[Feature] Added SonarQube Cloud "Scoped Organization Token" Detector (#4739)

* added sonarqube cloud scoped organization token detector

* fixed extra data version key in v1 detector; added build tags in v2 integration test

* added new detector versions to defaults file

* deleted leftover file

* fixed tests

* handle 403 during verification

* feat(sonarcloud): gate v2 detector behind feature flag

* Use format-compliant dummy org key in SonarCloud v2 verification

* tighten org id

* give up and add 200 status code in case someone creates an org with the dummy org id we are using

---------

Co-authored-by: Shahzad Haider <[email protected]>
Co-authored-by: Shahzad Haider <[email protected]>
Co-authored-by: Claude Sonnet 4.6 <[email protected]>

main.go

@@ -542,6 +542,7 @@ func run(state overseer.State, logSync func() error) {
 	feature.PineconeDetectorEnabled.Store(true)
 	feature.CloudinaryDetectorEnabled.Store(true)
 	feature.GitLabOAuthDetectorEnabled.Store(true)
+	feature.SonarCloudV2DetectorEnabled.Store(true)
 	feature.EnigmaDetectorEnabled.Store(true)
 	feature.DatadogApiKeyDetectorEnabled.Store(true)
 	feature.TlyDetectorEnabled.Store(true)

pkg/detectors/sonarcloud/v1/sonarcloud.go

@@ -20,6 +20,9 @@ type Scanner struct {
 
 // Ensure the Scanner satisfies the interface at compile time.
 var _ detectors.Detector = (*Scanner)(nil)
+var _ detectors.Versioner = (*Scanner)(nil)
+
+func (Scanner) Version() int { return 1 }
 
 var (
 	defaultClient = common.SaneHttpClient()
@@ -56,6 +59,9 @@ func (s Scanner) FromData(ctx context.Context, verify bool, data []byte) (result
 			DetectorType: detector_typepb.DetectorType_SonarCloud,
 			Raw:          []byte(match),
 			SecretParts:  map[string]string{"key": match},
+			ExtraData: map[string]string{
+				"version": fmt.Sprintf("%d", s.Version()),
+			},
 		}
 
 		if verify {

pkg/detectors/sonarcloud/v1/sonarcloud_integration_test.go

@@ -19,7 +19,7 @@ import (
 func TestSonarCloud_FromChunk(t *testing.T) {
 	ctx, cancel := context.WithTimeout(context.Background(), time.Second*5)
 	defer cancel()
-	testSecrets, err := common.GetSecret(ctx, "trufflehog-testing", "detectors3")
+	testSecrets, err := common.GetSecret(ctx, "trufflehog-testing", "detectors6")
 	if err != nil {
 		t.Fatalf("could not get test secrets from GCP: %s", err)
 	}
@@ -50,6 +50,12 @@ func TestSonarCloud_FromChunk(t *testing.T) {
 				{
 					DetectorType: detector_typepb.DetectorType_SonarCloud,
 					Verified:     true,
+					ExtraData: map[string]string{
+						"version": "1",
+					},
+					SecretParts: map[string]string{
+						"key": secret,
+					},
 				},
 			},
 			wantErr: false,
@@ -66,6 +72,12 @@ func TestSonarCloud_FromChunk(t *testing.T) {
 				{
 					DetectorType: detector_typepb.DetectorType_SonarCloud,
 					Verified:     false,
+					ExtraData: map[string]string{
+						"version": "1",
+					},
+					SecretParts: map[string]string{
+						"key": inactiveSecret,
+					},
 				},
 			},
 			wantErr: false,

pkg/detectors/sonarcloud/v2/sonarcloud.go

@@ -0,0 +1,124 @@
+package sonarcloud
+
+import (
+	"context"
+	"fmt"
+	"io"
+	"net/http"
+
+	regexp "github.com/wasilibs/go-re2"
+
+	"github.com/trufflesecurity/trufflehog/v3/pkg/common"
+	"github.com/trufflesecurity/trufflehog/v3/pkg/detectors"
+	"github.com/trufflesecurity/trufflehog/v3/pkg/pb/detector_typepb"
+)
+
+type Scanner struct {
+	client *http.Client
+}
+
+// Ensure the Scanner satisfies the interface at compile time.
+var _ detectors.Detector = (*Scanner)(nil)
+var _ detectors.Versioner = (*Scanner)(nil)
+
+func (Scanner) Version() int { return 2 }
+
+var (
+	defaultClient = common.SaneHttpClient()
+
+	// Make sure that your group is surrounded in boundary characters such as below to reduce false positives.
+	keyPat = regexp.MustCompile(`\b(sqco_[[:alnum:]]{59})\b`)
+)
+
+// Keywords are used for efficiently pre-filtering chunks.
+// Use identifiers in the secret preferably, or the provider name.
+func (s Scanner) Keywords() []string {
+	return []string{"sqco_"}
+}
+
+func (s Scanner) getClient() *http.Client {
+	if s.client != nil {
+		return s.client
+	}
+
+	return defaultClient
+}
+
+// FromData will find and optionally verify SonarCloud secrets in a given set of bytes.
+func (s Scanner) FromData(ctx context.Context, verify bool, data []byte) (results []detectors.Result, err error) {
+	dataStr := string(data)
+
+	uniqueTokenMatches := make(map[string]struct{})
+	for _, match := range keyPat.FindAllStringSubmatch(dataStr, -1) {
+		uniqueTokenMatches[match[1]] = struct{}{}
+	}
+
+	for match := range uniqueTokenMatches {
+		s1 := detectors.Result{
+			DetectorType: detector_typepb.DetectorType_SonarCloud,
+			Raw:          []byte(match),
+			SecretParts:  map[string]string{"key": match},
+			ExtraData: map[string]string{
+				"version": fmt.Sprintf("%d", s.Version()),
+			},
+		}
+
+		if verify {
+			isVerified, verificationErr := s.verifyMatch(ctx, s.getClient(), match)
+			s1.Verified = isVerified
+			s1.SetVerificationError(verificationErr, match)
+		}
+
+		results = append(results, s1)
+	}
+
+	return results, nil
+}
+
+// verifyMatch attempts to validate a SonarCloud token.
+func (s Scanner) verifyMatch(ctx context.Context, client *http.Client, token string) (bool, error) {
+	// Format-compliant (lowercase alphanumeric + hyphens) dummy key that won't match a
+	// real organization, so the API returns 404 rather than rejecting it as malformed.
+	organizationKey := "nonexistent-org-9f2a7c4e1b8d4a6f"
+	url := fmt.Sprintf("https://sonarcloud.io/api/projects/search?organization=%s", organizationKey)
+
+	req, err := http.NewRequestWithContext(ctx, http.MethodGet, url, http.NoBody)
+	if err != nil {
+		return false, fmt.Errorf("failed to create request: %w", err)
+	}
+
+	req.Header.Add("Content-Type", "application/x-www-form-urlencoded")
+	req.Header.Add("Authorization", fmt.Sprintf("Bearer %s", token))
+
+	res, err := client.Do(req)
+	if err != nil {
+		return false, fmt.Errorf("failed to perform request: %w", err)
+	}
+
+	defer func() {
+		_, _ = io.Copy(io.Discard, res.Body)
+		_ = res.Body.Close()
+	}()
+
+	// The official Sonar API docs don't document the response codes for this
+	// endpoint, but community evidence indicates 403 is returned when the
+	// token is valid but lacks org-admin permissions on the queried org:
+	// https://community.sonarsource.com/t/api-access-issue-for-read-only-user-despite-ui-access/140025
+	// https://community.sonarsource.com/t/http-403-when-accessing-api-projects-search-but-other-endpoint-works-like-components/20668
+	switch res.StatusCode {
+	case http.StatusOK, http.StatusNotFound, http.StatusForbidden:
+		return true, nil
+	case http.StatusUnauthorized:
+		return false, nil
+	default:
+		return false, fmt.Errorf("unexpected status code: %d", res.StatusCode)
+	}
+}
+
+func (s Scanner) Type() detector_typepb.DetectorType {
+	return detector_typepb.DetectorType_SonarCloud
+}
+
+func (s Scanner) Description() string {
+	return "SonarCloud is a cloud-based code quality and security service. SonarCloud tokens can be used to access project analysis and quality reports."
+}

pkg/detectors/sonarcloud/v2/sonarcloud_integration_test.go

@@ -0,0 +1,132 @@
+//go:build detectors
+// +build detectors
+
+package sonarcloud
+
+import (
+	"context"
+	"fmt"
+	"testing"
+	"time"
+
+	"github.com/kylelemons/godebug/pretty"
+
+	"github.com/trufflesecurity/trufflehog/v3/pkg/common"
+	"github.com/trufflesecurity/trufflehog/v3/pkg/detectors"
+	"github.com/trufflesecurity/trufflehog/v3/pkg/pb/detector_typepb"
+)
+
+func TestSonarCloud_FromChunk(t *testing.T) {
+	ctx, cancel := context.WithTimeout(context.Background(), time.Second*5)
+	defer cancel()
+	testSecrets, err := common.GetSecret(ctx, "trufflehog-testing", "detectors6")
+	if err != nil {
+		t.Fatalf("could not get test secrets from GCP: %s", err)
+	}
+	secret := testSecrets.MustGetField("SONARCLOUD_V2")
+	inactiveSecret := testSecrets.MustGetField("SONARCLOUD_V2_INACTIVE")
+
+	type args struct {
+		ctx    context.Context
+		data   []byte
+		verify bool
+	}
+	tests := []struct {
+		name    string
+		s       Scanner
+		args    args
+		want    []detectors.Result
+		wantErr bool
+	}{
+		{
+			name: "found, verified",
+			s:    Scanner{},
+			args: args{
+				ctx:    context.Background(),
+				data:   []byte(fmt.Sprintf("You can find a sonarcloud secret %s within", secret)),
+				verify: true,
+			},
+			want: []detectors.Result{
+				{
+					DetectorType: detector_typepb.DetectorType_SonarCloud,
+					Verified:     true,
+					ExtraData: map[string]string{
+						"version": "2",
+					},
+					SecretParts: map[string]string{
+						"key": secret,
+					},
+				},
+			},
+			wantErr: false,
+		},
+		{
+			name: "found, unverified",
+			s:    Scanner{},
+			args: args{
+				ctx:    context.Background(),
+				data:   []byte(fmt.Sprintf("You can find a sonarcloud secret %s within but not valid", inactiveSecret)), // the secret would satisfy the regex but not pass validation
+				verify: true,
+			},
+			want: []detectors.Result{
+				{
+					DetectorType: detector_typepb.DetectorType_SonarCloud,
+					Verified:     false,
+					ExtraData: map[string]string{
+						"version": "2",
+					},
+					SecretParts: map[string]string{
+						"key": inactiveSecret,
+					},
+				},
+			},
+			wantErr: false,
+		},
+		{
+			name: "not found",
+			s:    Scanner{},
+			args: args{
+				ctx:    context.Background(),
+				data:   []byte("You cannot find the secret within"),
+				verify: true,
+			},
+			want:    nil,
+			wantErr: false,
+		},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			s := Scanner{}
+			got, err := s.FromData(tt.args.ctx, tt.args.verify, tt.args.data)
+			if (err != nil) != tt.wantErr {
+				t.Errorf("SonarCloud.FromData() error = %v, wantErr %v", err, tt.wantErr)
+				return
+			}
+			for i := range got {
+				if len(got[i].Raw) == 0 {
+					t.Fatalf("no raw secret present: \n %+v", got[i])
+				}
+				got[i].Raw = nil
+			}
+			if diff := pretty.Compare(got, tt.want); diff != "" {
+				t.Errorf("SonarCloud.FromData() %s diff: (-got +want)\n%s", tt.name, diff)
+			}
+		})
+	}
+}
+
+func BenchmarkFromData(benchmark *testing.B) {
+	ctx := context.Background()
+	s := Scanner{}
+	for name, data := range detectors.MustGetBenchmarkData() {
+		benchmark.Run(name, func(b *testing.B) {
+			b.ResetTimer()
+			for n := 0; n < b.N; n++ {
+				_, err := s.FromData(ctx, false, data)
+				if err != nil {
+					b.Fatal(err)
+				}
+			}
+		})
+	}
+}

pkg/detectors/sonarcloud/v2/sonarcloud_test.go

@@ -0,0 +1,85 @@
+package sonarcloud
+
+import (
+	"context"
+	"fmt"
+	"testing"
+
+	"github.com/google/go-cmp/cmp"
+
+	"github.com/trufflesecurity/trufflehog/v3/pkg/detectors"
+	"github.com/trufflesecurity/trufflehog/v3/pkg/engine/ahocorasick"
+)
+
+var (
+	validPattern   = "sqco_FbT1v5HrMX6qyKUkaoLQdYOniAVhbEccERraQABuhBayDOkyCZTa8TDQFRp"
+	invalidPattern = "sqco_FbT1v5HrMX6qyKUkaoLQdYOniAVhbEccERraQABuhBayDOkyCZTa8TDQF=="
+)
+
+func TestSonarCloud_Pattern(t *testing.T) {
+	d := Scanner{}
+	ahoCorasickCore := ahocorasick.NewAhoCorasickCore([]detectors.Detector{d})
+	tests := []struct {
+		name  string
+		input string
+		want  []string
+	}{
+		{
+			name:  "valid pattern",
+			input: fmt.Sprintf("token = '%s'", validPattern),
+			want:  []string{validPattern},
+		},
+		{
+			name:  "valid pattern - ignore duplicate",
+			input: fmt.Sprintf("token = '%s' | '%s'", validPattern, validPattern),
+			want:  []string{validPattern},
+		},
+		{
+			name:  "invalid pattern",
+			input: fmt.Sprintf("token = '%s'", invalidPattern),
+			want:  []string{},
+		},
+	}
+
+	for _, test := range tests {
+		t.Run(test.name, func(t *testing.T) {
+			matchedDetectors := ahoCorasickCore.FindDetectorMatches([]byte(test.input))
+			if len(matchedDetectors) == 0 {
+				t.Errorf("keywords '%v' not matched by: %s", d.Keywords(), test.input)
+				return
+			}
+
+			results, err := d.FromData(context.Background(), false, []byte(test.input))
+			if err != nil {
+				t.Errorf("error = %v", err)
+				return
+			}
+
+			if len(results) != len(test.want) {
+				if len(results) == 0 {
+					t.Errorf("did not receive result")
+				} else {
+					t.Errorf("expected %d results, only received %d", len(test.want), len(results))
+				}
+				return
+			}
+
+			actual := make(map[string]struct{}, len(results))
+			for _, r := range results {
+				if len(r.RawV2) > 0 {
+					actual[string(r.RawV2)] = struct{}{}
+				} else {
+					actual[string(r.Raw)] = struct{}{}
+				}
+			}
+			expected := make(map[string]struct{}, len(test.want))
+			for _, v := range test.want {
+				expected[v] = struct{}{}
+			}
+
+			if diff := cmp.Diff(expected, actual); diff != "" {
+				t.Errorf("%s diff: (-want +got)\n%s", test.name, diff)
+			}
+		})
+	}
+}

pkg/engine/defaults/defaults.go

@@ -723,7 +723,8 @@ import (
 	"github.com/trufflesecurity/trufflehog/v3/pkg/detectors/snipcart"
 	"github.com/trufflesecurity/trufflehog/v3/pkg/detectors/snowflake"
 	"github.com/trufflesecurity/trufflehog/v3/pkg/detectors/snykkey"
-	"github.com/trufflesecurity/trufflehog/v3/pkg/detectors/sonarcloud"
+	sonarcloudv1 "github.com/trufflesecurity/trufflehog/v3/pkg/detectors/sonarcloud/v1"
+	sonarcloudv2 "github.com/trufflesecurity/trufflehog/v3/pkg/detectors/sonarcloud/v2"
 	"github.com/trufflesecurity/trufflehog/v3/pkg/detectors/sourcegraph"
 	"github.com/trufflesecurity/trufflehog/v3/pkg/detectors/sourcegraphcody"
 	"github.com/trufflesecurity/trufflehog/v3/pkg/detectors/spectralops"
@@ -1638,7 +1639,8 @@ func buildDetectorList() []detectors.Detector {
 		&snipcart.Scanner{},
 		&snowflake.Scanner{},
 		&snykkey.Scanner{},
-		&sonarcloud.Scanner{},
+		&sonarcloudv1.Scanner{},
+		&sonarcloudv2.Scanner{},
 		&sourcegraph.Scanner{},
 		&sourcegraphcody.Scanner{},
 		// &sparkpost.Scanner{},
@@ -1818,6 +1820,8 @@ func buildDetectorList() []detectors.Detector {
 			return !feature.CloudinaryDetectorEnabled.Load()
 		case *gitlaboauth2.Scanner:
 			return !feature.GitLabOAuthDetectorEnabled.Load()
+		case *sonarcloudv2.Scanner:
+			return !feature.SonarCloudV2DetectorEnabled.Load()
 		case *enigma.Scanner:
 			return !feature.EnigmaDetectorEnabled.Load()
 		case *datadogapikey.Scanner:

pkg/feature/feature.go

@@ -19,6 +19,7 @@ var (
 	PineconeDetectorEnabled                  atomic.Bool
 	CloudinaryDetectorEnabled                atomic.Bool
 	GitLabOAuthDetectorEnabled               atomic.Bool
+	SonarCloudV2DetectorEnabled              atomic.Bool
 	EnigmaDetectorEnabled                    atomic.Bool
 	DatadogApiKeyDetectorEnabled             atomic.Bool
 	TlyDetectorEnabled                       atomic.Bool