trufflesecurity/trufflehog
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Added Anypoint API OAuth2 Detector (#4312)

Browse Source 
* added anypoint oauth2 detector

* deleting secret from uniqueSecrets map if id-secret pair is verified

---------

Co-authored-by: Amaan Ullah <[email protected]>
This commit is contained in:
Nabeel Alam
2025-07-21 16:31:58 +05:00
committed by GitHub
co-authored by Amaan Ullah
parent 907ac64fd4
commit bfaddae9b6
5 changed files with 383 additions and 7 deletions
Download Patch File Download Diff File Expand all files Collapse all files
pkg/detectors/anypointoauth2/anypointoauth2.go
+131
View File
@@ -0,0 +1,131 @@
package anypointoauth2
import (
"context"
"fmt"
"io"
"net/http"
"strings"
regexp "github.com/wasilibs/go-re2"
"github.com/trufflesecurity/trufflehog/v3/pkg/common"
"github.com/trufflesecurity/trufflehog/v3/pkg/detectors"
"github.com/trufflesecurity/trufflehog/v3/pkg/pb/detectorspb"
)
type Scanner struct {
client *http.Client
detectors.DefaultMultiPartCredentialProvider
}
// Ensure the Scanner satisfies the interface at compile time.
var _ detectors.Detector = (*Scanner)(nil)
var (
defaultClient = common.SaneHttpClient()
// Make sure that your group is surrounded in boundary characters such as below to reduce false positives.
idPat = regexp.MustCompile(detectors.PrefixRegex([]string{"anypoint", "id"}) + `\b([0-9a-f]{32})\b`)
secretPat = regexp.MustCompile(detectors.PrefixRegex([]string{"anypoint", "secret"}) + `\b([0-9a-fA-F]{32})\b`)
verificationUrl = "https://anypoint.mulesoft.com/accounts/oauth2/token"
)
// Keywords are used for efficiently pre-filtering chunks.
// Use identifiers in the secret preferably, or the provider name.
func (s Scanner) Keywords() []string {
return []string{"anypoint"}
}
func (s Scanner) getClient() *http.Client {
if s.client != nil {
return s.client
}
return defaultClient
}
// FromData will find and optionally verify Anypoint secrets in a given set of bytes.
func (s Scanner) FromData(ctx context.Context, verify bool, data []byte) (results []detectors.Result, err error) {
dataStr := string(data)
var uniqueIDs, uniqueSecrets = make(map[string]struct{}), make(map[string]struct{})
for _, matches := range idPat.FindAllStringSubmatch(dataStr, -1) {
uniqueIDs[matches[1]] = struct{}{}
}
for _, matches := range secretPat.FindAllStringSubmatch(dataStr, -1) {
uniqueSecrets[matches[1]] = struct{}{}
}
for id := range uniqueIDs {
for secret := range uniqueSecrets {
if id == secret {
// Avoid processing the same string for both id and secret.
continue
}
s1 := detectors.Result{
DetectorType: detectorspb.DetectorType_AnypointOAuth2,
Raw: []byte(secret),
RawV2: []byte(fmt.Sprintf("%s:%s", id, secret)),
}
if verify {
client := s.getClient()
isVerified, verificationErr := verifyMatch(ctx, client, id, secret)
s1.Verified = isVerified
s1.SetVerificationError(verificationErr)
}
results = append(results, s1)
if s1.Verified {
// Anypoint client IDs and secrets are mapped one-to-one, so if a pair
// is verified, we can remove that secret from the uniqueSecrets map.
delete(uniqueSecrets, secret)
break
}
}
}
return
}
func verifyMatch(ctx context.Context, client *http.Client, id, secret string) (bool, error) {
payload := strings.NewReader(`{"grant_type":"client_credentials","client_id":"` + id + `","client_secret":"` + secret + `"}`)
req, err := http.NewRequestWithContext(ctx, http.MethodPost, verificationUrl, payload)
if err != nil {
return false, err
}
req.Header.Add("Content-Type", "application/json")
res, err := client.Do(req)
if err != nil {
return false, err
}
defer func() {
_, _ = io.Copy(io.Discard, res.Body)
_ = res.Body.Close()
}()
switch res.StatusCode {
// The endpoint responds with status 200 for valid Organization credentials and 422 for Client credentials.
case http.StatusOK, http.StatusUnprocessableEntity:
return true, nil
case http.StatusUnauthorized:
return false, nil
default:
return false, fmt.Errorf("unexpected status code: %d", res.StatusCode)
}
}
func (s Scanner) Type() detectorspb.DetectorType {
return detectorspb.DetectorType_AnypointOAuth2
}
func (s Scanner) Description() string {
return "Anypoint is a unified platform that allows organizations to build and manage APIs and integrations. Anypoint credentials can be used to access and manipulate these integrations and API data."
}
pkg/detectors/anypointoauth2/anypointoauth2_integration_test.go
+133
View File
@@ -0,0 +1,133 @@
//go:build detectors
// +build detectors
package anypointoauth2
import (
"context"
"fmt"
"testing"
"time"
"github.com/google/go-cmp/cmp"
"github.com/google/go-cmp/cmp/cmpopts"
"github.com/trufflesecurity/trufflehog/v3/pkg/detectors"
"github.com/trufflesecurity/trufflehog/v3/pkg/common"
"github.com/trufflesecurity/trufflehog/v3/pkg/pb/detectorspb"
)
func TestAnypointOAuth2_FromChunk(t *testing.T) {
ctx, cancel := context.WithTimeout(context.Background(), time.Second*5)
defer cancel()
testSecrets, err := common.GetSecret(ctx, "trufflehog-testing", "detectors6")
if err != nil {
t.Fatalf("could not get test secrets from GCP: %s", err)
}
clientID := testSecrets.MustGetField("ANYPOINT_CLIENT_ID")
clientSecret := testSecrets.MustGetField("ANYPOINT_CLIENT_SECRET")
inactiveSecret := testSecrets.MustGetField("ANYPOINT_INACTIVE_SECRET")
type args struct {
ctx context.Context
data []byte
verify bool
}
tests := []struct {
name string
s Scanner
args args
want []detectors.Result
wantErr bool
}{
{
name: "found, verified",
s: Scanner{},
args: args{
ctx: context.Background(),
data: []byte(fmt.Sprintf("You can find an anypoint secret %s within anypoint organization id %s", clientSecret, clientID)),
verify: true,
},
want: []detectors.Result{
{
DetectorType: detectorspb.DetectorType_AnypointOAuth2,
Verified: true,
},
},
wantErr: false,
},
{
name: "found, unverified",
s: Scanner{},
args: args{
ctx: context.Background(),
data: []byte(fmt.Sprintf("You can find an anypoint secret %s within anypoint organization id %s but not valid", inactiveSecret, clientID)), // the secret would satisfy the regex but not pass validation
verify: true,
},
want: []detectors.Result{
{
DetectorType: detectorspb.DetectorType_AnypointOAuth2,
Verified: false,
},
},
wantErr: false,
},
{
name: "not found",
s: Scanner{},
args: args{
ctx: context.Background(),
data: []byte("You cannot find the secret within"),
verify: true,
},
want: nil,
wantErr: false,
},
}
for _, tt := range tests {
t.Run(tt.name, func(t *testing.T) {
s := Scanner{}
got, err := s.FromData(tt.args.ctx, tt.args.verify, tt.args.data)
if (err != nil) != tt.wantErr {
t.Errorf("Anypoint.FromData() error = %v, wantErr %v", err, tt.wantErr)
return
}
for i := range got {
if len(got[i].Raw) == 0 {
t.Fatalf("no raw secret present: \n %+v", got[i])
}
gotErr := ""
if got[i].VerificationError() != nil {
gotErr = got[i].VerificationError().Error()
}
wantErr := ""
if tt.want[i].VerificationError() != nil {
wantErr = tt.want[i].VerificationError().Error()
}
if gotErr != wantErr {
t.Fatalf("wantVerificationError = %v, verification error = %v", tt.want[i].VerificationError(), got[i].VerificationError())
}
}
ignoreOpts := cmpopts.IgnoreFields(detectors.Result{}, "Raw", "RawV2", "verificationError", "primarySecret")
if diff := cmp.Diff(got, tt.want, ignoreOpts); diff != "" {
t.Errorf("AnypointOAuth2.FromData() %s diff: (-got +want)\n%s", tt.name, diff)
}
})
}
}
func BenchmarkFromData(benchmark *testing.B) {
ctx := context.Background()
s := Scanner{}
for name, data := range detectors.MustGetBenchmarkData() {
benchmark.Run(name, func(b *testing.B) {
b.ResetTimer()
for n := 0; n < b.N; n++ {
_, err := s.FromData(ctx, false, data)
if err != nil {
b.Fatal(err)
}
}
})
}
}
pkg/detectors/anypointoauth2/anypointoauth2_test.go
+107
View File
@@ -0,0 +1,107 @@
package anypointoauth2
import (
"context"
"fmt"
"testing"
"github.com/google/go-cmp/cmp"
"github.com/trufflesecurity/trufflehog/v3/pkg/detectors"
"github.com/trufflesecurity/trufflehog/v3/pkg/engine/ahocorasick"
)
var (
validPattern = "anypoint id: e3cd10a87f53b2dfa4b5fd606e7d9eca / secret: ACE9d7E606Df5B4AFD2B35f78A01DC3E"
complexPattern = `
# Secret Configuration File
# Organization details
ORG_NAME=my_organization
ORG_ID=abcd1234-ef56-gh78-ij90-klmn1234opqr
# Database credentials
DB_USERNAME=iamnotadmin
DB_PASSWORD=8f3b6d3e7c9a2f5e
# OAuth tokens
CLIENT_ID=e3cd10a87f53b2dfa4b5fd606e7d9eca
CLIENT_SECRET=ACE9d7E606Df5B4AFD2B35f78A01DC3E
# API keys
API_KEY=sk-ant-api03-nothing-just-some-random-api-key-1234fghijklmnopAA
SECRET_KEY=1a2b3c4d-5e6f-7g8h-9i0j-k1l2m3n4o5p6
# Endpoints
SERVICE_URL=https://api.example.com/v1/resource
`
invalidPattern = "anypoint id: k4lzc5ty98tnfu3a11y8gnv5vb1281as / secret: 8SBT9p4NXPYVS89EPtYV29SVT2SFcD8A"
)
func TestAnypoint_Pattern(t *testing.T) {
d := Scanner{}
ahoCorasickCore := ahocorasick.NewAhoCorasickCore([]detectors.Detector{d})
tests := []struct {
name string
input string
want []string
}{
{
name: "valid pattern",
input: fmt.Sprintf("anypoint credentials: %s", validPattern),
want: []string{"e3cd10a87f53b2dfa4b5fd606e7d9eca:ACE9d7E606Df5B4AFD2B35f78A01DC3E"},
},
{
name: "valid pattern - complex",
input: fmt.Sprintf("anypoint credentials: %s", complexPattern),
want: []string{"e3cd10a87f53b2dfa4b5fd606e7d9eca:ACE9d7E606Df5B4AFD2B35f78A01DC3E"},
},
{
name: "invalid pattern",
input: fmt.Sprintf("anypoint credentials: %s", invalidPattern),
want: nil,
},
}
for _, test := range tests {
t.Run(test.name, func(t *testing.T) {
matchedDetectors := ahoCorasickCore.FindDetectorMatches([]byte(test.input))
if len(matchedDetectors) == 0 {
t.Errorf("keywords '%v' not matched by: %s", d.Keywords(), test.input)
return
}
results, err := d.FromData(context.Background(), false, []byte(test.input))
if err != nil {
t.Errorf("error = %v", err)
return
}
if len(results) != len(test.want) {
if len(results) == 0 {
t.Errorf("did not receive result")
} else {
t.Errorf("expected %d results, only received %d", len(test.want), len(results))
}
return
}
actual := make(map[string]struct{}, len(results))
for _, r := range results {
if len(r.RawV2) > 0 {
actual[string(r.RawV2)] = struct{}{}
} else {
actual[string(r.Raw)] = struct{}{}
}
}
expected := make(map[string]struct{}, len(test.want))
for _, v := range test.want {
expected[v] = struct{}{}
}
if diff := cmp.Diff(expected, actual); diff != "" {
t.Errorf("%s diff: (-want +got)\n%s", test.name, diff)
}
})
}
}
pkg/pb/detectorspb/detectors.pb.go
+11 -7
View File
@@ -1138,6 +1138,7 @@ const (
DetectorType_BitbucketAppPassword DetectorType = 1029
DetectorType_Hasura DetectorType = 1030
DetectorType_SalesforceRefreshToken DetectorType = 1031
DetectorType_AnypointOAuth2 DetectorType = 1032
)
// Enum value maps for DetectorType.
@@ -2171,6 +2172,7 @@ var (
1029: "BitbucketAppPassword",
1030: "Hasura",
1031: "SalesforceRefreshToken",
1032: "AnypointOAuth2",
}
DetectorType_value = map[string]int32{
"Alibaba": 0,
@@ -3201,6 +3203,7 @@ var (
"BitbucketAppPassword": 1029,
"Hasura": 1030,
"SalesforceRefreshToken": 1031,
"AnypointOAuth2": 1032,
}
)
@@ -3654,7 +3657,7 @@ var file_detectors_proto_rawDesc = []byte{
0x4c, 0x41, 0x49, 0x4e, 0x10, 0x01, 0x12, 0x0a, 0x0a, 0x06, 0x42, 0x41, 0x53, 0x45, 0x36, 0x34,
0x10, 0x02, 0x12, 0x09, 0x0a, 0x05, 0x55, 0x54, 0x46, 0x31, 0x36, 0x10, 0x03, 0x12, 0x13, 0x0a,
0x0f, 0x45, 0x53, 0x43, 0x41, 0x50, 0x45, 0x44, 0x5f, 0x55, 0x4e, 0x49, 0x43, 0x4f, 0x44, 0x45,
0x10, 0x04, 0x2a, 0xa7, 0x85, 0x01, 0x0a, 0x0c, 0x44, 0x65, 0x74, 0x65, 0x63, 0x74, 0x6f, 0x72,
0x10, 0x04, 0x2a, 0xbc, 0x85, 0x01, 0x0a, 0x0c, 0x44, 0x65, 0x74, 0x65, 0x63, 0x74, 0x6f, 0x72,
0x54, 0x79, 0x70, 0x65, 0x12, 0x0b, 0x0a, 0x07, 0x41, 0x6c, 0x69, 0x62, 0x61, 0x62, 0x61, 0x10,
0x00, 0x12, 0x08, 0x0a, 0x04, 0x41, 0x4d, 0x51, 0x50, 0x10, 0x01, 0x12, 0x07, 0x0a, 0x03, 0x41,
0x57, 0x53, 0x10, 0x02, 0x12, 0x09, 0x0a, 0x05, 0x41, 0x7a, 0x75, 0x72, 0x65, 0x10, 0x03, 0x12,
@@ -4720,12 +4723,13 @@ var file_detectors_proto_rawDesc = []byte{
0x75, 0x63, 0x6b, 0x65, 0x74, 0x41, 0x70, 0x70, 0x50, 0x61, 0x73, 0x73, 0x77, 0x6f, 0x72, 0x64,
0x10, 0x85, 0x08, 0x12, 0x0b, 0x0a, 0x06, 0x48, 0x61, 0x73, 0x75, 0x72, 0x61, 0x10, 0x86, 0x08,
0x12, 0x1b, 0x0a, 0x16, 0x53, 0x61, 0x6c, 0x65, 0x73, 0x66, 0x6f, 0x72, 0x63, 0x65, 0x52, 0x65,
0x66, 0x72, 0x65, 0x73, 0x68, 0x54, 0x6f, 0x6b, 0x65, 0x6e, 0x10, 0x87, 0x08, 0x42, 0x3d, 0x5a,
0x3b, 0x67, 0x69, 0x74, 0x68, 0x75, 0x62, 0x2e, 0x63, 0x6f, 0x6d, 0x2f, 0x74, 0x72, 0x75, 0x66,
0x66, 0x6c, 0x65, 0x73, 0x65, 0x63, 0x75, 0x72, 0x69, 0x74, 0x79, 0x2f, 0x74, 0x72, 0x75, 0x66,
0x66, 0x6c, 0x65, 0x68, 0x6f, 0x67, 0x2f, 0x76, 0x33, 0x2f, 0x70, 0x6b, 0x67, 0x2f, 0x70, 0x62,
0x2f, 0x64, 0x65, 0x74, 0x65, 0x63, 0x74, 0x6f, 0x72, 0x73, 0x70, 0x62, 0x62, 0x06, 0x70, 0x72,
0x6f, 0x74, 0x6f, 0x33,
0x66, 0x72, 0x65, 0x73, 0x68, 0x54, 0x6f, 0x6b, 0x65, 0x6e, 0x10, 0x87, 0x08, 0x12, 0x13, 0x0a,
0x0e, 0x41, 0x6e, 0x79, 0x70, 0x6f, 0x69, 0x6e, 0x74, 0x4f, 0x41, 0x75, 0x74, 0x68, 0x32, 0x10,
0x88, 0x08, 0x42, 0x3d, 0x5a, 0x3b, 0x67, 0x69, 0x74, 0x68, 0x75, 0x62, 0x2e, 0x63, 0x6f, 0x6d,
0x2f, 0x74, 0x72, 0x75, 0x66, 0x66, 0x6c, 0x65, 0x73, 0x65, 0x63, 0x75, 0x72, 0x69, 0x74, 0x79,
0x2f, 0x74, 0x72, 0x75, 0x66, 0x66, 0x6c, 0x65, 0x68, 0x6f, 0x67, 0x2f, 0x76, 0x33, 0x2f, 0x70,
0x6b, 0x67, 0x2f, 0x70, 0x62, 0x2f, 0x64, 0x65, 0x74, 0x65, 0x63, 0x74, 0x6f, 0x72, 0x73, 0x70,
0x62, 0x62, 0x06, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x33,
}
var (
proto/detectors.proto
+1
View File
@@ -1041,6 +1041,7 @@ enum DetectorType {
BitbucketAppPassword = 1029;
Hasura = 1030;
SalesforceRefreshToken = 1031;
AnypointOAuth2 = 1032;
}
message Result {