
endpoint: "https://api.us5.datadoghq.com",
want: expectedOutput,
wantErr: false,
},
{
name: "valid datadog credentials with invalid endpoint",
apiKey: apiKey,
appKey: appKey,
endpoint: "https://api.eu.datadoghq.com",
want: []byte(fmt.Sprintf(`{
"AnalyzerType": %d,
"Bindings": [],
"UnboundedResources": null,
"Metadata": {}
}`, analyzers.AnalyzerTypeDatadog)),
wantErr: true,
},
{
name: "invalid credentials",
apiKey: "invalid_api_key",
@@ -63,7 +88,7 @@ func TestAnalyzer_Analyze(t *testing.T) {
for _, tt := range tests {
t.Run(tt.name, func(t *testing.T) {
a := Analyzer{Cfg: &config.Config{}}
got, err := a.Analyze(ctx, map[string]string{"apiKey": tt.apiKey, "appKey": tt.appKey})
got, err := a.Analyze(ctx, map[string]string{"api_key": tt.apiKey, "app_key": tt.appKey, "endpoint": tt.endpoint})
if (err != nil) != tt.wantErr {
t.Errorf("Analyzer.Analyze() error = %v, wantErr %v", err, tt.wantErr)
@@ -96,8 +121,6 @@ func TestAnalyzer_Analyze(t *testing.T) {
t.Fatalf("could not marshal got to JSON: %s", err)
}
fmt.Println(string(gotJSON))
// Parse the expected JSON string
var wantObj analyzers.AnalyzerResult
if err := json.Unmarshal(tt.want, &wantObj); err != nil {
@@ -131,6 +154,85 @@ func TestAnalyzer_Analyze(t *testing.T) {
}
}
func TestAnalyzer_Analyze_ApiKeyOnly(t *testing.T) {
ctx, cancel := context.WithTimeout(context.Background(), time.Minute*2)
defer cancel()
// Get API keys from GCP
var apiKey string
testSecrets, err := common.GetSecret(ctx, "trufflehog-testing", "analyzers1")
if err != nil {
t.Fatalf("Could not get test secrets from GCP: %s", err)
}
// Get the required credentials
apiKey = testSecrets.MustGetField("DATADOG_API_KEY")
// Fail if credentials are not available
if apiKey == "" {
t.Fatalf("Datadog credentials are required for this test")
}
want := expectedOutputAPIKey
a := Analyzer{Cfg: &config.Config{}}
got, err := a.Analyze(ctx, map[string]string{"api_key": apiKey, "endpoint": "https://api.us5.datadoghq.com"})
if err != nil {
t.Errorf("Analyzer.Analyze() error = %v, wantErr %v", err, false)
return
}
// For valid cases, verify we got a result
if got == nil {
t.Errorf("Analyzer.Analyze() = nil, want non-nil")
return
}
// Verify type is correct
if got.AnalyzerType != analyzers.AnalyzerTypeDatadog {
t.Errorf("Analyzer.Analyze() returned wrong analyzer type, got %d want %d",
got.AnalyzerType, analyzers.AnalyzerTypeDatadog)
}
// Bindings need to be in the same order to be comparable
sortBindings(got.Bindings)
// Marshal the actual result to JSON
gotJSON, err := json.Marshal(got)
if err != nil {
t.Fatalf("could not marshal got to JSON: %s", err)
}
// Parse the expected JSON string
var wantObj analyzers.AnalyzerResult
if err := json.Unmarshal(want, &wantObj); err != nil {
t.Fatalf("could not unmarshal want JSON string: %s", err)
}
// Bindings need to be in the same order to be comparable
sortBindings(wantObj.Bindings)
// Marshal the expected result to JSON (to normalize)
wantJSON, err := json.Marshal(wantObj)
if err != nil {
t.Fatalf("could not marshal want to JSON: %s", err)
}
// Compare the JSON strings
if string(gotJSON) != string(wantJSON) {
// Pretty-print both JSON strings for easier comparison
var gotIndented, wantIndented []byte
gotIndented, err = json.MarshalIndent(got, "", " ")
if err != nil {
t.Fatalf("could not marshal got to indented JSON: %s", err)
}
wantIndented, err = json.MarshalIndent(wantObj, "", " ")
if err != nil {
t.Fatalf("could not marshal want to indented JSON: %s", err)
}
t.Errorf("Analyzer.Analyze() = %s, want %s", gotIndented, wantIndented)
}
}
// Helper function to sort bindings
func sortBindings(bindings []analyzers.Binding) {
sort.SliceStable(bindings, func(i, j int) bool {
pkg/analyzer/analyzers/datadog/expected_output.json
+1100 -1018
View File
File diff suppressed because it is too large Load Diff
pkg/analyzer/analyzers/datadog/expected_output_apikey.json
+63
View File
@@ -0,0 +1,63 @@
{
"AnalyzerType": 37,
"Bindings": [
{
"Resource": {
"Name": "Unknown User",
"FullyQualifiedName": "Unknown User",
"Type": "User",
"Metadata": {},
"Parent": null
},
"Permission": {
"Value": "Submit Events",
"Parent": null
},
"Condition": ""
},
{
"Resource": {
"Name": "Unknown User",
"FullyQualifiedName": "Unknown User",
"Type": "User",
"Metadata": {},
"Parent": null
},
"Permission": {
"Value": "Submit Logs",
"Parent": null
},
"Condition": ""
},
{
"Resource": {
"Name": "Unknown User",
"FullyQualifiedName": "Unknown User",
"Type": "User",
"Metadata": {},
"Parent": null
},
"Permission": {
"Value": "Submit Metrics",
"Parent": null
},
"Condition": ""
},
{
"Resource": {
"Name": "Unknown User",
"FullyQualifiedName": "Unknown User",
"Type": "User",
"Metadata": {},
"Parent": null
},
"Permission": {
"Value": "Submit Service Checks",
"Parent": null
},
"Condition": ""
}
],
"UnboundedResources": null,
"Metadata": {}
}
pkg/analyzer/analyzers/datadog/requests.go
+84 -9
View File
@@ -8,6 +8,7 @@ import (
"fmt"
"io"
"net/http"
"net/url"
"slices"
"strconv"
"sync"
@@ -119,7 +120,11 @@ func makeDataDogRequest(client *http.Client, baseURL, endpoint, method, apiKey s
defer cancel()
// create request
req, err := http.NewRequestWithContext(ctx, method, baseURL+endpoint, http.NoBody)
url, err := url.JoinPath(baseURL, endpoint)
if err != nil {
return nil, 0, fmt.Errorf("failed to build URL: %w", err)
}
req, err := http.NewRequestWithContext(ctx, method, url, http.NoBody)
if err != nil {
return nil, 0, err
}
@@ -172,6 +177,49 @@ func (h *HttpStatusTest) RunTest(client *http.Client, baseURL string, headers ma
}
}
// --------------------------------
// Validate ApiKey
// --------------------------------
func ValidateApiKey(client *http.Client, baseURL, apiKey string) (bool, error) {
// Use a simple endpoint to test if the domain works
endpoint, err := url.JoinPath(baseURL, endpoints[ResourceTypeValidate])
if err != nil {
return false, fmt.Errorf("failed to build endpoint: %w", err)
}
ctx, cancel := context.WithTimeout(context.Background(), defaultTimeout)
defer cancel()
// Create request
req, err := http.NewRequestWithContext(ctx, "GET", endpoint, http.NoBody)
if err != nil {
return false, err
}
// Add required keys in the header
req.Header.Set(apiKeyHeader, apiKey)
resp, err := client.Do(req)
if err != nil {
return false, err
}
defer func() {
_, _ = io.Copy(io.Discard, resp.Body)
_ = resp.Body.Close()
}()
// If we get a response that's not a connection error, this domain works
switch resp.StatusCode {
case http.StatusOK:
return true, nil
case http.StatusForbidden:
return false, nil
default:
return false, fmt.Errorf("Unable to validate api key with status code: %d", resp.StatusCode)
}
}
// --------------------------------
// Data capture functions
// --------------------------------
@@ -238,16 +286,44 @@ func CapturePermissions(client *http.Client, baseURL, apiKey, appKey string, sec
}
for _, scope := range scopes {
status, err := scope.HttpTest.RunTest(client, baseURL, headers)
if err != nil {
return fmt.Errorf("running test for scope %s: %w", scope.Name, err)
}
if scope.HttpTest.Endpoint != "" {
status, err := scope.HttpTest.RunTest(client, baseURL, headers)
if err != nil {
return fmt.Errorf("running test for scope %s: %w", scope.Name, err)
}
metadata := map[string]string{
"Resource": scope.Resource,
}
if status {
permission := Permission{
Name: scope.Name,
Title: scope.Title,
Description: scope.Description,
MetaData: metadata,
}
permissions = append(permissions, permission)
}
}
}
secretInfo.Permissions = permissions
return nil
}
// API key is not finely grained, so we assign some default permissions
func CaptureApiKeyPermissions(secretInfo *SecretInfo) error {
scopes, err := readInScopes()
if err != nil {
return fmt.Errorf("reading in scopes: %w", err)
}
permissions := make([]Permission, 0)
for _, scope := range scopes {
metadata := map[string]string{
"Resource": scope.Resource,
}
if status {
if scope.HttpTest.Endpoint == "" {
permission := Permission{
Name: scope.Name,
Title: scope.Title,
@@ -257,8 +333,7 @@ func CapturePermissions(client *http.Client, baseURL, apiKey, appKey string, sec
permissions = append(permissions, permission)
}
}
secretInfo.Permissions = permissions
secretInfo.Permissions = append(secretInfo.Permissions, permissions...)
return nil
}
pkg/analyzer/analyzers/datadog/scopes.json
+24
View File
@@ -814,5 +814,29 @@
"valid_statuses": [400, 404, 429],
"invalid_statuses": [403]
}
},
{
"name": "metrics_write",
"title": "Submit Metrics",
"description": "Submit custom metrics to Datadog.",
"resource": "Metrics"
},
{
"name": "logs_write",
"title": "Submit Logs",
"description": "Send logs to Datadog for indexing and processing.",
"resource": "Logs"
},
{
"name": "events_write",
"title": "Submit Events",
"description": "Post events to the Datadog event stream.",
"resource": "Events"
},
{
"name": "service_checks_write",
"title": "Submit Service Checks",
"description": "Send service check statuses to Datadog.",
"resource": "Service Checks"
}
]
pkg/analyzer/cli.go
+1 -1
View File
@@ -138,7 +138,7 @@ func Run(keyType string, secretInfo SecretInfo) {
case "monday":
monday.AnalyzeAndPrintPermissions(secretInfo.Cfg, secretInfo.Parts["key"])
case "datadog":
datadog.AnalyzeAndPrintPermissions(secretInfo.Cfg, secretInfo.Parts["apiKey"], secretInfo.Parts["appKey"])
datadog.AnalyzeAndPrintPermissions(secretInfo.Cfg, secretInfo.Parts["api_key"], secretInfo.Parts["app_key"], secretInfo.Parts["endpoint"])
case "ngrok":
ngrok.AnalyzeAndPrintPermissions(secretInfo.Cfg, secretInfo.Parts["key"])
case "mux":
pkg/detectors/datadogapikey/datadogapikey.go
+126
View File
@@ -0,0 +1,126 @@
package datadogapikey
import (
"context"
"fmt"
"io"
"net/http"
"strings"
"github.com/trufflesecurity/trufflehog/v3/pkg/common"
"github.com/trufflesecurity/trufflehog/v3/pkg/detectors"
"github.com/trufflesecurity/trufflehog/v3/pkg/pb/detectorspb"
regexp "github.com/wasilibs/go-re2"
)
type Scanner struct {
client *http.Client
detectors.EndpointSetter
detectors.DefaultMultiPartCredentialProvider
}
// Ensure the Scanner satisfies the interface at compile time.
var _ detectors.Detector = (*Scanner)(nil)
var _ detectors.EndpointCustomizer = (*Scanner)(nil)
var _ detectors.CloudProvider = (*Scanner)(nil)
func (Scanner) CloudEndpoint() string { return "https://api.datadoghq.com" }
var (
client = common.SaneHttpClient()
// Make sure that your group is surrounded in boundary characters such as below to reduce false positives.
apiKeyPat = regexp.MustCompile(detectors.PrefixRegex([]string{"datadog", "dd"}) + `\b([a-zA-Z0-9-]{32})\b`)
datadogURLPat = regexp.MustCompile(`\b(api(?:\.[a-z0-9-]+)?\.(?:datadoghq|ddog-gov)\.(com|eu))\b`)
)
// Keywords are used for efficiently pre-filtering chunks.
// Use identifiers in the secret preferably, or the provider name.
func (s Scanner) Keywords() []string {
return []string{"datadog", "ddog-gov"}
}
func (s Scanner) getClient() *http.Client {
if s.client != nil {
return s.client
}
return client
}
// FromData will find and optionally verify DatadogToken secrets in a given set of bytes.
func (s Scanner) FromData(ctx context.Context, verify bool, data []byte) (results []detectors.Result, err error) {
dataStr := string(data)
apiMatches := apiKeyPat.FindAllStringSubmatch(dataStr, -1)
var uniqueFoundUrls = make(map[string]struct{})
for _, matches := range datadogURLPat.FindAllStringSubmatch(dataStr, -1) {
uniqueFoundUrls[matches[1]] = struct{}{}
}
endpoints := make([]string, 0, len(uniqueFoundUrls))
for endpoint := range uniqueFoundUrls {
endpoints = append(endpoints, "https://"+endpoint)
}
for _, apiMatch := range apiMatches {
resApiMatch := strings.TrimSpace(apiMatch[1])
s1 := detectors.Result{
DetectorType: detectorspb.DetectorType_DatadogApikey,
Raw: []byte(resApiMatch),
}
if verify {
for _, baseURL := range s.Endpoints(endpoints...) {
client := s.getClient()
isVerified, verificationErr := verifyMatch(ctx, client, resApiMatch, baseURL)
if isVerified {
s1.Verified = isVerified
s1.AnalysisInfo = map[string]string{"api_key": resApiMatch, "endpoint": baseURL}
// break the loop once we've successfully validated the token against a baseURL
break
}
s1.SetVerificationError(verificationErr, resApiMatch)
}
}
results = append(results, s1)
}
return results, nil
}
func verifyMatch(ctx context.Context, client *http.Client, apiKey, baseUrl string) (bool, error) {
// Reference: https://docs.datadoghq.com/api/latest/authentication/
req, err := http.NewRequestWithContext(ctx, http.MethodGet, baseUrl+"/api/v1/validate", http.NoBody)
if err != nil {
return false, err
}
req.Header.Add("DD-API-KEY", apiKey)
res, err := client.Do(req)
if err != nil {
return false, err
}
defer func() {
_, _ = io.Copy(io.Discard, res.Body)
_ = res.Body.Close()
}()
switch res.StatusCode {
case http.StatusOK:
return true, nil
case http.StatusForbidden:
return false, nil
case http.StatusTooManyRequests:
return false, fmt.Errorf("too many requests")
default:
return false, fmt.Errorf("unexpected status code: %d", res.StatusCode)
}
}
func (s Scanner) Type() detectorspb.DetectorType {
return detectorspb.DetectorType_DatadogApikey
}
func (s Scanner) Description() string {
return "Datadog is a monitoring and security platform for cloud applications. Datadog API and Application keys can be used to access and manage data and configurations within Datadog."
}
pkg/detectors/datadogapikey/datadogapikey_integration_test.go
+126
View File
@@ -0,0 +1,126 @@
//go:build detectors
// +build detectors
package datadogapikey
import (
"context"
"fmt"
"testing"
"time"
"github.com/kylelemons/godebug/pretty"
"github.com/trufflesecurity/trufflehog/v3/pkg/detectors"
"github.com/trufflesecurity/trufflehog/v3/pkg/common"
"github.com/trufflesecurity/trufflehog/v3/pkg/pb/detectorspb"
)
func TestDataDogApiKey_FromChunk(t *testing.T) {
ctx, cancel := context.WithTimeout(context.Background(), time.Second*5)
defer cancel()
testSecrets, err := common.GetSecret(ctx, "trufflehog-testing", "detectors5")
if err != nil {
t.Fatalf("could not get test secrets from GCP: %s", err)
}
apiKey := testSecrets.MustGetField("DATADOGTOKEN_TOKEN")
invalidApiKey := "FKNwdbyfYTmGUm5DK3yHEuK-BBQf0fVG"
datdogEndpoint := "https://api.us5.datadoghq.com"
type args struct {
ctx context.Context
data []byte
verify bool
}
tests := []struct {
name string
s Scanner
args args
want []detectors.Result
wantErr bool
}{
{
name: "found, verified",
s: Scanner{},
args: args{
ctx: context.Background(),
data: []byte(fmt.Sprintf("You can find a datadogtoken secret within datadog %s and endpoint is %v", apiKey, datdogEndpoint)),
verify: true,
},
want: []detectors.Result{
{
DetectorType: detectorspb.DetectorType_DatadogApikey,
Verified: true,
AnalysisInfo: map[string]string{
"api_key": apiKey,
"endpoint": datdogEndpoint,
},
Raw: []byte(apiKey),
},
},
wantErr: false,
},
{
name: "found, unverified",
s: Scanner{},
args: args{
ctx: context.Background(),
data: []byte(fmt.Sprintf("You can find a datadogtoken secret within datadog %s and endpoint is %v", invalidApiKey, datdogEndpoint)),
verify: true,
},
want: []detectors.Result{
{
DetectorType: detectorspb.DetectorType_DatadogApikey,
Verified: false,
Raw: []byte(invalidApiKey),
},
},
wantErr: false,
},
{
name: "not found",
s: Scanner{},
args: args{
ctx: context.Background(),
data: []byte("You cannot find the secret within"),
verify: true,
},
want: nil,
wantErr: false,
},
}
for _, tt := range tests {
t.Run(tt.name, func(t *testing.T) {
s := Scanner{}
// use default cloud endpoint
s.UseCloudEndpoint(true)
s.SetCloudEndpoint(s.CloudEndpoint())
s.UseFoundEndpoints(true)
got, err := s.FromData(tt.args.ctx, tt.args.verify, tt.args.data)
if (err != nil) != tt.wantErr {
t.Errorf("DatadogToken.FromData() error = %v, wantErr %v", err, tt.wantErr)
return
}
if diff := pretty.Compare(got, tt.want); diff != "" {
t.Errorf("DatadogToken.FromData() %s diff: (-got +want)\n%s", tt.name, diff)
}
})
}
}
func BenchmarkFromData(benchmark *testing.B) {
ctx := context.Background()
s := Scanner{}
for name, data := range detectors.MustGetBenchmarkData() {
benchmark.Run(name, func(b *testing.B) {
b.ResetTimer()
for n := 0; n < b.N; n++ {
_, err := s.FromData(ctx, false, data)
if err != nil {
b.Fatal(err)
}
}
})
}
}
pkg/detectors/datadogapikey/datadogapikey_test.go
+94
View File
@@ -0,0 +1,94 @@
package datadogapikey
import (
"context"
"testing"
"github.com/google/go-cmp/cmp"
"github.com/google/go-cmp/cmp/cmpopts"
"github.com/trufflesecurity/trufflehog/v3/pkg/detectors"
"github.com/trufflesecurity/trufflehog/v3/pkg/engine/ahocorasick"
"github.com/trufflesecurity/trufflehog/v3/pkg/pb/detectorspb"
)
func TestDataDogApiKey_Pattern_WithValidAPIKey(t *testing.T) {
d := Scanner{}
ahoCorasickCore := ahocorasick.NewAhoCorasickCore([]detectors.Detector{d})
input := `
dd_api_secret: "FKNwdbyfYTmGUm5DK3yHEuK-BBQf0fVG"
dd_app: "iHxNanzZ8vjrmbjXK7NJLrwpGw2czdSh90PKH6VL"
base_url1: "https://api.us5.datadoghq.com"
base_url2: "https://api.app.ddog-gov.com"
`
apiKey := "FKNwdbyfYTmGUm5DK3yHEuK-BBQf0fVG"
wantedResult := []detectors.Result{
{
DetectorType: detectorspb.DetectorType_DatadogApikey,
Raw: []byte(apiKey),
},
}
matchedDetectors := ahoCorasickCore.FindDetectorMatches([]byte(input))
if len(matchedDetectors) == 0 {
t.Errorf("keywords '%v' not matched by: %s", d.Keywords(), input)
return
}
results, err := d.FromData(context.Background(), false, []byte(input))
if err != nil {
t.Errorf("error = %v", err)
return
}
if diff := cmp.Diff(wantedResult, results, cmpopts.IgnoreFields(detectors.Result{}, "verificationError", "primarySecret")); diff != "" {
t.Errorf("%s diff: (-want +got)\n%s", "TestDataDogApiKey_Pattern_WithValidAPIKeyOnly", diff)
}
}
func TestDataDogApiKey_NoSecrets(t *testing.T) {
d := Scanner{}
ahoCorasickCore := ahocorasick.NewAhoCorasickCore([]detectors.Detector{d})
input := `
base_url1: "https://api.us5.datadoghq.com"
base_url2: "https://api.app.ddog-gov.com"
`
matchedDetectors := ahoCorasickCore.FindDetectorMatches([]byte(input))
if len(matchedDetectors) == 0 {
t.Errorf("keywords '%v' not matched by: %s", d.Keywords(), input)
return
}
results, err := d.FromData(context.Background(), false, []byte(input))
if err != nil {
t.Errorf("error = %v", err)
return
}
if len(results) != 0 {
t.Errorf("expected 0 results, received %d", len(results))
}
}
func TestDataDogApiKey_InvalidSecrets(t *testing.T) {
d := Scanner{}
ahoCorasickCore := ahocorasick.NewAhoCorasickCore([]detectors.Detector{d})
input := `
dd_api_secret: "@FKNwdbyfYTmGUm5DK3yHEuK"
dd_app: "iHxNanzZ8vjrmbjXK7NJLrwpGw2czdSh90PKH6VL"
base_url1: "https://api.us5.datadoghq.com"
base_url2: "https://api.app.ddog-gov.com"
`
matchedDetectors := ahoCorasickCore.FindDetectorMatches([]byte(input))
if len(matchedDetectors) == 0 {
t.Errorf("keywords '%v' not matched by: %s", d.Keywords(), input)
return
}
results, err := d.FromData(context.Background(), false, []byte(input))
if err != nil {
t.Errorf("error = %v", err)
return
}
if len(results) != 0 {
t.Errorf("expected 0 results, received %d", len(results))
}
}
pkg/pb/detectorspb/detectors.pb.go
+11 -6
View File
@@ -1149,6 +1149,7 @@ const (
DetectorType_OpenAIAdmin DetectorType = 1040
DetectorType_GoogleGeminiAPIKey DetectorType = 1041
DetectorType_ArtifactoryReferenceToken DetectorType = 1042
DetectorType_DatadogApikey DetectorType = 1043
)
// Enum value maps for DetectorType.
@@ -2193,6 +2194,7 @@ var (
1040: "OpenAIAdmin",
1041: "GoogleGeminiAPIKey",
1042: "ArtifactoryReferenceToken",
1043: "DatadogApikey",
}
DetectorType_value = map[string]int32{
"Alibaba": 0,
@@ -3234,6 +3236,7 @@ var (
"OpenAIAdmin": 1040,
"GoogleGeminiAPIKey": 1041,
"ArtifactoryReferenceToken": 1042,
"DatadogApikey": 1043,
}
)
@@ -3687,7 +3690,7 @@ var file_detectors_proto_rawDesc = []byte{
0x4c, 0x41, 0x49, 0x4e, 0x10, 0x01, 0x12, 0x0a, 0x0a, 0x06, 0x42, 0x41, 0x53, 0x45, 0x36, 0x34,
0x10, 0x02, 0x12, 0x09, 0x0a, 0x05, 0x55, 0x54, 0x46, 0x31, 0x36, 0x10, 0x03, 0x12, 0x13, 0x0a,
0x0f, 0x45, 0x53, 0x43, 0x41, 0x50, 0x45, 0x44, 0x5f, 0x55, 0x4e, 0x49, 0x43, 0x4f, 0x44, 0x45,
0x10, 0x04, 0x2a, 0x90, 0x87, 0x01, 0x0a, 0x0c, 0x44, 0x65, 0x74, 0x65, 0x63, 0x74, 0x6f, 0x72,
0x10, 0x04, 0x2a, 0xa4, 0x87, 0x01, 0x0a, 0x0c, 0x44, 0x65, 0x74, 0x65, 0x63, 0x74, 0x6f, 0x72,
0x54, 0x79, 0x70, 0x65, 0x12, 0x0b, 0x0a, 0x07, 0x41, 0x6c, 0x69, 0x62, 0x61, 0x62, 0x61, 0x10,
0x00, 0x12, 0x08, 0x0a, 0x04, 0x41, 0x4d, 0x51, 0x50, 0x10, 0x01, 0x12, 0x07, 0x0a, 0x03, 0x41,
0x57, 0x53, 0x10, 0x02, 0x12, 0x09, 0x0a, 0x05, 0x41, 0x7a, 0x75, 0x72, 0x65, 0x10, 0x03, 0x12,
@@ -4768,11 +4771,13 @@ var file_detectors_proto_rawDesc = []byte{
0x12, 0x47, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x47, 0x65, 0x6d, 0x69, 0x6e, 0x69, 0x41, 0x50, 0x49,
0x4b, 0x65, 0x79, 0x10, 0x91, 0x08, 0x12, 0x1e, 0x0a, 0x19, 0x41, 0x72, 0x74, 0x69, 0x66, 0x61,
0x63, 0x74, 0x6f, 0x72, 0x79, 0x52, 0x65, 0x66, 0x65, 0x72, 0x65, 0x6e, 0x63, 0x65, 0x54, 0x6f,
0x6b, 0x65, 0x6e, 0x10, 0x92, 0x08, 0x42, 0x3d, 0x5a, 0x3b, 0x67, 0x69, 0x74, 0x68, 0x75, 0x62,
0x2e, 0x63, 0x6f, 0x6d, 0x2f, 0x74, 0x72, 0x75, 0x66, 0x66, 0x6c, 0x65, 0x73, 0x65, 0x63, 0x75,
0x72, 0x69, 0x74, 0x79, 0x2f, 0x74, 0x72, 0x75, 0x66, 0x66, 0x6c, 0x65, 0x68, 0x6f, 0x67, 0x2f,
0x76, 0x33, 0x2f, 0x70, 0x6b, 0x67, 0x2f, 0x70, 0x62, 0x2f, 0x64, 0x65, 0x74, 0x65, 0x63, 0x74,
0x6f, 0x72, 0x73, 0x70, 0x62, 0x62, 0x06, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x33,
0x6b, 0x65, 0x6e, 0x10, 0x92, 0x08, 0x12, 0x12, 0x0a, 0x0d, 0x44, 0x61, 0x74, 0x61, 0x64, 0x6f,
0x67, 0x41, 0x70, 0x69, 0x6b, 0x65, 0x79, 0x10, 0x93, 0x08, 0x42, 0x3d, 0x5a, 0x3b, 0x67, 0x69,
0x74, 0x68, 0x75, 0x62, 0x2e, 0x63, 0x6f, 0x6d, 0x2f, 0x74, 0x72, 0x75, 0x66, 0x66, 0x6c, 0x65,
0x73, 0x65, 0x63, 0x75, 0x72, 0x69, 0x74, 0x79, 0x2f, 0x74, 0x72, 0x75, 0x66, 0x66, 0x6c, 0x65,
0x68, 0x6f, 0x67, 0x2f, 0x76, 0x33, 0x2f, 0x70, 0x6b, 0x67, 0x2f, 0x70, 0x62, 0x2f, 0x64, 0x65,
0x74, 0x65, 0x63, 0x74, 0x6f, 0x72, 0x73, 0x70, 0x62, 0x62, 0x06, 0x70, 0x72, 0x6f, 0x74, 0x6f,
0x33,
}
var (
pkg/tui/pages/analyze_form/analyze_form.go
+7 -3
View File
@@ -98,14 +98,18 @@ func New(c common.Common, keyType string) *AnalyzeForm {
case "datadog":
inputs = []textinputs.InputConfig{{
Label: "API Key",
Key: "apiKey",
Key: "api_key",
Required: true,
RedactInput: true,
}, {
Label: "Application Key",
Key: "appKey",
Required: true,
Key: "app_key",
Required: false,
RedactInput: true,
}, {
Label: "Endpoint (press Enter to skip if unknown; TruffleHog will attempt to auto-detect)",
Key: "endpoint",
Required: false,
}}
case "mux":
inputs = []textinputs.InputConfig{{
proto/detectors.proto
+1
View File
@@ -1052,6 +1052,7 @@ enum DetectorType {
OpenAIAdmin = 1040;
GoogleGeminiAPIKey = 1041;
ArtifactoryReferenceToken = 1042;
DatadogApikey = 1043;
}
message Result {