[INS-339] Add New Relic User Key detector (#4794)

* add new relic user key detector

* extract region verification logic to separate method

* chore: regen protos, feature flag gating, add SecretParts

* chore: regen protos

---------

Co-authored-by: Muneeb Ullah Khan <[email protected]>
This commit is contained in:
Mustansir
2026-07-30 18:29:52 +05:00
committed by GitHub
co-authored by Muneeb Ullah Khan
parent 5ca8517781
commit e6fc3489dd
9 changed files with 407 additions and 6 deletions
+1
View File
@@ -566,6 +566,7 @@ func run(state overseer.State, logSync func() error) {
feature.DuoDetectorEnabled.Store(true)
feature.NewRelicLicenseKeyDetectorEnabled.Store(true)
feature.NewRelicBrowserKeyDetectorEnabled.Store(true)
feature.NewRelicUserKeyDetectorEnabled.Store(true)
conf := &config.Config{}
if *configFilename != "" {
@@ -0,0 +1,147 @@
package newrelicuserkey
import (
"context"
"encoding/json"
"errors"
"fmt"
"io"
"net/http"
"strings"
regexp "github.com/wasilibs/go-re2"
"github.com/trufflesecurity/trufflehog/v3/pkg/common"
"github.com/trufflesecurity/trufflehog/v3/pkg/detectors"
"github.com/trufflesecurity/trufflehog/v3/pkg/pb/detector_typepb"
)
type Scanner struct {
client *http.Client
}
// Ensure the Scanner satisfies the interfaces at compile time.
var _ detectors.Detector = (*Scanner)(nil)
var (
defaultClient = common.SaneHttpClient()
keyPat = regexp.MustCompile(`\b(NRAK-[A-Z0-9]{27})\b`)
)
func (s Scanner) getClient() *http.Client {
if s.client != nil {
return s.client
}
return defaultClient
}
// Keywords are used for efficiently pre-filtering chunks.
func (s Scanner) Keywords() []string { return []string{"nrak-"} }
func (s Scanner) Type() detector_typepb.DetectorType {
return detector_typepb.DetectorType_NewRelicUserKey
}
func (s Scanner) Description() string {
return "A New Relic User API Key is an authentication token used to query data from New Relic via the NerdGraph API or REST API, allowing users to access account data and perform read operations securely. It is primarily used for interacting with New Relic’s query and configuration services."
}
func (s Scanner) FromData(ctx context.Context, verify bool, data []byte) (results []detectors.Result, err error) {
dataStr := string(data)
matches := keyPat.FindAllStringSubmatch(dataStr, -1)
for _, match := range matches {
resMatch := strings.TrimSpace(match[1])
s1 := detectors.Result{
DetectorType: s.Type(),
Raw: []byte(resMatch),
Redacted: resMatch[:8] + "...",
SecretParts: map[string]string{
"key": resMatch,
},
}
if verify {
isVerified, extraData, verificationErr := s.verify(ctx, resMatch)
s1.Verified = isVerified
s1.ExtraData = extraData
if extraData != nil {
s1.SecretParts["region"] = extraData["region"]
}
s1.SetVerificationError(verificationErr)
}
results = append(results, s1)
}
return results, nil
}
type graphqlResponse struct {
Data struct {
RequestContext struct {
UserID string `json:"userId"`
} `json:"requestContext"`
} `json:"data"`
}
// verify checks if the provided key is valid by making a request to the New Relic NerdGraph API.
// It sends a POST request to the NerdGraph API. A valid key will result in a 200 OK response.
// Invalid key will return in 401 Unauthorized, and a key with incorrect region will return a 403 Forbidden.
// https://docs.newrelic.com/docs/apis/nerdgraph/get-started/introduction-new-relic-nerdgraph/
func (s Scanner) verify(ctx context.Context, key string) (bool, map[string]string, error) {
regionUrls := map[string]string{
"us": "https://api.newrelic.com/graphql",
"eu": "https://api.eu.newrelic.com/graphql",
}
errs := make([]error, 0, len(regionUrls))
for region, regionUrl := range regionUrls {
verified, extraData, err := s.verifyRegion(ctx, key, region, regionUrl)
if err != nil {
errs = append(errs, fmt.Errorf("error verifying region %s: %w", region, err))
continue
}
if verified {
return true, extraData, nil
}
}
return false, nil, errors.Join(errs...)
}
func (s Scanner) verifyRegion(ctx context.Context, key, region, regionUrl string) (bool, map[string]string, error) {
body := `{"query": "{ requestContext { userId } }"}`
req, err := http.NewRequestWithContext(
ctx, http.MethodPost, regionUrl, strings.NewReader(body))
if err != nil {
return false, nil, fmt.Errorf("error constructing request: %w", err)
}
req.Header.Set("Content-Type", "application/json")
req.Header.Set("API-Key", key)
client := s.getClient()
res, err := client.Do(req)
if err != nil {
return false, nil, fmt.Errorf("error making request: %w", err)
}
defer func() {
_, _ = io.Copy(io.Discard, res.Body)
_ = res.Body.Close()
}()
switch res.StatusCode {
case http.StatusOK:
var resp graphqlResponse
if err := json.NewDecoder(res.Body).Decode(&resp); err != nil {
return false, nil, fmt.Errorf("error decoding response for region %s: %w", region, err)
}
return true, map[string]string{"region": region, "user_id": resp.Data.RequestContext.UserID}, nil
case http.StatusUnauthorized, http.StatusForbidden:
// 401 means the key is invalid, 403 means the region is incorrect
return false, nil, nil
default:
return false, nil, fmt.Errorf("unexpected status code for region %s: %d", region, res.StatusCode)
}
}
@@ -0,0 +1,161 @@
//go:build detectors
// +build detectors
package newrelicuserkey
import (
"context"
"fmt"
"testing"
"time"
"github.com/kylelemons/godebug/pretty"
"github.com/trufflesecurity/trufflehog/v3/pkg/common"
"github.com/trufflesecurity/trufflehog/v3/pkg/detectors"
"github.com/trufflesecurity/trufflehog/v3/pkg/pb/detector_typepb"
)
func TestNewRelicUserKey_FromChunk(t *testing.T) {
ctx, cancel := context.WithTimeout(context.Background(), time.Second*5)
defer cancel()
testSecrets, err := common.GetSecret(ctx, "trufflehog-testing", "detectors6")
if err != nil {
t.Fatalf("could not get test secrets from GCP: %s", err)
}
key := testSecrets.MustGetField("NEW_RELIC_USER_KEY")
keyEU := testSecrets.MustGetField("NEW_RELIC_USER_KEY_EU")
keyInactive := "NRAK-GDJSS4QZORUYIC1OGTRNGQMT5VH"
type args struct {
ctx context.Context
data []byte
verify bool
}
tests := []struct {
name string
s Scanner
args args
want []detectors.Result
wantErr bool
}{
{
name: "found, verified",
s: Scanner{},
args: args{
ctx: context.Background(),
data: []byte(fmt.Sprintf("You can find a new relic user key %s within", key)),
verify: true,
},
want: []detectors.Result{
{
DetectorType: detector_typepb.DetectorType_NewRelicUserKey,
Verified: true,
ExtraData: map[string]string{
"region": "us",
"user_id": "1007651396",
},
SecretParts: map[string]string{
"key": key,
"region": "us",
},
},
},
wantErr: false,
},
{
name: "found eu, verified",
s: Scanner{},
args: args{
ctx: context.Background(),
data: []byte(fmt.Sprintf("You can find a new EU relic user key %s within", keyEU)),
verify: true,
},
want: []detectors.Result{
{
DetectorType: detector_typepb.DetectorType_NewRelicUserKey,
Verified: true,
ExtraData: map[string]string{
"region": "eu",
"user_id": "1007651478",
},
SecretParts: map[string]string{
"key": keyEU,
"region": "eu",
},
},
},
wantErr: false,
},
{
name: "found, unverified",
s: Scanner{},
args: args{
ctx: context.Background(),
data: []byte(fmt.Sprintf("You can find a new relic user key %s within", keyInactive)), // the secret would satisfy the regex but not pass validation
verify: true,
},
want: []detectors.Result{
{
DetectorType: detector_typepb.DetectorType_NewRelicUserKey,
Verified: false,
SecretParts: map[string]string{
"key": keyInactive,
},
},
},
wantErr: false,
},
{
name: "not found",
s: Scanner{},
args: args{
ctx: context.Background(),
data: []byte("You cannot find the secret within"),
verify: true,
},
want: nil,
wantErr: false,
},
}
for _, tt := range tests {
t.Run(tt.name, func(t *testing.T) {
s := Scanner{}
got, err := s.FromData(tt.args.ctx, tt.args.verify, tt.args.data)
if (err != nil) != tt.wantErr {
t.Errorf("NewRelicUserKey.FromData() error = %v, wantErr %v", err, tt.wantErr)
return
}
for i := range got {
if len(got[i].Raw) == 0 {
t.Fatalf("no raw secret present: \n %+v", got[i])
}
got[i].Raw = nil
if len(got[i].Redacted) == 0 {
t.Fatalf("no redacted secret present: \n %+v", got[i])
}
got[i].Redacted = ""
}
if diff := pretty.Compare(got, tt.want); diff != "" {
t.Errorf("NewRelicUserKey.FromData() %s diff: (-got +want)\n%s", tt.name, diff)
}
})
}
}
func BenchmarkFromData(benchmark *testing.B) {
ctx := context.Background()
s := Scanner{}
for name, data := range detectors.MustGetBenchmarkData() {
benchmark.Run(name, func(b *testing.B) {
b.ResetTimer()
for n := 0; n < b.N; n++ {
_, err := s.FromData(ctx, false, data)
if err != nil {
b.Fatal(err)
}
}
})
}
}
@@ -0,0 +1,80 @@
package newrelicuserkey
import (
"context"
"fmt"
"testing"
"github.com/google/go-cmp/cmp"
"github.com/trufflesecurity/trufflehog/v3/pkg/detectors"
"github.com/trufflesecurity/trufflehog/v3/pkg/engine/ahocorasick"
)
var (
validPattern = "NRAK-GDJSS4QZORUYIC1OGTRNGQMT5VH"
invalidPattern = "NRAK-GDJSS4QZORUYIC1OGTRNGQMT5V"
)
func TestNewRelicUserKey_Pattern(t *testing.T) {
d := Scanner{}
ahoCorasickCore := ahocorasick.NewAhoCorasickCore([]detectors.Detector{d})
tests := []struct {
name string
input string
want []string
}{
{
name: "valid pattern",
input: fmt.Sprintf("new relic user key = '%s'", validPattern),
want: []string{validPattern},
},
{
name: "invalid pattern",
input: fmt.Sprintf("new relic user key = '%s'", invalidPattern),
want: []string{},
},
}
for _, test := range tests {
t.Run(test.name, func(t *testing.T) {
matchedDetectors := ahoCorasickCore.FindDetectorMatches([]byte(test.input))
if len(matchedDetectors) == 0 {
t.Errorf("keywords '%v' not matched by: %s", d.Keywords(), test.input)
return
}
results, err := d.FromData(context.Background(), false, []byte(test.input))
if err != nil {
t.Errorf("error = %v", err)
return
}
if len(results) != len(test.want) {
if len(results) == 0 {
t.Errorf("did not receive result")
} else {
t.Errorf("expected %d results, only received %d", len(test.want), len(results))
}
return
}
actual := make(map[string]struct{}, len(results))
for _, r := range results {
if len(r.RawV2) > 0 {
actual[string(r.RawV2)] = struct{}{}
} else {
actual[string(r.Raw)] = struct{}{}
}
}
expected := make(map[string]struct{}, len(test.want))
for _, v := range test.want {
expected[v] = struct{}{}
}
if diff := cmp.Diff(expected, actual); diff != "" {
t.Errorf("%s diff: (-want +got)\n%s", test.name, diff)
}
})
}
}
+4
View File
@@ -514,6 +514,7 @@ import (
"github.com/trufflesecurity/trufflehog/v3/pkg/detectors/newrelicinsightsinsertkey"
"github.com/trufflesecurity/trufflehog/v3/pkg/detectors/newreliclicensekey"
"github.com/trufflesecurity/trufflehog/v3/pkg/detectors/newrelicpersonalapikey"
"github.com/trufflesecurity/trufflehog/v3/pkg/detectors/newrelicuserkey"
"github.com/trufflesecurity/trufflehog/v3/pkg/detectors/newsapi"
"github.com/trufflesecurity/trufflehog/v3/pkg/detectors/newscatcher"
"github.com/trufflesecurity/trufflehog/v3/pkg/detectors/nexmoapikey"
@@ -1429,6 +1430,7 @@ func buildDetectorList() []detectors.Detector {
&newrelicinsightsinsertkey.Scanner{},
&newreliclicensekey.Scanner{},
&newrelicpersonalapikey.Scanner{},
&newrelicuserkey.Scanner{},
&newsapi.Scanner{},
&newscatcher.Scanner{},
&nexmoapikey.Scanner{},
@@ -1872,6 +1874,8 @@ func buildDetectorList() []detectors.Detector {
return !feature.NewRelicLicenseKeyDetectorEnabled.Load()
case *newrelicbrowserkey.Scanner:
return !feature.NewRelicBrowserKeyDetectorEnabled.Load()
case *newrelicuserkey.Scanner:
return !feature.NewRelicUserKeyDetectorEnabled.Load()
default:
return false
}
+1
View File
@@ -147,6 +147,7 @@ var excludedFromDefaultList = map[detector_typepb.DetectorType]struct{}{
detector_typepb.DetectorType_Duo: {},
detector_typepb.DetectorType_NewRelicLicenseKey: {},
detector_typepb.DetectorType_NewRelicBrowserKey: {},
detector_typepb.DetectorType_NewRelicUserKey: {},
// Reserved / special types.
detector_typepb.DetectorType_CustomRegex: {}, // added dynamically via engine config, not via buildDetectorList()
+1
View File
@@ -44,6 +44,7 @@ var (
DuoDetectorEnabled atomic.Bool
NewRelicLicenseKeyDetectorEnabled atomic.Bool
NewRelicBrowserKeyDetectorEnabled atomic.Bool
NewRelicUserKeyDetectorEnabled atomic.Bool
)
type AtomicString struct {
+11 -6
View File
@@ -1119,6 +1119,7 @@ const (
DetectorType_Duo DetectorType = 1063
DetectorType_NewRelicLicenseKey DetectorType = 1064
DetectorType_NewRelicBrowserKey DetectorType = 1065
DetectorType_NewRelicUserKey DetectorType = 1066
)
// Enum value maps for DetectorType.
@@ -2186,6 +2187,7 @@ var (
1063: "Duo",
1064: "NewRelicLicenseKey",
1065: "NewRelicBrowserKey",
1066: "NewRelicUserKey",
}
DetectorType_value = map[string]int32{
"Alibaba": 0,
@@ -3250,6 +3252,7 @@ var (
"Duo": 1063,
"NewRelicLicenseKey": 1064,
"NewRelicBrowserKey": 1065,
"NewRelicUserKey": 1066,
}
)
@@ -3285,7 +3288,7 @@ var File_detector_type_proto protoreflect.FileDescriptor
var file_detector_type_proto_rawDesc = []byte{
0x0a, 0x13, 0x64, 0x65, 0x74, 0x65, 0x63, 0x74, 0x6f, 0x72, 0x5f, 0x74, 0x79, 0x70, 0x65, 0x2e,
0x70, 0x72, 0x6f, 0x74, 0x6f, 0x12, 0x0d, 0x64, 0x65, 0x74, 0x65, 0x63, 0x74, 0x6f, 0x72, 0x5f,
0x74, 0x79, 0x70, 0x65, 0x2a, 0xfb, 0x8a, 0x01, 0x0a, 0x0c, 0x44, 0x65, 0x74, 0x65, 0x63, 0x74,
0x74, 0x79, 0x70, 0x65, 0x2a, 0x91, 0x8b, 0x01, 0x0a, 0x0c, 0x44, 0x65, 0x74, 0x65, 0x63, 0x74,
0x6f, 0x72, 0x54, 0x79, 0x70, 0x65, 0x12, 0x0b, 0x0a, 0x07, 0x41, 0x6c, 0x69, 0x62, 0x61, 0x62,
0x61, 0x10, 0x00, 0x12, 0x08, 0x0a, 0x04, 0x41, 0x4d, 0x51, 0x50, 0x10, 0x01, 0x12, 0x07, 0x0a,
0x03, 0x41, 0x57, 0x53, 0x10, 0x02, 0x12, 0x09, 0x0a, 0x05, 0x41, 0x7a, 0x75, 0x72, 0x65, 0x10,
@@ -4397,11 +4400,13 @@ var file_detector_type_proto_rawDesc = []byte{
0x08, 0x12, 0x17, 0x0a, 0x12, 0x4e, 0x65, 0x77, 0x52, 0x65, 0x6c, 0x69, 0x63, 0x4c, 0x69, 0x63,
0x65, 0x6e, 0x73, 0x65, 0x4b, 0x65, 0x79, 0x10, 0xa8, 0x08, 0x12, 0x17, 0x0a, 0x12, 0x4e, 0x65,
0x77, 0x52, 0x65, 0x6c, 0x69, 0x63, 0x42, 0x72, 0x6f, 0x77, 0x73, 0x65, 0x72, 0x4b, 0x65, 0x79,
0x10, 0xa9, 0x08, 0x42, 0x41, 0x5a, 0x3f, 0x67, 0x69, 0x74, 0x68, 0x75, 0x62, 0x2e, 0x63, 0x6f,
0x6d, 0x2f, 0x74, 0x72, 0x75, 0x66, 0x66, 0x6c, 0x65, 0x73, 0x65, 0x63, 0x75, 0x72, 0x69, 0x74,
0x79, 0x2f, 0x74, 0x72, 0x75, 0x66, 0x66, 0x6c, 0x65, 0x68, 0x6f, 0x67, 0x2f, 0x76, 0x33, 0x2f,
0x70, 0x6b, 0x67, 0x2f, 0x70, 0x62, 0x2f, 0x64, 0x65, 0x74, 0x65, 0x63, 0x74, 0x6f, 0x72, 0x5f,
0x74, 0x79, 0x70, 0x65, 0x70, 0x62, 0x62, 0x06, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x33,
0x10, 0xa9, 0x08, 0x12, 0x14, 0x0a, 0x0f, 0x4e, 0x65, 0x77, 0x52, 0x65, 0x6c, 0x69, 0x63, 0x55,
0x73, 0x65, 0x72, 0x4b, 0x65, 0x79, 0x10, 0xaa, 0x08, 0x42, 0x41, 0x5a, 0x3f, 0x67, 0x69, 0x74,
0x68, 0x75, 0x62, 0x2e, 0x63, 0x6f, 0x6d, 0x2f, 0x74, 0x72, 0x75, 0x66, 0x66, 0x6c, 0x65, 0x73,
0x65, 0x63, 0x75, 0x72, 0x69, 0x74, 0x79, 0x2f, 0x74, 0x72, 0x75, 0x66, 0x66, 0x6c, 0x65, 0x68,
0x6f, 0x67, 0x2f, 0x76, 0x33, 0x2f, 0x70, 0x6b, 0x67, 0x2f, 0x70, 0x62, 0x2f, 0x64, 0x65, 0x74,
0x65, 0x63, 0x74, 0x6f, 0x72, 0x5f, 0x74, 0x79, 0x70, 0x65, 0x70, 0x62, 0x62, 0x06, 0x70, 0x72,
0x6f, 0x74, 0x6f, 0x33,
}
var (
+1
View File
@@ -1067,4 +1067,5 @@ enum DetectorType {
Duo = 1063;
NewRelicLicenseKey = 1064;
NewRelicBrowserKey = 1065;
NewRelicUserKey = 1066;
}