From e494eaf7b09724fc1c71212c86b8c0fe863424aa Mon Sep 17 00:00:00 2001 From: Kashif Khan <70996046+kashifkhan0771@users.noreply.github.com> Date: Thu, 21 Nov 2024 23:36:57 +0500 Subject: [PATCH] updated buildkite detectors (#3611) * updated buildkite detectors * resolved comments * added scoped in extradata --- pkg/detectors/buildkite/{ => v1}/buildkite.go | 63 +++++++++++++++---- .../{ => v1}/buildkite_integration_test.go | 0 .../buildkite/{ => v1}/buildkite_test.go | 0 .../v2}/buildkite.go | 19 ++---- .../v2}/buildkite_test.go | 0 .../v2}/buildkitev2_integration_test.go | 0 pkg/engine/defaults/defaults.go | 8 +-- 7 files changed, 60 insertions(+), 30 deletions(-) rename pkg/detectors/buildkite/{ => v1}/buildkite.go (57%) rename pkg/detectors/buildkite/{ => v1}/buildkite_integration_test.go (100%) rename pkg/detectors/buildkite/{ => v1}/buildkite_test.go (100%) rename pkg/detectors/{buildkitev2 => buildkite/v2}/buildkite.go (82%) rename pkg/detectors/{buildkitev2 => buildkite/v2}/buildkite_test.go (100%) rename pkg/detectors/{buildkitev2 => buildkite/v2}/buildkitev2_integration_test.go (100%) diff --git a/pkg/detectors/buildkite/buildkite.go b/pkg/detectors/buildkite/v1/buildkite.go similarity index 57% rename from pkg/detectors/buildkite/buildkite.go rename to pkg/detectors/buildkite/v1/buildkite.go index e91d35506..1a4cca6b6 100644 --- a/pkg/detectors/buildkite/buildkite.go +++ b/pkg/detectors/buildkite/v1/buildkite.go @@ -2,7 +2,9 @@ package buildkite import ( "context" + "encoding/json" "fmt" + "io" "net/http" "strings" @@ -15,6 +17,10 @@ import ( type Scanner struct{} +type APIResponse struct { + Scopes []string `json:"scopes"` +} + func (s Scanner) Version() int { return 1 } // Ensure the Scanner satisfies the interface at compile time. @@ -49,21 +55,15 @@ func (s Scanner) FromData(ctx context.Context, verify bool, data []byte) (result s1 := detectors.Result{ DetectorType: detectorspb.DetectorType_Buildkite, Raw: []byte(resMatch), + ExtraData: make(map[string]string), } if verify { - req, err := http.NewRequestWithContext(ctx, "GET", "https://api.buildkite.com/v2/access-token", nil) - if err != nil { - continue - } - req.Header.Add("Authorization", fmt.Sprintf("Bearer %s", resMatch)) - res, err := client.Do(req) - if err == nil { - defer res.Body.Close() - if res.StatusCode >= 200 && res.StatusCode < 300 { - s1.Verified = true - } - } + extraData, isVerified, verificationErr := VerifyBuildKite(ctx, client, resMatch) + s1.Verified = isVerified + s1.SetVerificationError(verificationErr, resMatch) + + s1.ExtraData = extraData } results = append(results, s1) @@ -79,3 +79,42 @@ func (s Scanner) Type() detectorspb.DetectorType { func (s Scanner) Description() string { return "Buildkite is a platform for running fast, secure, and scalable continuous integration pipelines. Buildkite API tokens can be used to access and modify pipeline data and configurations." } + +func VerifyBuildKite(ctx context.Context, client *http.Client, secret string) (map[string]string, bool, error) { + // create a request + // api doc: https://buildkite.com/docs/apis/rest-api/access-token#get-the-current-token + req, err := http.NewRequestWithContext(ctx, "GET", "https://api.buildkite.com/v2/access-token", nil) + if err != nil { + return nil, false, err + } + + // add authorization header + req.Header.Add("Authorization", fmt.Sprintf("Bearer %s", secret)) + + res, err := client.Do(req) + if err != nil { + return nil, false, err + } + defer func() { + _, _ = io.Copy(io.Discard, res.Body) + _ = res.Body.Close() + }() + + switch res.StatusCode { + case http.StatusOK: + var response APIResponse + + if err := json.NewDecoder(res.Body).Decode(&response); err != nil { + return nil, false, err + } + + extraData := make(map[string]string) + + extraData["scopes"] = strings.Join(response.Scopes, ", ") + return extraData, true, nil + case http.StatusUnauthorized: + return nil, false, nil + default: + return nil, false, fmt.Errorf("unexpected HTTP response status %d", res.StatusCode) + } +} diff --git a/pkg/detectors/buildkite/buildkite_integration_test.go b/pkg/detectors/buildkite/v1/buildkite_integration_test.go similarity index 100% rename from pkg/detectors/buildkite/buildkite_integration_test.go rename to pkg/detectors/buildkite/v1/buildkite_integration_test.go diff --git a/pkg/detectors/buildkite/buildkite_test.go b/pkg/detectors/buildkite/v1/buildkite_test.go similarity index 100% rename from pkg/detectors/buildkite/buildkite_test.go rename to pkg/detectors/buildkite/v1/buildkite_test.go diff --git a/pkg/detectors/buildkitev2/buildkite.go b/pkg/detectors/buildkite/v2/buildkite.go similarity index 82% rename from pkg/detectors/buildkitev2/buildkite.go rename to pkg/detectors/buildkite/v2/buildkite.go index f42663d0f..1f416bbc2 100644 --- a/pkg/detectors/buildkitev2/buildkite.go +++ b/pkg/detectors/buildkite/v2/buildkite.go @@ -2,14 +2,13 @@ package buildkitev2 import ( "context" - "fmt" - "net/http" "strings" regexp "github.com/wasilibs/go-re2" "github.com/trufflesecurity/trufflehog/v3/pkg/common" "github.com/trufflesecurity/trufflehog/v3/pkg/detectors" + v1 "github.com/trufflesecurity/trufflehog/v3/pkg/detectors/buildkite/v1" "github.com/trufflesecurity/trufflehog/v3/pkg/pb/detectorspb" ) @@ -52,18 +51,10 @@ func (s Scanner) FromData(ctx context.Context, verify bool, data []byte) (result } if verify { - req, err := http.NewRequestWithContext(ctx, "GET", "https://api.buildkite.com/v2/access-token", nil) - if err != nil { - continue - } - req.Header.Add("Authorization", fmt.Sprintf("Bearer %s", resMatch)) - res, err := client.Do(req) - if err == nil { - defer res.Body.Close() - if res.StatusCode >= 200 && res.StatusCode < 300 { - s1.Verified = true - } - } + extraData, isVerified, verificationErr := v1.VerifyBuildKite(ctx, client, resMatch) + s1.Verified = isVerified + s1.SetVerificationError(verificationErr, resMatch) + s1.ExtraData = extraData } results = append(results, s1) diff --git a/pkg/detectors/buildkitev2/buildkite_test.go b/pkg/detectors/buildkite/v2/buildkite_test.go similarity index 100% rename from pkg/detectors/buildkitev2/buildkite_test.go rename to pkg/detectors/buildkite/v2/buildkite_test.go diff --git a/pkg/detectors/buildkitev2/buildkitev2_integration_test.go b/pkg/detectors/buildkite/v2/buildkitev2_integration_test.go similarity index 100% rename from pkg/detectors/buildkitev2/buildkitev2_integration_test.go rename to pkg/detectors/buildkite/v2/buildkitev2_integration_test.go diff --git a/pkg/engine/defaults/defaults.go b/pkg/engine/defaults/defaults.go index 9bd38bd0e..5e23a833a 100644 --- a/pkg/engine/defaults/defaults.go +++ b/pkg/engine/defaults/defaults.go @@ -109,8 +109,8 @@ import ( "github.com/trufflesecurity/trufflehog/v3/pkg/detectors/budibase" "github.com/trufflesecurity/trufflehog/v3/pkg/detectors/bugherd" "github.com/trufflesecurity/trufflehog/v3/pkg/detectors/bugsnag" - "github.com/trufflesecurity/trufflehog/v3/pkg/detectors/buildkite" - "github.com/trufflesecurity/trufflehog/v3/pkg/detectors/buildkitev2" + buildKitev1 "github.com/trufflesecurity/trufflehog/v3/pkg/detectors/buildkite/v1" + buildKitev2 "github.com/trufflesecurity/trufflehog/v3/pkg/detectors/buildkite/v2" "github.com/trufflesecurity/trufflehog/v3/pkg/detectors/bulbul" "github.com/trufflesecurity/trufflehog/v3/pkg/detectors/bulksms" "github.com/trufflesecurity/trufflehog/v3/pkg/detectors/buttercms" @@ -934,8 +934,8 @@ func buildDetectorList() []detectors.Detector { &budibase.Scanner{}, &bugherd.Scanner{}, &bugsnag.Scanner{}, - &buildkite.Scanner{}, - &buildkitev2.Scanner{}, + &buildKitev1.Scanner{}, + &buildKitev2.Scanner{}, &bulbul.Scanner{}, &bulksms.Scanner{}, &buttercms.Scanner{},