trufflesecurity/trufflehog
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

[Fix] (#3306)

Browse Source 
For AWS session token, substring is being searched to avoid false positive session tokens.
Reference: https://nitter.poast.org/TalBeerySec/status/1816449053841838223#m
This commit is contained in:
Abdul Basit
2024-09-24 11:24:46 -07:00
committed by GitHub
parent b921232a35
commit b612e1e4fd
1 changed files with 3 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
pkg/detectors/awssessionkeys/awssessionkey.go
+3 -1
View File
@@ -86,8 +86,10 @@ func GetHMAC(key []byte, data []byte) []byte {
return hasher.Sum(nil)
}
// Reference: https://nitter.poast.org/TalBeerySec/status/1816449053841838223#m
func checkSessionToken(sessionToken string, secret string) bool {
if !strings.Contains(sessionToken, "YXdz") || strings.Contains(sessionToken, secret) {
if !(strings.Contains(sessionToken, "YXdz") || strings.Contains(sessionToken, "Jb3JpZ2luX2Vj")) ||
strings.Contains(sessionToken, secret) {
// Handle error if the sessionToken is not a valid base64 string
return false
}