From abaf126d25ca4fbbb4ff3129aef4feff59af4818 Mon Sep 17 00:00:00 2001 From: Abdul Basit Date: Wed, 9 Apr 2025 12:44:35 +0500 Subject: [PATCH] (fix) domain regex issue in JiraToken detector (#4005) * fix in regex to allow multiple subdomains * don't add to results if host not found * we want to keep the unapproachable domains in results. * add test coverage for multiple subdomain support. --------- Co-authored-by: Kashif Khan <70996046+kashifkhan0771@users.noreply.github.com> --- pkg/detectors/jiratoken/v1/jiratoken.go | 2 +- pkg/detectors/jiratoken/v2/jiratoken_v2.go | 4 +--- pkg/detectors/jiratoken/v2/jiratoken_v2_test.go | 6 ++++++ 3 files changed, 8 insertions(+), 4 deletions(-) diff --git a/pkg/detectors/jiratoken/v1/jiratoken.go b/pkg/detectors/jiratoken/v1/jiratoken.go index 3930f184f..d6e4b83fa 100644 --- a/pkg/detectors/jiratoken/v1/jiratoken.go +++ b/pkg/detectors/jiratoken/v1/jiratoken.go @@ -30,7 +30,7 @@ var ( // Make sure that your group is surrounded in boundary characters such as below to reduce false positives. tokenPat = regexp.MustCompile(detectors.PrefixRegex([]string{"jira"}) + `\b([a-zA-Z-0-9]{24})\b`) - domainPat = regexp.MustCompile(detectors.PrefixRegex([]string{"jira"}) + `\b([a-zA-Z-0-9]{5,24}\.[a-zA-Z-0-9]{3,16}\.[a-zA-Z-0-9]{3,16})\b`) + domainPat = regexp.MustCompile(detectors.PrefixRegex([]string{"jira"}) + `\b((?:[a-zA-Z0-9-]{1,24}\.)+[a-zA-Z0-9-]{2,24}\.[a-zA-Z0-9-]{2,16})\b`) emailPat = regexp.MustCompile(detectors.PrefixRegex([]string{"jira"}) + common.EmailPattern) ) diff --git a/pkg/detectors/jiratoken/v2/jiratoken_v2.go b/pkg/detectors/jiratoken/v2/jiratoken_v2.go index 4b0aeaec7..ca68806bf 100644 --- a/pkg/detectors/jiratoken/v2/jiratoken_v2.go +++ b/pkg/detectors/jiratoken/v2/jiratoken_v2.go @@ -30,7 +30,7 @@ var ( // https://support.atlassian.com/atlassian-account/docs/manage-api-tokens-for-your-atlassian-account/ // Tokens created after Jan 18 2023 use a variable length tokenPat = regexp.MustCompile(detectors.PrefixRegex([]string{"jira"}) + `\b([A-Za-z0-9+/=_-]+=[A-Za-z0-9]{8})\b`) - domainPat = regexp.MustCompile(detectors.PrefixRegex([]string{"jira"}) + `\b([a-zA-Z-0-9]{5,24}\.[a-zA-Z-0-9]{3,16}\.[a-zA-Z-0-9]{3,16})\b`) + domainPat = regexp.MustCompile(detectors.PrefixRegex([]string{"jira"}) + `\b((?:[a-zA-Z0-9-]{1,24}\.)+[a-zA-Z0-9-]{2,24}\.[a-zA-Z0-9-]{2,16})\b`) emailPat = regexp.MustCompile(detectors.PrefixRegex([]string{"jira"}) + `\b([A-Za-z0-9._%+-]+@[A-Za-z0-9.-]+\.[A-Z|a-z]{2,})\b`) ) @@ -82,9 +82,7 @@ func (s Scanner) FromData(ctx context.Context, verify bool, data []byte) (result } results = append(results, s1) - } - } } diff --git a/pkg/detectors/jiratoken/v2/jiratoken_v2_test.go b/pkg/detectors/jiratoken/v2/jiratoken_v2_test.go index 0d8acaf36..4c8db5467 100644 --- a/pkg/detectors/jiratoken/v2/jiratoken_v2_test.go +++ b/pkg/detectors/jiratoken/v2/jiratoken_v2_test.go @@ -15,6 +15,7 @@ var ( validTokenPattern = "9nsCADa7812Z7VoIsYJ0K4rFWLBfk=1rhOsLAW" invalidTokenPattern = "9nsCA?a7812Z7VoI%YJ0K4rFWLBfk91rhOsLAW" validDomainPattern = "hereisavalidsubdomain.heresalongdomain.com" + validDomainPattern2 = "jira.hereisavalidsubdomain.heresalongdomain.com" invalidDomainPattern = "?y4r3fs1ewqec12v1e3tl.5Hcsrcehic89saXd.ro@" validEmailPattern = "xfKF_BZq7@grum.com" invalidEmailPattern = "xfKF_BZq7/grum.com" @@ -34,6 +35,11 @@ func TestJiraToken_Pattern(t *testing.T) { input: fmt.Sprintf("%s %s \n%s %s\n%s %s", keyword, validTokenPattern, keyword, validDomainPattern, keyword, validEmailPattern), want: []string{validEmailPattern + ":" + validTokenPattern + ":" + validDomainPattern}, }, + { + name: "valid pattern - with multiple subdomains", + input: fmt.Sprintf("%s %s \n%s %s\n%s %s", keyword, validTokenPattern, keyword, validDomainPattern2, keyword, validEmailPattern), + want: []string{validEmailPattern + ":" + validTokenPattern + ":" + validDomainPattern2}, + }, { name: "valid pattern - key out of prefix range", input: fmt.Sprintf("%s keyword is not close to the real key in the data\n = '%s' domain = '%s' email = '%s'", keyword, validTokenPattern, validDomainPattern, validEmailPattern),