Compare commits
4 Commits
| Author | SHA1 | Date | |
|---|---|---|---|
 Bill Rich
|
5bbd45fdbe | ||
|
Bill Rich
|
77a20bead1 | ||
|
Bill Rich
|
426d77da20 | ||
|
Bill Rich
|
0e75e6b31a |
@@ -13,8 +13,6 @@ builds:
|
|||||||
dockers:
|
dockers:
|
||||||
- image_templates: ["trufflesecurity/{{ .ProjectName }}:{{ .Version }}-amd64"]
|
- image_templates: ["trufflesecurity/{{ .ProjectName }}:{{ .Version }}-amd64"]
|
||||||
dockerfile: Dockerfile.goreleaser
|
dockerfile: Dockerfile.goreleaser
|
||||||
extra_files:
|
|
||||||
- entrypoint.sh
|
|
||||||
use: buildx
|
use: buildx
|
||||||
build_flag_templates:
|
build_flag_templates:
|
||||||
- --platform=linux/amd64
|
- --platform=linux/amd64
|
||||||
@@ -28,8 +26,6 @@ dockers:
|
|||||||
- image_templates: ["trufflesecurity/{{ .ProjectName }}:{{ .Version }}-arm64v8"]
|
- image_templates: ["trufflesecurity/{{ .ProjectName }}:{{ .Version }}-arm64v8"]
|
||||||
goarch: arm64
|
goarch: arm64
|
||||||
dockerfile: Dockerfile.goreleaser
|
dockerfile: Dockerfile.goreleaser
|
||||||
extra_files:
|
|
||||||
- entrypoint.sh
|
|
||||||
use: buildx
|
use: buildx
|
||||||
build_flag_templates:
|
build_flag_templates:
|
||||||
- --platform=linux/arm64/v8
|
- --platform=linux/arm64/v8
|
||||||
@@ -42,8 +38,6 @@ dockers:
|
|||||||
- --label=org.opencontainers.image.licenses=AGPL-3.0
|
- --label=org.opencontainers.image.licenses=AGPL-3.0
|
||||||
- image_templates: ["ghcr.io/trufflesecurity/{{ .ProjectName }}:{{ .Version }}-amd64"]
|
- image_templates: ["ghcr.io/trufflesecurity/{{ .ProjectName }}:{{ .Version }}-amd64"]
|
||||||
dockerfile: Dockerfile.goreleaser
|
dockerfile: Dockerfile.goreleaser
|
||||||
extra_files:
|
|
||||||
- entrypoint.sh
|
|
||||||
use: buildx
|
use: buildx
|
||||||
build_flag_templates:
|
build_flag_templates:
|
||||||
- --platform=linux/amd64
|
- --platform=linux/amd64
|
||||||
@@ -57,8 +51,6 @@ dockers:
|
|||||||
- image_templates: ["ghcr.io/trufflesecurity/{{ .ProjectName }}:{{ .Version }}-arm64v8"]
|
- image_templates: ["ghcr.io/trufflesecurity/{{ .ProjectName }}:{{ .Version }}-arm64v8"]
|
||||||
goarch: arm64
|
goarch: arm64
|
||||||
dockerfile: Dockerfile.goreleaser
|
dockerfile: Dockerfile.goreleaser
|
||||||
extra_files:
|
|
||||||
- entrypoint.sh
|
|
||||||
use: buildx
|
use: buildx
|
||||||
build_flag_templates:
|
build_flag_templates:
|
||||||
- --platform=linux/arm64/v8
|
- --platform=linux/arm64/v8
|
||||||
|
|||||||
+7
-12
@@ -1,18 +1,13 @@
|
|||||||
FROM --platform=${BUILDPLATFORM} golang:bullseye as builder
|
FROM golang:bullseye as builder
|
||||||
|
|
||||||
WORKDIR /build
|
WORKDIR /build
|
||||||
|
COPY go.mod go.sum ./
|
||||||
|
RUN go mod download
|
||||||
COPY . .
|
COPY . .
|
||||||
ENV CGO_ENABLED=0
|
RUN CGO_ENABLED=0 go build -a -o trufflehog main.go
|
||||||
ARG TARGETOS TARGETARCH
|
|
||||||
RUN --mount=type=cache,target=/go/pkg/mod \
|
|
||||||
--mount=type=cache,target=/root/.cache/go-build \
|
|
||||||
GOOS=${TARGETOS} GOARCH=${TARGETARCH} go build -o trufflehog .
|
|
||||||
|
|
||||||
FROM alpine:3.15
|
FROM alpine:3.15
|
||||||
RUN apk add --no-cache git ca-certificates \
|
RUN apk add --no-cache git
|
||||||
&& rm -rf /var/cache/apk/* && \
|
COPY --from=builder /etc/ssl/certs/ca-certificates.crt /etc/ssl/certs/ca-certificates.crt
|
||||||
update-ca-certificates
|
|
||||||
COPY --from=builder /build/trufflehog /usr/bin/trufflehog
|
COPY --from=builder /build/trufflehog /usr/bin/trufflehog
|
||||||
COPY entrypoint.sh /etc/entrypoint.sh
|
ENTRYPOINT ["/usr/bin/trufflehog"]
|
||||||
RUN chmod +x /etc/entrypoint.sh
|
|
||||||
ENTRYPOINT ["/etc/entrypoint.sh"]
|
|
||||||
|
|||||||
@@ -1,10 +1,7 @@
|
|||||||
FROM alpine:3.15
|
FROM alpine:3.15
|
||||||
|
|
||||||
RUN apk add --no-cache git ca-certificates \
|
RUN apk add --no-cache git
|
||||||
&& rm -rf /var/cache/apk/* && \
|
|
||||||
update-ca-certificates
|
|
||||||
WORKDIR /usr/bin/
|
WORKDIR /usr/bin/
|
||||||
COPY trufflehog .
|
COPY trufflehog .
|
||||||
COPY entrypoint.sh /etc/entrypoint.sh
|
|
||||||
RUN chmod +x /etc/entrypoint.sh
|
ENTRYPOINT ["/usr/bin/trufflehog"]
|
||||||
ENTRYPOINT ["/etc/entrypoint.sh"]
|
|
||||||
|
|||||||
@@ -28,13 +28,13 @@ test-failing:
|
|||||||
CGO_ENABLED=0 go test -timeout=5m $(shell go list ./... | grep -v /vendor/) | grep FAIL
|
CGO_ENABLED=0 go test -timeout=5m $(shell go list ./... | grep -v /vendor/) | grep FAIL
|
||||||
|
|
||||||
test:
|
test:
|
||||||
CGO_ENABLED=0 go test -timeout=5m $(shell go list ./... | grep -v /vendor/ | grep -v pkg/detectors)
|
CGO_ENABLED=0 go test -timeout=5m $(shell go list ./... | grep -v /vendor/)
|
||||||
|
|
||||||
test-race:
|
test-race:
|
||||||
CGO_ENABLED=1 go test -timeout=5m -race $(shell go list ./... | grep -v /vendor/ | grep -v pkg/detectors)
|
CGO_ENABLED=1 go test -timeout=5m -race $(shell go list ./... | grep -v /vendor/)
|
||||||
|
|
||||||
test-detectors:
|
test-detectors:
|
||||||
CGO_ENABLED=0 go test -tags=detectors -timeout=5m $(shell go list ./... | grep pkg/detectors)
|
CGO_ENABLED=0 go test -tags=detectors -timeout=5m $(shell go list ./...)
|
||||||
|
|
||||||
bench:
|
bench:
|
||||||
CGO_ENABLED=0 go test $(shell go list ./pkg/secrets/... | grep -v /vendor/) -benchmem -run=xxx -bench .
|
CGO_ENABLED=0 go test $(shell go list ./pkg/secrets/... | grep -v /vendor/) -benchmem -run=xxx -bench .
|
||||||
@@ -57,6 +57,3 @@ release-protos-image:
|
|||||||
|
|
||||||
snifftest:
|
snifftest:
|
||||||
./hack/snifftest/snifftest.sh
|
./hack/snifftest/snifftest.sh
|
||||||
|
|
||||||
test-release:
|
|
||||||
goreleaser release --rm-dist --skip-publish --snapshot
|
|
||||||
@@ -6,14 +6,14 @@
|
|||||||
|
|
||||||
---
|
---
|
||||||
|
|
||||||
<div align="center">
|
<center>
|
||||||
|
|
||||||
[](https://github.com/trufflesecurity/trufflehog/actions)
|
[](https://github.com/trufflesecurity/trufflehog/actions)
|
||||||
[](https://goreportcard.com/report/github.com/trufflesecurity/trufflehog/v3)
|
[](https://goreportcard.com/report/github.com/trufflesecurity/trufflehog/v3)
|
||||||
[](/LICENSE)
|
[](/LICENSE)
|
||||||
[](/pkg/detectors)
|
[](/pkg/detectors) <!-- Badge must be run from staging, see badges/shields#5967 -->
|
||||||
|
|
||||||
</div>
|
</center>
|
||||||
|
|
||||||
---
|
---
|
||||||
|
|
||||||
@@ -169,8 +169,6 @@ docker run -it -v "$PWD:/pwd" trufflesecurity/trufflehog:latest github --org=tru
|
|||||||
base:
|
base:
|
||||||
# Scan commits until here (usually dev branch).
|
# Scan commits until here (usually dev branch).
|
||||||
head: # optional
|
head: # optional
|
||||||
# Extra args to be passed to the trufflehog cli.
|
|
||||||
extra_args: # optional
|
|
||||||
```
|
```
|
||||||
|
|
||||||
The TruffleHog OSS Github Action can be used to scan a range of commits for leaked credentials. The action will fail if
|
The TruffleHog OSS Github Action can be used to scan a range of commits for leaked credentials. The action will fail if
|
||||||
@@ -194,26 +192,6 @@ jobs:
|
|||||||
path: ./
|
path: ./
|
||||||
base: ${{ github.event.repository.default_branch }}
|
base: ${{ github.event.repository.default_branch }}
|
||||||
head: HEAD
|
head: HEAD
|
||||||
extra_args: --debug
|
|
||||||
```
|
|
||||||
|
|
||||||
### Precommit Hook
|
|
||||||
|
|
||||||
Trufflehog can be used in a precommit hook to prevent credentials from leaking before they ever leave your computer.
|
|
||||||
An example `.pre-commit-config.yaml` is provided (see [pre-commit.com](https://pre-commit.com/) for installation).
|
|
||||||
|
|
||||||
```yaml
|
|
||||||
repos:
|
|
||||||
- repo: local
|
|
||||||
hooks:
|
|
||||||
- id: trufflehog
|
|
||||||
name: TruffleHog
|
|
||||||
description: Detect secrets in your data.
|
|
||||||
entry: bash -c 'trufflehog git file://. --only-verified --fail'
|
|
||||||
# For running trufflehog in docker, use the following entry instead:
|
|
||||||
# entry: bash -c 'docker run -v "$(pwd):/workdir" -i --rm trufflesecurity/trufflehog:latest git file:///workdir --only-verified --fail'
|
|
||||||
language: system
|
|
||||||
stages: ["commit", "push"]
|
|
||||||
```
|
```
|
||||||
|
|
||||||
## Contributors
|
## Contributors
|
||||||
|
|||||||
@@ -12,10 +12,6 @@ inputs:
|
|||||||
head:
|
head:
|
||||||
description: Scan commits until here (usually dev branch).
|
description: Scan commits until here (usually dev branch).
|
||||||
required: false
|
required: false
|
||||||
extra_args:
|
|
||||||
default: ''
|
|
||||||
description: Extra args to be passed to the trufflehog cli.
|
|
||||||
required: false
|
|
||||||
branding:
|
branding:
|
||||||
icon: "shield"
|
icon: "shield"
|
||||||
color: "green"
|
color: "green"
|
||||||
@@ -30,4 +26,3 @@ runs:
|
|||||||
- --branch
|
- --branch
|
||||||
- ${{ inputs.head }}
|
- ${{ inputs.head }}
|
||||||
- --fail
|
- --fail
|
||||||
- ${{ inputs.extra_args }}
|
|
||||||
|
|||||||
Executable → Regular
+3
-4
@@ -1,5 +1,4 @@
|
|||||||
#!/usr/bin/env ash
|
#! /usr/bin/env bash
|
||||||
|
|
||||||
# `$*` expands the `args` supplied in an `array` individually
|
args=("$@")
|
||||||
# or splits `args` in a string separated by whitespace.
|
/usr/bin/trufflehog ${args[@]}
|
||||||
/usr/bin/trufflehog $*
|
|
||||||
@@ -4,18 +4,14 @@ go 1.18
|
|||||||
|
|
||||||
replace github.com/jpillora/overseer => github.com/trufflesecurity/overseer v1.1.7-custom5
|
replace github.com/jpillora/overseer => github.com/trufflesecurity/overseer v1.1.7-custom5
|
||||||
|
|
||||||
replace github.com/zricethezav/gitleaks/v8 => github.com/trufflesecurity/gitleaks/v8 v8.6.1-custom10
|
replace github.com/zricethezav/gitleaks/v8 => github.com/trufflesecurity/gitleaks/v8 v8.6.1-custom7
|
||||||
|
|
||||||
replace github.com/gitleaks/go-gitdiff => github.com/trufflesecurity/go-gitdiff v0.7.6-zombies2
|
replace github.com/gitleaks/go-gitdiff => github.com/trufflesecurity/go-gitdiff v0.7.6-zombies2
|
||||||
|
|
||||||
replace github.com/bill-rich/gitparser => /home/hrich/go/src/github.com/bill-rich/gitparse
|
|
||||||
|
|
||||||
require (
|
require (
|
||||||
cloud.google.com/go/secretmanager v1.5.0
|
cloud.google.com/go/secretmanager v1.5.0
|
||||||
github.com/Azure/go-autorest/autorest/azure/auth v0.5.11
|
github.com/Azure/go-autorest/autorest/azure/auth v0.5.11
|
||||||
github.com/aws/aws-sdk-go v1.44.61
|
github.com/aws/aws-sdk-go v1.44.56
|
||||||
github.com/bill-rich/disk-buffer-reader v0.1.2
|
|
||||||
github.com/bill-rich/gitparser v0.0.0-00010101000000-000000000000
|
|
||||||
github.com/bill-rich/go-syslog v0.0.0-20220413021637-49edb52a574c
|
github.com/bill-rich/go-syslog v0.0.0-20220413021637-49edb52a574c
|
||||||
github.com/bitfinexcom/bitfinex-api-go v0.0.0-20210608095005-9e0b26f200fb
|
github.com/bitfinexcom/bitfinex-api-go v0.0.0-20210608095005-9e0b26f200fb
|
||||||
github.com/bradleyfalzon/ghinstallation/v2 v2.1.0
|
github.com/bradleyfalzon/ghinstallation/v2 v2.1.0
|
||||||
@@ -23,6 +19,7 @@ require (
|
|||||||
github.com/envoyproxy/protoc-gen-validate v0.6.7
|
github.com/envoyproxy/protoc-gen-validate v0.6.7
|
||||||
github.com/fatih/color v1.13.0
|
github.com/fatih/color v1.13.0
|
||||||
github.com/felixge/fgprof v0.9.2
|
github.com/felixge/fgprof v0.9.2
|
||||||
|
github.com/gitleaks/go-gitdiff v0.7.4
|
||||||
github.com/go-errors/errors v1.4.2
|
github.com/go-errors/errors v1.4.2
|
||||||
github.com/go-git/go-git/v5 v5.4.2
|
github.com/go-git/go-git/v5 v5.4.2
|
||||||
github.com/golang-jwt/jwt v3.2.2+incompatible
|
github.com/golang-jwt/jwt v3.2.2+incompatible
|
||||||
@@ -40,17 +37,17 @@ require (
|
|||||||
github.com/razorpay/razorpay-go v0.0.0-20210728161131-0341409a6ab2
|
github.com/razorpay/razorpay-go v0.0.0-20210728161131-0341409a6ab2
|
||||||
github.com/rs/zerolog v1.27.0
|
github.com/rs/zerolog v1.27.0
|
||||||
github.com/sergi/go-diff v1.2.0
|
github.com/sergi/go-diff v1.2.0
|
||||||
github.com/sirupsen/logrus v1.9.0
|
github.com/sirupsen/logrus v1.8.1
|
||||||
github.com/stretchr/testify v1.8.0
|
github.com/stretchr/testify v1.8.0
|
||||||
github.com/tailscale/depaware v0.0.0-20210622194025-720c4b409502
|
github.com/tailscale/depaware v0.0.0-20210622194025-720c4b409502
|
||||||
github.com/xanzy/go-gitlab v0.69.0
|
github.com/xanzy/go-gitlab v0.69.0
|
||||||
github.com/zricethezav/gitleaks/v8 v8.10.3
|
github.com/zricethezav/gitleaks/v8 v8.5.2
|
||||||
golang.org/x/crypto v0.0.0-20211215165025-cf75a172585e
|
golang.org/x/crypto v0.0.0-20211215165025-cf75a172585e
|
||||||
golang.org/x/net v0.0.0-20220617184016-355a448f1bc9
|
golang.org/x/net v0.0.0-20220617184016-355a448f1bc9
|
||||||
golang.org/x/oauth2 v0.0.0-20220608161450-d0670ef3b1eb
|
golang.org/x/oauth2 v0.0.0-20220608161450-d0670ef3b1eb
|
||||||
golang.org/x/sync v0.0.0-20220601150217-0de741cfad7f
|
golang.org/x/sync v0.0.0-20220601150217-0de741cfad7f
|
||||||
google.golang.org/genproto v0.0.0-20220617124728-180714bec0ad
|
google.golang.org/genproto v0.0.0-20220617124728-180714bec0ad
|
||||||
google.golang.org/protobuf v1.28.1
|
google.golang.org/protobuf v1.28.0
|
||||||
gopkg.in/alecthomas/kingpin.v2 v2.2.6
|
gopkg.in/alecthomas/kingpin.v2 v2.2.6
|
||||||
gopkg.in/h2non/gock.v1 v1.1.2
|
gopkg.in/h2non/gock.v1 v1.1.2
|
||||||
)
|
)
|
||||||
@@ -76,7 +73,6 @@ require (
|
|||||||
github.com/dimchansky/utfbom v1.1.1 // indirect
|
github.com/dimchansky/utfbom v1.1.1 // indirect
|
||||||
github.com/dsnet/compress v0.0.1 // indirect
|
github.com/dsnet/compress v0.0.1 // indirect
|
||||||
github.com/emirpasic/gods v1.12.0 // indirect
|
github.com/emirpasic/gods v1.12.0 // indirect
|
||||||
github.com/gitleaks/go-gitdiff v0.7.6 // indirect
|
|
||||||
github.com/go-git/gcfg v1.5.0 // indirect
|
github.com/go-git/gcfg v1.5.0 // indirect
|
||||||
github.com/go-git/go-billy/v5 v5.3.1 // indirect
|
github.com/go-git/go-billy/v5 v5.3.1 // indirect
|
||||||
github.com/go-ole/go-ole v1.2.6 // indirect
|
github.com/go-ole/go-ole v1.2.6 // indirect
|
||||||
@@ -87,7 +83,7 @@ require (
|
|||||||
github.com/google/go-cmp v0.5.8 // indirect
|
github.com/google/go-cmp v0.5.8 // indirect
|
||||||
github.com/google/go-github/v45 v45.2.0 // indirect
|
github.com/google/go-github/v45 v45.2.0 // indirect
|
||||||
github.com/google/go-querystring v1.1.0 // indirect
|
github.com/google/go-querystring v1.1.0 // indirect
|
||||||
github.com/google/pprof v0.0.0-20220729232143-a41b82acbcb1 // indirect
|
github.com/google/pprof v0.0.0-20211214055906-6f57359322fd // indirect
|
||||||
github.com/googleapis/enterprise-certificate-proxy v0.1.0 // indirect
|
github.com/googleapis/enterprise-certificate-proxy v0.1.0 // indirect
|
||||||
github.com/googleapis/gax-go/v2 v2.4.0 // indirect
|
github.com/googleapis/gax-go/v2 v2.4.0 // indirect
|
||||||
github.com/h2non/parth v0.0.0-20190131123155-b4df798d6542 // indirect
|
github.com/h2non/parth v0.0.0-20190131123155-b4df798d6542 // indirect
|
||||||
@@ -111,7 +107,7 @@ require (
|
|||||||
github.com/yusufpapurcu/wmi v1.2.2 // indirect
|
github.com/yusufpapurcu/wmi v1.2.2 // indirect
|
||||||
go.opencensus.io v0.23.0 // indirect
|
go.opencensus.io v0.23.0 // indirect
|
||||||
golang.org/x/mod v0.5.0 // indirect
|
golang.org/x/mod v0.5.0 // indirect
|
||||||
golang.org/x/sys v0.0.0-20220811171246-fbc7d0a398ab // indirect
|
golang.org/x/sys v0.0.0-20220615213510-4f61da869c0c // indirect
|
||||||
golang.org/x/text v0.3.7 // indirect
|
golang.org/x/text v0.3.7 // indirect
|
||||||
golang.org/x/time v0.0.0-20220411224347-583f2d630306 // indirect
|
golang.org/x/time v0.0.0-20220411224347-583f2d630306 // indirect
|
||||||
golang.org/x/tools v0.1.7 // indirect
|
golang.org/x/tools v0.1.7 // indirect
|
||||||
|
|||||||
@@ -98,10 +98,8 @@ github.com/anmitsu/go-shlex v0.0.0-20161002113705-648efa622239/go.mod h1:2FmKhYU
|
|||||||
github.com/antihax/optional v1.0.0/go.mod h1:uupD/76wgC+ih3iEmQUL+0Ugr19nfwCT1kdvxnR2qWY=
|
github.com/antihax/optional v1.0.0/go.mod h1:uupD/76wgC+ih3iEmQUL+0Ugr19nfwCT1kdvxnR2qWY=
|
||||||
github.com/armon/go-socks5 v0.0.0-20160902184237-e75332964ef5 h1:0CwZNZbxp69SHPdPJAN/hZIm0C4OItdklCFmMRWYpio=
|
github.com/armon/go-socks5 v0.0.0-20160902184237-e75332964ef5 h1:0CwZNZbxp69SHPdPJAN/hZIm0C4OItdklCFmMRWYpio=
|
||||||
github.com/armon/go-socks5 v0.0.0-20160902184237-e75332964ef5/go.mod h1:wHh0iHkYZB8zMSxRWpUBQtwG5a7fFgvEO+odwuTv2gs=
|
github.com/armon/go-socks5 v0.0.0-20160902184237-e75332964ef5/go.mod h1:wHh0iHkYZB8zMSxRWpUBQtwG5a7fFgvEO+odwuTv2gs=
|
||||||
github.com/aws/aws-sdk-go v1.44.61 h1:NcpLSS3Z0MiVQIYugx4I40vSIEEAXT0baO684ExNRco=
|
github.com/aws/aws-sdk-go v1.44.56 h1:bT+lExwagH7djxb6InKUVkEKGPAj5aAPnV85/m1fKro=
|
||||||
github.com/aws/aws-sdk-go v1.44.61/go.mod h1:y4AeaBuwd2Lk+GepC1E9v0qOiTws0MIWAX4oIKwKHZo=
|
github.com/aws/aws-sdk-go v1.44.56/go.mod h1:y4AeaBuwd2Lk+GepC1E9v0qOiTws0MIWAX4oIKwKHZo=
|
||||||
github.com/bill-rich/disk-buffer-reader v0.1.2 h1:pN9K5JoacTcNWp2SCd3n7mPouSwMP9ouTS66Qa+5IPY=
|
|
||||||
github.com/bill-rich/disk-buffer-reader v0.1.2/go.mod h1:VVzzsK1Ac2AnpOfp/5r9JlIFaFkZ9uSf7zisZayCt0Y=
|
|
||||||
github.com/bill-rich/go-syslog v0.0.0-20220413021637-49edb52a574c h1:tSME5FDS02qQll3JYodI6RZR/g4EKOHApGv1wMZT+Z0=
|
github.com/bill-rich/go-syslog v0.0.0-20220413021637-49edb52a574c h1:tSME5FDS02qQll3JYodI6RZR/g4EKOHApGv1wMZT+Z0=
|
||||||
github.com/bill-rich/go-syslog v0.0.0-20220413021637-49edb52a574c/go.mod h1:+sCc6hztur+oZCLOsNk6wCCy+GLrnSNHSRmTnnL+8iQ=
|
github.com/bill-rich/go-syslog v0.0.0-20220413021637-49edb52a574c/go.mod h1:+sCc6hztur+oZCLOsNk6wCCy+GLrnSNHSRmTnnL+8iQ=
|
||||||
github.com/bitfinexcom/bitfinex-api-go v0.0.0-20210608095005-9e0b26f200fb h1:9v7Bzlg+1EBYi2IYcUmOwHReBEfqBbYIj3ZCi9cIe1Q=
|
github.com/bitfinexcom/bitfinex-api-go v0.0.0-20210608095005-9e0b26f200fb h1:9v7Bzlg+1EBYi2IYcUmOwHReBEfqBbYIj3ZCi9cIe1Q=
|
||||||
@@ -260,9 +258,8 @@ github.com/google/pprof v0.0.0-20210226084205-cbba55b83ad5/go.mod h1:kpwsk12EmLe
|
|||||||
github.com/google/pprof v0.0.0-20210601050228-01bbb1931b22/go.mod h1:kpwsk12EmLew5upagYY7GY0pfYCcupk39gWOCRROcvE=
|
github.com/google/pprof v0.0.0-20210601050228-01bbb1931b22/go.mod h1:kpwsk12EmLew5upagYY7GY0pfYCcupk39gWOCRROcvE=
|
||||||
github.com/google/pprof v0.0.0-20210609004039-a478d1d731e9/go.mod h1:kpwsk12EmLew5upagYY7GY0pfYCcupk39gWOCRROcvE=
|
github.com/google/pprof v0.0.0-20210609004039-a478d1d731e9/go.mod h1:kpwsk12EmLew5upagYY7GY0pfYCcupk39gWOCRROcvE=
|
||||||
github.com/google/pprof v0.0.0-20210720184732-4bb14d4b1be1/go.mod h1:kpwsk12EmLew5upagYY7GY0pfYCcupk39gWOCRROcvE=
|
github.com/google/pprof v0.0.0-20210720184732-4bb14d4b1be1/go.mod h1:kpwsk12EmLew5upagYY7GY0pfYCcupk39gWOCRROcvE=
|
||||||
|
github.com/google/pprof v0.0.0-20211214055906-6f57359322fd h1:1FjCyPC+syAzJ5/2S8fqdZK1R22vvA0J7JZKcuOIQ7Y=
|
||||||
github.com/google/pprof v0.0.0-20211214055906-6f57359322fd/go.mod h1:KgnwoLYCZ8IQu3XUZ8Nc/bM9CCZFOyjUNOSygVozoDg=
|
github.com/google/pprof v0.0.0-20211214055906-6f57359322fd/go.mod h1:KgnwoLYCZ8IQu3XUZ8Nc/bM9CCZFOyjUNOSygVozoDg=
|
||||||
github.com/google/pprof v0.0.0-20220729232143-a41b82acbcb1 h1:8pyqKJvrJqUYaKS851Ule26pwWvey6IDMiczaBLDKLQ=
|
|
||||||
github.com/google/pprof v0.0.0-20220729232143-a41b82acbcb1/go.mod h1:gSuNB+gJaOiQKLEZ+q+PK9Mq3SOzhRcw2GsGS/FhYDk=
|
|
||||||
github.com/google/renameio v0.1.0/go.mod h1:KWCgfxg9yswjAJkECMjeO8J8rahYeXnNhOm40UhjYkI=
|
github.com/google/renameio v0.1.0/go.mod h1:KWCgfxg9yswjAJkECMjeO8J8rahYeXnNhOm40UhjYkI=
|
||||||
github.com/google/uuid v1.1.2/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
|
github.com/google/uuid v1.1.2/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
|
||||||
github.com/googleapis/enterprise-certificate-proxy v0.0.0-20220520183353-fd19c99a87aa/go.mod h1:17drOmN3MwGY7t0e+Ei9b45FFGA3fBs3x36SsCg1hq8=
|
github.com/googleapis/enterprise-certificate-proxy v0.0.0-20220520183353-fd19c99a87aa/go.mod h1:17drOmN3MwGY7t0e+Ei9b45FFGA3fBs3x36SsCg1hq8=
|
||||||
@@ -377,8 +374,8 @@ github.com/sergi/go-diff v1.1.0/go.mod h1:STckp+ISIX8hZLjrqAeVduY0gWCT9IjLuqbuNX
|
|||||||
github.com/sergi/go-diff v1.2.0 h1:XU+rvMAioB0UC3q1MFrIQy4Vo5/4VsRDQQXHsEya6xQ=
|
github.com/sergi/go-diff v1.2.0 h1:XU+rvMAioB0UC3q1MFrIQy4Vo5/4VsRDQQXHsEya6xQ=
|
||||||
github.com/sergi/go-diff v1.2.0/go.mod h1:STckp+ISIX8hZLjrqAeVduY0gWCT9IjLuqbuNXdaHfM=
|
github.com/sergi/go-diff v1.2.0/go.mod h1:STckp+ISIX8hZLjrqAeVduY0gWCT9IjLuqbuNXdaHfM=
|
||||||
github.com/sirupsen/logrus v1.4.1/go.mod h1:ni0Sbl8bgC9z8RoU9G6nDWqqs/fq4eDPysMBDgk/93Q=
|
github.com/sirupsen/logrus v1.4.1/go.mod h1:ni0Sbl8bgC9z8RoU9G6nDWqqs/fq4eDPysMBDgk/93Q=
|
||||||
github.com/sirupsen/logrus v1.9.0 h1:trlNQbNUG3OdDrDil03MCb1H2o9nJ1x4/5LYw7byDE0=
|
github.com/sirupsen/logrus v1.8.1 h1:dJKuHgqk1NNQlqoA6BTlM1Wf9DOH3NBjQyu0h9+AZZE=
|
||||||
github.com/sirupsen/logrus v1.9.0/go.mod h1:naHLuLoDiP4jHNo9R0sCBMtWGeIprob74mVsIT4qYEQ=
|
github.com/sirupsen/logrus v1.8.1/go.mod h1:yWOB1SBYBC5VeMP7gHvWumXLIWorT60ONWic61uBYv0=
|
||||||
github.com/smartystreets/assertions v1.0.1 h1:voD4ITNjPL5jjBfgR/r8fPIIBrliWrWHeiJApdr3r4w=
|
github.com/smartystreets/assertions v1.0.1 h1:voD4ITNjPL5jjBfgR/r8fPIIBrliWrWHeiJApdr3r4w=
|
||||||
github.com/smartystreets/assertions v1.0.1/go.mod h1:kHHU4qYBaI3q23Pp3VPrmWhuIUrLW/7eUrw0BU5VaoM=
|
github.com/smartystreets/assertions v1.0.1/go.mod h1:kHHU4qYBaI3q23Pp3VPrmWhuIUrLW/7eUrw0BU5VaoM=
|
||||||
github.com/smartystreets/gunit v1.1.3 h1:32x+htJCu3aMswhPw3teoJ+PnWPONqdNgaGs6Qt8ZaU=
|
github.com/smartystreets/gunit v1.1.3 h1:32x+htJCu3aMswhPw3teoJ+PnWPONqdNgaGs6Qt8ZaU=
|
||||||
@@ -401,8 +398,8 @@ github.com/tailscale/depaware v0.0.0-20210622194025-720c4b409502 h1:34icjjmqJ2HP
|
|||||||
github.com/tailscale/depaware v0.0.0-20210622194025-720c4b409502/go.mod h1:p9lPsd+cx33L3H9nNoecRRxPssFKUwwI50I3pZ0yT+8=
|
github.com/tailscale/depaware v0.0.0-20210622194025-720c4b409502/go.mod h1:p9lPsd+cx33L3H9nNoecRRxPssFKUwwI50I3pZ0yT+8=
|
||||||
github.com/therootcompany/xz v1.0.1 h1:CmOtsn1CbtmyYiusbfmhmkpAAETj0wBIH6kCYaX+xzw=
|
github.com/therootcompany/xz v1.0.1 h1:CmOtsn1CbtmyYiusbfmhmkpAAETj0wBIH6kCYaX+xzw=
|
||||||
github.com/therootcompany/xz v1.0.1/go.mod h1:3K3UH1yCKgBneZYhuQUvJ9HPD19UEXEI0BWbMn8qNMY=
|
github.com/therootcompany/xz v1.0.1/go.mod h1:3K3UH1yCKgBneZYhuQUvJ9HPD19UEXEI0BWbMn8qNMY=
|
||||||
github.com/trufflesecurity/gitleaks/v8 v8.6.1-custom10 h1:QuGZ5bJcQpVz+3sfvKKPDkQwdUueiBg0V+2eMHzkryo=
|
github.com/trufflesecurity/gitleaks/v8 v8.6.1-custom7 h1:K4Ah1RMmlKjvIwLEdn9kADugbTd9AM7RYxVOsrkmcTk=
|
||||||
github.com/trufflesecurity/gitleaks/v8 v8.6.1-custom10/go.mod h1:2iZpX4Epnmx7VK2atbIMEjHW9rivie5RRe0ZhPWUFvM=
|
github.com/trufflesecurity/gitleaks/v8 v8.6.1-custom7/go.mod h1:2iZpX4Epnmx7VK2atbIMEjHW9rivie5RRe0ZhPWUFvM=
|
||||||
github.com/trufflesecurity/go-gitdiff v0.7.6-zombies2 h1:srCJzbE3b44+ZIPcgJSfvinHCOQlkMwVghtKf23un6o=
|
github.com/trufflesecurity/go-gitdiff v0.7.6-zombies2 h1:srCJzbE3b44+ZIPcgJSfvinHCOQlkMwVghtKf23un6o=
|
||||||
github.com/trufflesecurity/go-gitdiff v0.7.6-zombies2/go.mod h1:pKz0X4YzCKZs30BL+weqBIG7mx0jl4tF1uXV9ZyNvrA=
|
github.com/trufflesecurity/go-gitdiff v0.7.6-zombies2/go.mod h1:pKz0X4YzCKZs30BL+weqBIG7mx0jl4tF1uXV9ZyNvrA=
|
||||||
github.com/trufflesecurity/overseer v1.1.7-custom5 h1:xu+Fg6fkSRifUPzUCl7N8HmobJ6WGOkIApGnM7mJS6w=
|
github.com/trufflesecurity/overseer v1.1.7-custom5 h1:xu+Fg6fkSRifUPzUCl7N8HmobJ6WGOkIApGnM7mJS6w=
|
||||||
@@ -573,6 +570,7 @@ golang.org/x/sys v0.0.0-20190624142023-c5567b49c5d0/go.mod h1:h1NjWce9XRLGQEsW7w
|
|||||||
golang.org/x/sys v0.0.0-20190726091711-fc99dfbffb4e/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
|
golang.org/x/sys v0.0.0-20190726091711-fc99dfbffb4e/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
|
||||||
golang.org/x/sys v0.0.0-20190916202348-b4ddaad3f8a3/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
|
golang.org/x/sys v0.0.0-20190916202348-b4ddaad3f8a3/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
|
||||||
golang.org/x/sys v0.0.0-20191001151750-bb3f8db39f24/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
|
golang.org/x/sys v0.0.0-20191001151750-bb3f8db39f24/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
|
||||||
|
golang.org/x/sys v0.0.0-20191026070338-33540a1f6037/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
|
||||||
golang.org/x/sys v0.0.0-20191204072324-ce4227a45e2e/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
|
golang.org/x/sys v0.0.0-20191204072324-ce4227a45e2e/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
|
||||||
golang.org/x/sys v0.0.0-20191228213918-04cbcbbfeed8/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
|
golang.org/x/sys v0.0.0-20191228213918-04cbcbbfeed8/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
|
||||||
golang.org/x/sys v0.0.0-20200113162924-86b910548bc1/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
|
golang.org/x/sys v0.0.0-20200113162924-86b910548bc1/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
|
||||||
@@ -627,10 +625,8 @@ golang.org/x/sys v0.0.0-20220502124256-b6088ccd6cba/go.mod h1:oPkhp1MJrh7nUepCBc
|
|||||||
golang.org/x/sys v0.0.0-20220503163025-988cb79eb6c6/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
|
golang.org/x/sys v0.0.0-20220503163025-988cb79eb6c6/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
|
||||||
golang.org/x/sys v0.0.0-20220520151302-bc2c85ada10a/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
|
golang.org/x/sys v0.0.0-20220520151302-bc2c85ada10a/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
|
||||||
golang.org/x/sys v0.0.0-20220610221304-9f5ed59c137d/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
|
golang.org/x/sys v0.0.0-20220610221304-9f5ed59c137d/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
|
||||||
|
golang.org/x/sys v0.0.0-20220615213510-4f61da869c0c h1:aFV+BgZ4svzjfabn8ERpuB4JI4N6/rdy1iusx77G3oU=
|
||||||
golang.org/x/sys v0.0.0-20220615213510-4f61da869c0c/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
|
golang.org/x/sys v0.0.0-20220615213510-4f61da869c0c/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
|
||||||
golang.org/x/sys v0.0.0-20220715151400-c0bba94af5f8/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
|
|
||||||
golang.org/x/sys v0.0.0-20220811171246-fbc7d0a398ab h1:2QkjZIsXupsJbJIdSjjUOgWK3aEtzyuh2mPt3l/CkeU=
|
|
||||||
golang.org/x/sys v0.0.0-20220811171246-fbc7d0a398ab/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
|
|
||||||
golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo=
|
golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo=
|
||||||
golang.org/x/term v0.0.0-20210927222741-03fcf44c2211 h1:JGgROgKl9N8DuW20oFS5gxc+lE67/N3FcwmBPMe7ArY=
|
golang.org/x/term v0.0.0-20210927222741-03fcf44c2211 h1:JGgROgKl9N8DuW20oFS5gxc+lE67/N3FcwmBPMe7ArY=
|
||||||
golang.org/x/term v0.0.0-20210927222741-03fcf44c2211/go.mod h1:jbD1KX2456YbFQfuXm/mYQcufACuNUgVhRMnK/tPxf8=
|
golang.org/x/term v0.0.0-20210927222741-03fcf44c2211/go.mod h1:jbD1KX2456YbFQfuXm/mYQcufACuNUgVhRMnK/tPxf8=
|
||||||
@@ -886,9 +882,8 @@ google.golang.org/protobuf v1.25.0/go.mod h1:9JNX74DMeImyA3h4bdi1ymwjUzf21/xIlba
|
|||||||
google.golang.org/protobuf v1.26.0-rc.1/go.mod h1:jlhhOSvTdKEhbULTjvd4ARK9grFBp09yW+WbY/TyQbw=
|
google.golang.org/protobuf v1.26.0-rc.1/go.mod h1:jlhhOSvTdKEhbULTjvd4ARK9grFBp09yW+WbY/TyQbw=
|
||||||
google.golang.org/protobuf v1.26.0/go.mod h1:9q0QmTI4eRPtz6boOQmLYwt+qCgq0jsYwAQnmE0givc=
|
google.golang.org/protobuf v1.26.0/go.mod h1:9q0QmTI4eRPtz6boOQmLYwt+qCgq0jsYwAQnmE0givc=
|
||||||
google.golang.org/protobuf v1.27.1/go.mod h1:9q0QmTI4eRPtz6boOQmLYwt+qCgq0jsYwAQnmE0givc=
|
google.golang.org/protobuf v1.27.1/go.mod h1:9q0QmTI4eRPtz6boOQmLYwt+qCgq0jsYwAQnmE0givc=
|
||||||
|
google.golang.org/protobuf v1.28.0 h1:w43yiav+6bVFTBQFZX0r7ipe9JQ1QsbMgHwbBziscLw=
|
||||||
google.golang.org/protobuf v1.28.0/go.mod h1:HV8QOd/L58Z+nl8r43ehVNZIU/HEI6OcFqwMG9pJV4I=
|
google.golang.org/protobuf v1.28.0/go.mod h1:HV8QOd/L58Z+nl8r43ehVNZIU/HEI6OcFqwMG9pJV4I=
|
||||||
google.golang.org/protobuf v1.28.1 h1:d0NfwRgPtno5B1Wa6L2DAG+KivqkdutMf1UhdNx175w=
|
|
||||||
google.golang.org/protobuf v1.28.1/go.mod h1:HV8QOd/L58Z+nl8r43ehVNZIU/HEI6OcFqwMG9pJV4I=
|
|
||||||
gopkg.in/alecthomas/kingpin.v2 v2.2.6 h1:jMFz6MfLP0/4fUyZle81rXUoxOBFi19VUFKVDOQfozc=
|
gopkg.in/alecthomas/kingpin.v2 v2.2.6 h1:jMFz6MfLP0/4fUyZle81rXUoxOBFi19VUFKVDOQfozc=
|
||||||
gopkg.in/alecthomas/kingpin.v2 v2.2.6/go.mod h1:FMv+mEhP44yOT+4EoQTLFTRgOQ1FBLkstjWtayDeSgw=
|
gopkg.in/alecthomas/kingpin.v2 v2.2.6/go.mod h1:FMv+mEhP44yOT+4EoQTLFTRgOQ1FBLkstjWtayDeSgw=
|
||||||
gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
|
gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
|
||||||
|
|||||||
@@ -17,11 +17,9 @@ import (
|
|||||||
"github.com/gorilla/mux"
|
"github.com/gorilla/mux"
|
||||||
"github.com/jpillora/overseer"
|
"github.com/jpillora/overseer"
|
||||||
"github.com/sirupsen/logrus"
|
"github.com/sirupsen/logrus"
|
||||||
"gopkg.in/alecthomas/kingpin.v2"
|
|
||||||
|
|
||||||
"github.com/trufflesecurity/trufflehog/v3/pkg/sources"
|
|
||||||
"github.com/trufflesecurity/trufflehog/v3/pkg/updater"
|
"github.com/trufflesecurity/trufflehog/v3/pkg/updater"
|
||||||
"github.com/trufflesecurity/trufflehog/v3/pkg/version"
|
"github.com/trufflesecurity/trufflehog/v3/pkg/version"
|
||||||
|
"gopkg.in/alecthomas/kingpin.v2"
|
||||||
|
|
||||||
"github.com/trufflesecurity/trufflehog/v3/pkg/common"
|
"github.com/trufflesecurity/trufflehog/v3/pkg/common"
|
||||||
"github.com/trufflesecurity/trufflehog/v3/pkg/decoders"
|
"github.com/trufflesecurity/trufflehog/v3/pkg/decoders"
|
||||||
@@ -191,75 +189,36 @@ func run(state overseer.State) {
|
|||||||
if remote {
|
if remote {
|
||||||
defer os.RemoveAll(repoPath)
|
defer os.RemoveAll(repoPath)
|
||||||
}
|
}
|
||||||
|
err = e.ScanGit(ctx, repoPath, *gitScanBranch, *gitScanSinceCommit, *gitScanMaxDepth, filter)
|
||||||
config := sources.Config{
|
if err != nil {
|
||||||
RepoPath: repoPath,
|
logrus.WithError(err).Fatal("Failed to scan git.")
|
||||||
HeadRef: *gitScanBranch,
|
|
||||||
BaseRef: *gitScanSinceCommit,
|
|
||||||
MaxDepth: *gitScanMaxDepth,
|
|
||||||
Filter: filter,
|
|
||||||
}
|
|
||||||
|
|
||||||
if err = e.ScanGit(ctx, config); err != nil {
|
|
||||||
logrus.WithError(err).Fatal("Failed to scan Git.")
|
|
||||||
}
|
}
|
||||||
case githubScan.FullCommand():
|
case githubScan.FullCommand():
|
||||||
if len(*githubScanOrgs) == 0 && len(*githubScanRepos) == 0 {
|
if len(*githubScanOrgs) == 0 && len(*githubScanRepos) == 0 {
|
||||||
log.Fatal("You must specify at least one organization or repository.")
|
log.Fatal("You must specify at least one organization or repository.")
|
||||||
}
|
}
|
||||||
|
err = e.ScanGitHub(ctx, *githubScanEndpoint, *githubScanRepos, *githubScanOrgs, *githubScanToken, *githubIncludeForks, filter, *concurrency, *githubIncludeMembers)
|
||||||
github := func(c sources.Config) {
|
if err != nil {
|
||||||
c.Endpoint = *githubScanEndpoint
|
logrus.WithError(err).Fatal("Failed to scan git.")
|
||||||
c.Repos = *githubScanRepos
|
|
||||||
c.Orgs = *githubScanOrgs
|
|
||||||
c.Token = *githubScanToken
|
|
||||||
c.IncludeForks = *githubIncludeForks
|
|
||||||
c.IncludeMembers = *githubIncludeMembers
|
|
||||||
c.Concurrency = *concurrency
|
|
||||||
}
|
|
||||||
|
|
||||||
if err = e.ScanGitHub(ctx, sources.NewConfig(github)); err != nil {
|
|
||||||
logrus.WithError(err).Fatal("Failed to scan Github.")
|
|
||||||
}
|
}
|
||||||
case gitlabScan.FullCommand():
|
case gitlabScan.FullCommand():
|
||||||
gitlab := func(c sources.Config) {
|
err := e.ScanGitLab(ctx, *gitlabScanEndpoint, *gitlabScanToken, *gitlabScanRepos)
|
||||||
c.Endpoint = *gitlabScanEndpoint
|
if err != nil {
|
||||||
c.Token = *gitlabScanToken
|
|
||||||
c.Repos = *gitlabScanRepos
|
|
||||||
}
|
|
||||||
|
|
||||||
if err = e.ScanGitLab(ctx, sources.NewConfig(gitlab)); err != nil {
|
|
||||||
logrus.WithError(err).Fatal("Failed to scan GitLab.")
|
logrus.WithError(err).Fatal("Failed to scan GitLab.")
|
||||||
}
|
}
|
||||||
case filesystemScan.FullCommand():
|
case filesystemScan.FullCommand():
|
||||||
fs := func(c sources.Config) {
|
err := e.ScanFileSystem(ctx, *filesystemDirectories)
|
||||||
c.Directories = *filesystemDirectories
|
if err != nil {
|
||||||
}
|
|
||||||
|
|
||||||
if err = e.ScanFileSystem(ctx, sources.NewConfig(fs)); err != nil {
|
|
||||||
logrus.WithError(err).Fatal("Failed to scan filesystem")
|
logrus.WithError(err).Fatal("Failed to scan filesystem")
|
||||||
}
|
}
|
||||||
case s3Scan.FullCommand():
|
case s3Scan.FullCommand():
|
||||||
s3 := func(c sources.Config) {
|
err := e.ScanS3(ctx, *s3ScanKey, *s3ScanSecret, *s3ScanCloudEnv, *s3ScanBuckets)
|
||||||
c.Key = *s3ScanKey
|
if err != nil {
|
||||||
c.Secret = *s3ScanSecret
|
|
||||||
c.Buckets = *s3ScanBuckets
|
|
||||||
}
|
|
||||||
|
|
||||||
if err = e.ScanS3(ctx, sources.NewConfig(s3)); err != nil {
|
|
||||||
logrus.WithError(err).Fatal("Failed to scan S3.")
|
logrus.WithError(err).Fatal("Failed to scan S3.")
|
||||||
}
|
}
|
||||||
case syslogScan.FullCommand():
|
case syslogScan.FullCommand():
|
||||||
syslog := func(c sources.Config) {
|
err := e.ScanSyslog(ctx, *syslogAddress, *syslogProtocol, *syslogTLSCert, *syslogTLSKey, *syslogFormat, *concurrency)
|
||||||
c.Address = *syslogAddress
|
if err != nil {
|
||||||
c.Protocol = *syslogProtocol
|
|
||||||
c.CertPath = *syslogTLSCert
|
|
||||||
c.KeyPath = *syslogTLSKey
|
|
||||||
c.Format = *syslogFormat
|
|
||||||
c.Concurrency = *concurrency
|
|
||||||
}
|
|
||||||
|
|
||||||
if err = e.ScanSyslog(ctx, sources.NewConfig(syslog)); err != nil {
|
|
||||||
logrus.WithError(err).Fatal("Failed to scan syslog.")
|
logrus.WithError(err).Fatal("Failed to scan syslog.")
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
|
|||||||
@@ -1,36 +0,0 @@
|
|||||||
package common
|
|
||||||
|
|
||||||
import (
|
|
||||||
"bufio"
|
|
||||||
"errors"
|
|
||||||
"io"
|
|
||||||
|
|
||||||
log "github.com/sirupsen/logrus"
|
|
||||||
)
|
|
||||||
|
|
||||||
const (
|
|
||||||
ChunkSize = 10 * 1024
|
|
||||||
PeekSize = 3 * 1024
|
|
||||||
)
|
|
||||||
|
|
||||||
func ChunkReader(r io.Reader) chan []byte {
|
|
||||||
chunkChan := make(chan []byte)
|
|
||||||
go func() {
|
|
||||||
defer close(chunkChan)
|
|
||||||
reader := bufio.NewReaderSize(bufio.NewReader(r), ChunkSize)
|
|
||||||
for {
|
|
||||||
chunk := make([]byte, ChunkSize)
|
|
||||||
n, err := reader.Read(chunk)
|
|
||||||
if err != nil && !errors.Is(err, io.EOF) {
|
|
||||||
log.WithError(err).Error("Error chunking reader.")
|
|
||||||
break
|
|
||||||
}
|
|
||||||
peekData, _ := reader.Peek(PeekSize)
|
|
||||||
chunkChan <- append(chunk[:n], peekData...)
|
|
||||||
if errors.Is(err, io.EOF) {
|
|
||||||
break
|
|
||||||
}
|
|
||||||
}
|
|
||||||
}()
|
|
||||||
return chunkChan
|
|
||||||
}
|
|
||||||
@@ -1,75 +0,0 @@
|
|||||||
package common
|
|
||||||
|
|
||||||
import (
|
|
||||||
"bufio"
|
|
||||||
"bytes"
|
|
||||||
"errors"
|
|
||||||
"io"
|
|
||||||
"net/http"
|
|
||||||
"testing"
|
|
||||||
|
|
||||||
diskbufferreader "github.com/bill-rich/disk-buffer-reader"
|
|
||||||
)
|
|
||||||
|
|
||||||
func TestChunker(t *testing.T) {
|
|
||||||
resp, err := http.Get("https://raw.githubusercontent.com/bill-rich/bad-secrets/master/FifteenMB.gz")
|
|
||||||
if err != nil {
|
|
||||||
t.Fatal(err)
|
|
||||||
}
|
|
||||||
defer resp.Body.Close()
|
|
||||||
reReader, err := diskbufferreader.New(resp.Body)
|
|
||||||
if err != nil {
|
|
||||||
t.Fatal(err)
|
|
||||||
}
|
|
||||||
defer reReader.Close()
|
|
||||||
|
|
||||||
baseChunkCount := 0
|
|
||||||
|
|
||||||
// Count chunks from looping using chunk size.
|
|
||||||
for {
|
|
||||||
baseChunkCount++
|
|
||||||
tmpChunk := make([]byte, ChunkSize)
|
|
||||||
_, err := reReader.Read(tmpChunk)
|
|
||||||
if err != nil {
|
|
||||||
if errors.Is(err, io.EOF) {
|
|
||||||
break
|
|
||||||
}
|
|
||||||
t.Error(err)
|
|
||||||
}
|
|
||||||
}
|
|
||||||
_ = reReader.Reset()
|
|
||||||
|
|
||||||
// Get the first two chunks for comparing later.
|
|
||||||
baseChunkOne := make([]byte, ChunkSize)
|
|
||||||
baseChunkTwo := make([]byte, ChunkSize)
|
|
||||||
|
|
||||||
baseReader := bufio.NewReaderSize(reReader, ChunkSize)
|
|
||||||
_, _ = baseReader.Read(baseChunkOne)
|
|
||||||
peek, _ := baseReader.Peek(PeekSize)
|
|
||||||
baseChunkOne = append(baseChunkOne, peek...)
|
|
||||||
_, _ = baseReader.Read(baseChunkTwo)
|
|
||||||
peek, _ = baseReader.Peek(PeekSize)
|
|
||||||
baseChunkTwo = append(baseChunkTwo, peek...)
|
|
||||||
|
|
||||||
// Reset the reader to the beginning and use ChunkReader.
|
|
||||||
_ = reReader.Reset()
|
|
||||||
|
|
||||||
testChunkCount := 0
|
|
||||||
for chunk := range ChunkReader(reReader) {
|
|
||||||
testChunkCount++
|
|
||||||
switch testChunkCount {
|
|
||||||
case 1:
|
|
||||||
if !bytes.Equal(baseChunkOne, chunk) {
|
|
||||||
t.Errorf("First chunk did not match expected. Got: %d bytes, expected: %d bytes", len(chunk), len(baseChunkOne))
|
|
||||||
}
|
|
||||||
case 2:
|
|
||||||
if !bytes.Equal(baseChunkTwo, chunk) {
|
|
||||||
t.Errorf("Second chunk did not match expected. Got: %d bytes, expected: %d bytes", len(chunk), len(baseChunkTwo))
|
|
||||||
}
|
|
||||||
}
|
|
||||||
}
|
|
||||||
if testChunkCount != baseChunkCount {
|
|
||||||
t.Errorf("Wrong number of chunks received. Got %d, expected: %d.", testChunkCount, baseChunkCount)
|
|
||||||
}
|
|
||||||
|
|
||||||
}
|
|
||||||
@@ -1,16 +1,18 @@
|
|||||||
package sources
|
package common
|
||||||
|
|
||||||
import (
|
import (
|
||||||
"errors"
|
"errors"
|
||||||
"fmt"
|
"fmt"
|
||||||
"time"
|
"time"
|
||||||
|
|
||||||
|
"github.com/trufflesecurity/trufflehog/v3/pkg/sources"
|
||||||
)
|
)
|
||||||
|
|
||||||
type ChunkFunc func(chunk *Chunk) error
|
type ChunkFunc func(chunk *sources.Chunk) error
|
||||||
|
|
||||||
var MatchError = errors.New("chunk doesn't match")
|
var MatchError = errors.New("chunk doesn't match")
|
||||||
|
|
||||||
func HandleTestChannel(chunksCh chan *Chunk, cf ChunkFunc) error {
|
func HandleTestChannel(chunksCh chan *sources.Chunk, cf ChunkFunc) error {
|
||||||
for {
|
for {
|
||||||
select {
|
select {
|
||||||
case gotChunk := <-chunksCh:
|
case gotChunk := <-chunksCh:
|
||||||
@@ -0,0 +1,133 @@
|
|||||||
|
package decoders
|
||||||
|
|
||||||
|
import (
|
||||||
|
"bytes"
|
||||||
|
"context"
|
||||||
|
"errors"
|
||||||
|
"fmt"
|
||||||
|
"io"
|
||||||
|
|
||||||
|
"github.com/mholt/archiver/v4"
|
||||||
|
log "github.com/sirupsen/logrus"
|
||||||
|
"github.com/trufflesecurity/trufflehog/v3/pkg/sources"
|
||||||
|
)
|
||||||
|
|
||||||
|
// Ensure the Decoder satisfies the interface at compile time
|
||||||
|
var _ Decoder = (*Archive)(nil)
|
||||||
|
|
||||||
|
var (
|
||||||
|
MaxDepth = 5
|
||||||
|
MaxSize = 100 // In MB
|
||||||
|
)
|
||||||
|
|
||||||
|
type Archive struct {
|
||||||
|
files [][]byte
|
||||||
|
newChunkData bytes.Buffer
|
||||||
|
}
|
||||||
|
|
||||||
|
func (d *Archive) FromChunk(chunk *sources.Chunk) *sources.Chunk {
|
||||||
|
ctx := context.Background()
|
||||||
|
byteReader := bytes.NewReader(chunk.Data)
|
||||||
|
err := d.openArchive(ctx, 0, byteReader)
|
||||||
|
if err != nil {
|
||||||
|
if errors.Is(err, archiver.ErrNoMatch) {
|
||||||
|
return nil
|
||||||
|
}
|
||||||
|
log.WithError(err).Debug("Error unarchiving chunk.")
|
||||||
|
return nil
|
||||||
|
}
|
||||||
|
chunk.Data = bytes.Join(d.files, []byte{})
|
||||||
|
return chunk
|
||||||
|
}
|
||||||
|
|
||||||
|
func (d *Archive) openArchive(ctx context.Context, depth int, reader io.Reader) error {
|
||||||
|
if depth >= MaxDepth {
|
||||||
|
return fmt.Errorf("max archive depth reached")
|
||||||
|
}
|
||||||
|
format, reader, err := archiver.Identify("", reader)
|
||||||
|
if err != nil {
|
||||||
|
if errors.Is(err, archiver.ErrNoMatch) && depth > 0 {
|
||||||
|
fileBytes, err := ReadToMax(reader)
|
||||||
|
if err != nil {
|
||||||
|
return err
|
||||||
|
}
|
||||||
|
d.files = append(d.files, fileBytes)
|
||||||
|
return nil
|
||||||
|
}
|
||||||
|
return err
|
||||||
|
}
|
||||||
|
switch archive := format.(type) {
|
||||||
|
case archiver.Extractor:
|
||||||
|
log.Debug("chunk is archived")
|
||||||
|
err := archive.Extract(context.WithValue(ctx, "depth", depth+1), reader, nil, d.extractorHandler)
|
||||||
|
if err != nil {
|
||||||
|
return err
|
||||||
|
}
|
||||||
|
return nil
|
||||||
|
case archiver.Decompressor:
|
||||||
|
log.Debug("chunk is compressed")
|
||||||
|
compReader, err := archive.OpenReader(reader)
|
||||||
|
if err != nil {
|
||||||
|
return err
|
||||||
|
}
|
||||||
|
return d.openArchive(ctx, depth+1, compReader)
|
||||||
|
}
|
||||||
|
return fmt.Errorf("Unknown archive type: %s", format.Name())
|
||||||
|
}
|
||||||
|
|
||||||
|
func IsArchive(reader io.Reader) bool {
|
||||||
|
format, readerB, err := archiver.Identify("", reader)
|
||||||
|
reader = readerB
|
||||||
|
if err != nil {
|
||||||
|
return false
|
||||||
|
}
|
||||||
|
switch format.(type) {
|
||||||
|
case archiver.Extractor:
|
||||||
|
return true
|
||||||
|
case archiver.Decompressor:
|
||||||
|
return true
|
||||||
|
}
|
||||||
|
return false
|
||||||
|
}
|
||||||
|
|
||||||
|
func (d *Archive) extractorHandler(ctx context.Context, f archiver.File) error {
|
||||||
|
depth := 0
|
||||||
|
if ctxDepth, ok := ctx.Value("depth").(int); ok {
|
||||||
|
depth = ctxDepth
|
||||||
|
}
|
||||||
|
|
||||||
|
fReader, err := f.Open()
|
||||||
|
if err != nil {
|
||||||
|
return err
|
||||||
|
}
|
||||||
|
fileBytes, err := ReadToMax(fReader)
|
||||||
|
if err != nil {
|
||||||
|
return err
|
||||||
|
}
|
||||||
|
fileContent := bytes.NewReader(fileBytes)
|
||||||
|
err = d.openArchive(ctx, depth, fileContent)
|
||||||
|
if err != nil {
|
||||||
|
return err
|
||||||
|
}
|
||||||
|
return nil
|
||||||
|
}
|
||||||
|
|
||||||
|
func ReadToMax(reader io.Reader) ([]byte, error) {
|
||||||
|
// Read the file up to the max size.
|
||||||
|
fileContent := bytes.Buffer{}
|
||||||
|
for i := 0; i <= MaxSize*1024; i++ {
|
||||||
|
fileChunk := make([]byte, 1024)
|
||||||
|
bRead, err := reader.Read(fileChunk)
|
||||||
|
if err != nil {
|
||||||
|
return []byte{}, err
|
||||||
|
}
|
||||||
|
fileContent.Write(fileChunk[0:bRead])
|
||||||
|
if bRead < 1024 {
|
||||||
|
break
|
||||||
|
}
|
||||||
|
if i == MaxSize*1024 && bRead == 1024 {
|
||||||
|
log.Debug("Max archive size reached.")
|
||||||
|
}
|
||||||
|
}
|
||||||
|
return fileContent.Bytes(), nil
|
||||||
|
}
|
||||||
@@ -8,6 +8,7 @@ func DefaultDecoders() []Decoder {
|
|||||||
return []Decoder{
|
return []Decoder{
|
||||||
&Plain{},
|
&Plain{},
|
||||||
&Base64{},
|
&Base64{},
|
||||||
|
&Archive{},
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
|
|
||||||
|
|||||||
@@ -51,7 +51,6 @@ func (s Scanner) FromData(ctx context.Context, verify bool, data []byte) (result
|
|||||||
s1 := detectors.Result{
|
s1 := detectors.Result{
|
||||||
DetectorType: detectorspb.DetectorType_AdobeIO,
|
DetectorType: detectorspb.DetectorType_AdobeIO,
|
||||||
Raw: []byte(resMatch),
|
Raw: []byte(resMatch),
|
||||||
RawV2: []byte(resMatch + resIdMatch),
|
|
||||||
}
|
}
|
||||||
|
|
||||||
if verify {
|
if verify {
|
||||||
|
|||||||
@@ -52,7 +52,6 @@ func (s Scanner) FromData(ctx context.Context, verify bool, data []byte) (result
|
|||||||
s1 := detectors.Result{
|
s1 := detectors.Result{
|
||||||
DetectorType: detectorspb.DetectorType_Adzuna,
|
DetectorType: detectorspb.DetectorType_Adzuna,
|
||||||
Raw: []byte(resMatch),
|
Raw: []byte(resMatch),
|
||||||
RawV2: []byte(resMatch + resIdMatch),
|
|
||||||
}
|
}
|
||||||
|
|
||||||
if verify {
|
if verify {
|
||||||
|
|||||||
@@ -52,7 +52,6 @@ func (s Scanner) FromData(ctx context.Context, verify bool, data []byte) (result
|
|||||||
s1 := detectors.Result{
|
s1 := detectors.Result{
|
||||||
DetectorType: detectorspb.DetectorType_Aeroworkflow,
|
DetectorType: detectorspb.DetectorType_Aeroworkflow,
|
||||||
Raw: []byte(resMatch),
|
Raw: []byte(resMatch),
|
||||||
RawV2: []byte(resMatch + resIdMatch),
|
|
||||||
}
|
}
|
||||||
|
|
||||||
if verify {
|
if verify {
|
||||||
|
|||||||
@@ -53,7 +53,6 @@ func (s Scanner) FromData(ctx context.Context, verify bool, data []byte) (result
|
|||||||
s1 := detectors.Result{
|
s1 := detectors.Result{
|
||||||
DetectorType: detectorspb.DetectorType_Agora,
|
DetectorType: detectorspb.DetectorType_Agora,
|
||||||
Raw: []byte(resMatch),
|
Raw: []byte(resMatch),
|
||||||
RawV2: []byte(resMatch + resSecret),
|
|
||||||
}
|
}
|
||||||
|
|
||||||
if verify {
|
if verify {
|
||||||
|
|||||||
@@ -53,7 +53,6 @@ func (s Scanner) FromData(ctx context.Context, verify bool, data []byte) (result
|
|||||||
s1 := detectors.Result{
|
s1 := detectors.Result{
|
||||||
DetectorType: detectorspb.DetectorType_AirbrakeProjectKey,
|
DetectorType: detectorspb.DetectorType_AirbrakeProjectKey,
|
||||||
Raw: []byte(resMatch),
|
Raw: []byte(resMatch),
|
||||||
RawV2: []byte(resMatch + resIdMatch),
|
|
||||||
}
|
}
|
||||||
|
|
||||||
if verify {
|
if verify {
|
||||||
|
|||||||
@@ -53,7 +53,6 @@ func (s Scanner) FromData(ctx context.Context, verify bool, data []byte) (result
|
|||||||
DetectorType: detectorspb.DetectorType_AirtableApiKey,
|
DetectorType: detectorspb.DetectorType_AirtableApiKey,
|
||||||
Redacted: appRes,
|
Redacted: appRes,
|
||||||
Raw: []byte(keyRes),
|
Raw: []byte(keyRes),
|
||||||
RawV2: []byte(keyRes + appRes),
|
|
||||||
}
|
}
|
||||||
|
|
||||||
if verify {
|
if verify {
|
||||||
|
|||||||
@@ -53,7 +53,6 @@ func (s Scanner) FromData(ctx context.Context, verify bool, data []byte) (result
|
|||||||
s1 := detectors.Result{
|
s1 := detectors.Result{
|
||||||
DetectorType: detectorspb.DetectorType_Alegra,
|
DetectorType: detectorspb.DetectorType_Alegra,
|
||||||
Raw: []byte(tokenPatMatch),
|
Raw: []byte(tokenPatMatch),
|
||||||
RawV2: []byte(tokenPatMatch + userPatMatch),
|
|
||||||
}
|
}
|
||||||
|
|
||||||
if verify {
|
if verify {
|
||||||
|
|||||||
@@ -51,7 +51,6 @@ func (s Scanner) FromData(ctx context.Context, verify bool, data []byte) (result
|
|||||||
s1 := detectors.Result{
|
s1 := detectors.Result{
|
||||||
DetectorType: detectorspb.DetectorType_AlgoliaAdminKey,
|
DetectorType: detectorspb.DetectorType_AlgoliaAdminKey,
|
||||||
Raw: []byte(resMatch),
|
Raw: []byte(resMatch),
|
||||||
RawV2: []byte(resMatch + resIdMatch),
|
|
||||||
}
|
}
|
||||||
|
|
||||||
if verify {
|
if verify {
|
||||||
|
|||||||
@@ -84,7 +84,6 @@ func (s Scanner) FromData(ctx context.Context, verify bool, data []byte) (result
|
|||||||
s1 := detectors.Result{
|
s1 := detectors.Result{
|
||||||
DetectorType: detectorspb.DetectorType_Alibaba,
|
DetectorType: detectorspb.DetectorType_Alibaba,
|
||||||
Raw: []byte(resMatch),
|
Raw: []byte(resMatch),
|
||||||
RawV2: []byte(resMatch + resIdMatch),
|
|
||||||
}
|
}
|
||||||
|
|
||||||
if verify {
|
if verify {
|
||||||
@@ -104,7 +103,7 @@ func (s Scanner) FromData(ctx context.Context, verify bool, data []byte) (result
|
|||||||
params.Add("Version", "2014-05-26")
|
params.Add("Version", "2014-05-26")
|
||||||
|
|
||||||
stringToSign := buildStringToSign(req.Method, params.Encode())
|
stringToSign := buildStringToSign(req.Method, params.Encode())
|
||||||
signature := GetSignature(stringToSign, resMatch+"&") // Get Signature HMAC SHA1
|
signature := GetSignature(stringToSign, resMatch+"&") //Get Signature HMAC SHA1
|
||||||
params.Add("Signature", signature)
|
params.Add("Signature", signature)
|
||||||
req.URL.RawQuery = params.Encode()
|
req.URL.RawQuery = params.Encode()
|
||||||
|
|
||||||
|
|||||||
@@ -52,7 +52,6 @@ func (s Scanner) FromData(ctx context.Context, verify bool, data []byte) (result
|
|||||||
s1 := detectors.Result{
|
s1 := detectors.Result{
|
||||||
DetectorType: detectorspb.DetectorType_Amadeus,
|
DetectorType: detectorspb.DetectorType_Amadeus,
|
||||||
Raw: []byte(resMatch),
|
Raw: []byte(resMatch),
|
||||||
RawV2: []byte(resMatch + resSecret),
|
|
||||||
}
|
}
|
||||||
|
|
||||||
if verify {
|
if verify {
|
||||||
|
|||||||
@@ -52,7 +52,6 @@ func (s Scanner) FromData(ctx context.Context, verify bool, data []byte) (result
|
|||||||
s1 := detectors.Result{
|
s1 := detectors.Result{
|
||||||
DetectorType: detectorspb.DetectorType_AmplitudeApiKey,
|
DetectorType: detectorspb.DetectorType_AmplitudeApiKey,
|
||||||
Raw: []byte(resMatch),
|
Raw: []byte(resMatch),
|
||||||
RawV2: []byte(resMatch + resSecretMatch),
|
|
||||||
}
|
}
|
||||||
|
|
||||||
if verify {
|
if verify {
|
||||||
|
|||||||
@@ -52,7 +52,6 @@ func (s Scanner) FromData(ctx context.Context, verify bool, data []byte) (result
|
|||||||
s1 := detectors.Result{
|
s1 := detectors.Result{
|
||||||
DetectorType: detectorspb.DetectorType_Anypoint,
|
DetectorType: detectorspb.DetectorType_Anypoint,
|
||||||
Raw: []byte(resMatch),
|
Raw: []byte(resMatch),
|
||||||
RawV2: []byte(resMatch + orgRes),
|
|
||||||
}
|
}
|
||||||
|
|
||||||
if verify {
|
if verify {
|
||||||
|
|||||||
@@ -61,9 +61,7 @@ func (s Scanner) FromData(ctx context.Context, verify bool, data []byte) (result
|
|||||||
|
|
||||||
var result Response
|
var result Response
|
||||||
if errBody == nil {
|
if errBody == nil {
|
||||||
if err := json.Unmarshal(body, &result); err != nil {
|
json.Unmarshal(body, &result)
|
||||||
continue
|
|
||||||
}
|
|
||||||
|
|
||||||
if res.StatusCode >= 200 && res.StatusCode < 300 && result.ReturnCode == 0 {
|
if res.StatusCode >= 200 && res.StatusCode < 300 && result.ReturnCode == 0 {
|
||||||
s1.Verified = true
|
s1.Verified = true
|
||||||
|
|||||||
@@ -53,7 +53,6 @@ func (s Scanner) FromData(ctx context.Context, verify bool, data []byte) (result
|
|||||||
s1 := detectors.Result{
|
s1 := detectors.Result{
|
||||||
DetectorType: detectorspb.DetectorType_ApiDeck,
|
DetectorType: detectorspb.DetectorType_ApiDeck,
|
||||||
Raw: []byte(resMatch),
|
Raw: []byte(resMatch),
|
||||||
RawV2: []byte(resMatch + resIdMatch),
|
|
||||||
}
|
}
|
||||||
|
|
||||||
if verify {
|
if verify {
|
||||||
|
|||||||
@@ -52,7 +52,6 @@ func (s Scanner) FromData(ctx context.Context, verify bool, data []byte) (result
|
|||||||
s1 := detectors.Result{
|
s1 := detectors.Result{
|
||||||
DetectorType: detectorspb.DetectorType_Apiflash,
|
DetectorType: detectorspb.DetectorType_Apiflash,
|
||||||
Raw: []byte(resMatch),
|
Raw: []byte(resMatch),
|
||||||
RawV2: []byte(resMatch + resUrlMatch),
|
|
||||||
}
|
}
|
||||||
|
|
||||||
if verify {
|
if verify {
|
||||||
|
|||||||
@@ -54,7 +54,6 @@ func (s Scanner) FromData(ctx context.Context, verify bool, data []byte) (result
|
|||||||
s1 := detectors.Result{
|
s1 := detectors.Result{
|
||||||
DetectorType: detectorspb.DetectorType_APIMatic,
|
DetectorType: detectorspb.DetectorType_APIMatic,
|
||||||
Raw: []byte(userPatMatch),
|
Raw: []byte(userPatMatch),
|
||||||
RawV2: []byte(userPatMatch + passPatMatch),
|
|
||||||
}
|
}
|
||||||
if verify {
|
if verify {
|
||||||
timeout := 10 * time.Second
|
timeout := 10 * time.Second
|
||||||
|
|||||||
@@ -63,7 +63,6 @@ func (s Scanner) FromData(ctx context.Context, verify bool, data []byte) (result
|
|||||||
s1 := detectors.Result{
|
s1 := detectors.Result{
|
||||||
DetectorType: detectorspb.DetectorType_Appcues,
|
DetectorType: detectorspb.DetectorType_Appcues,
|
||||||
Raw: []byte(resMatch),
|
Raw: []byte(resMatch),
|
||||||
RawV2: []byte(resMatch + resUserMatch),
|
|
||||||
}
|
}
|
||||||
if verify {
|
if verify {
|
||||||
req, err := http.NewRequestWithContext(ctx, "GET", fmt.Sprintf("https://api.appcues.com/v2/accounts/%s/flows", resIdMatch), nil)
|
req, err := http.NewRequestWithContext(ctx, "GET", fmt.Sprintf("https://api.appcues.com/v2/accounts/%s/flows", resIdMatch), nil)
|
||||||
|
|||||||
@@ -53,7 +53,6 @@ func (s Scanner) FromData(ctx context.Context, verify bool, data []byte) (result
|
|||||||
s1 := detectors.Result{
|
s1 := detectors.Result{
|
||||||
DetectorType: detectorspb.DetectorType_Apptivo,
|
DetectorType: detectorspb.DetectorType_Apptivo,
|
||||||
Raw: []byte(resMatch),
|
Raw: []byte(resMatch),
|
||||||
RawV2: []byte(resMatch + resIdMatch),
|
|
||||||
}
|
}
|
||||||
|
|
||||||
if verify {
|
if verify {
|
||||||
|
|||||||
@@ -54,7 +54,6 @@ func (s Scanner) FromData(ctx context.Context, verify bool, data []byte) (result
|
|||||||
s1 := detectors.Result{
|
s1 := detectors.Result{
|
||||||
DetectorType: detectorspb.DetectorType_ArtifactoryAccessToken,
|
DetectorType: detectorspb.DetectorType_ArtifactoryAccessToken,
|
||||||
Raw: []byte(resMatch),
|
Raw: []byte(resMatch),
|
||||||
RawV2: []byte(resMatch + resURLMatch),
|
|
||||||
}
|
}
|
||||||
|
|
||||||
if verify {
|
if verify {
|
||||||
|
|||||||
@@ -53,7 +53,6 @@ func (s Scanner) FromData(ctx context.Context, verify bool, data []byte) (result
|
|||||||
s1 := detectors.Result{
|
s1 := detectors.Result{
|
||||||
DetectorType: detectorspb.DetectorType_Artsy,
|
DetectorType: detectorspb.DetectorType_Artsy,
|
||||||
Raw: []byte(resMatch),
|
Raw: []byte(resMatch),
|
||||||
RawV2: []byte(resMatch + resIdMatch),
|
|
||||||
}
|
}
|
||||||
|
|
||||||
if verify {
|
if verify {
|
||||||
|
|||||||
@@ -58,7 +58,6 @@ func (s Scanner) FromData(ctx context.Context, verify bool, data []byte) (result
|
|||||||
DetectorType: detectorspb.DetectorType_Auth0ManagementApiToken,
|
DetectorType: detectorspb.DetectorType_Auth0ManagementApiToken,
|
||||||
Redacted: domainRes,
|
Redacted: domainRes,
|
||||||
Raw: []byte(managementApiTokenRes),
|
Raw: []byte(managementApiTokenRes),
|
||||||
RawV2: []byte(managementApiTokenRes + domainRes),
|
|
||||||
}
|
}
|
||||||
|
|
||||||
if verify {
|
if verify {
|
||||||
|
|||||||
@@ -2,11 +2,14 @@ package auth0oauth
|
|||||||
|
|
||||||
import (
|
import (
|
||||||
"context"
|
"context"
|
||||||
|
// "fmt"
|
||||||
|
// "log"
|
||||||
|
"regexp"
|
||||||
|
"strings"
|
||||||
|
|
||||||
"io/ioutil"
|
"io/ioutil"
|
||||||
"net/http"
|
"net/http"
|
||||||
"net/url"
|
"net/url"
|
||||||
"regexp"
|
|
||||||
"strings"
|
|
||||||
|
|
||||||
"github.com/trufflesecurity/trufflehog/v3/pkg/common"
|
"github.com/trufflesecurity/trufflehog/v3/pkg/common"
|
||||||
"github.com/trufflesecurity/trufflehog/v3/pkg/detectors"
|
"github.com/trufflesecurity/trufflehog/v3/pkg/detectors"
|
||||||
@@ -62,7 +65,6 @@ func (s Scanner) FromData(ctx context.Context, verify bool, data []byte) (result
|
|||||||
DetectorType: detectorspb.DetectorType_Auth0oauth,
|
DetectorType: detectorspb.DetectorType_Auth0oauth,
|
||||||
Redacted: clientIdRes,
|
Redacted: clientIdRes,
|
||||||
Raw: []byte(clientSecretRes),
|
Raw: []byte(clientSecretRes),
|
||||||
RawV2: []byte(clientIdRes + clientSecretRes),
|
|
||||||
}
|
}
|
||||||
|
|
||||||
if verify {
|
if verify {
|
||||||
|
|||||||
@@ -52,7 +52,6 @@ func (s Scanner) FromData(ctx context.Context, verify bool, data []byte) (result
|
|||||||
s1 := detectors.Result{
|
s1 := detectors.Result{
|
||||||
DetectorType: detectorspb.DetectorType_Autodesk,
|
DetectorType: detectorspb.DetectorType_Autodesk,
|
||||||
Raw: []byte(resMatch),
|
Raw: []byte(resMatch),
|
||||||
RawV2: []byte(resMatch + resSecret),
|
|
||||||
}
|
}
|
||||||
|
|
||||||
if verify {
|
if verify {
|
||||||
|
|||||||
@@ -27,7 +27,7 @@ var (
|
|||||||
// Make sure that your group is surrounded in boundary characters such as below to reduce false positives.
|
// Make sure that your group is surrounded in boundary characters such as below to reduce false positives.
|
||||||
// Key types are from this list https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_identifiers.html#identifiers-unique-ids
|
// Key types are from this list https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_identifiers.html#identifiers-unique-ids
|
||||||
idPat = regexp.MustCompile(`\b((?:AKIA|ABIA|ACCA|ASIA)[0-9A-Z]{16})\b`)
|
idPat = regexp.MustCompile(`\b((?:AKIA|ABIA|ACCA|ASIA)[0-9A-Z]{16})\b`)
|
||||||
secretPat = regexp.MustCompile(`[^A-Za-z0-9+\/]{0,1}([A-Za-z0-9+\/]{40})[^A-Za-z0-9+\/]{0,1}`)
|
secretPat = regexp.MustCompile(`\b([A-Za-z0-9+/]{40})[ \r\n'"\x60]`)
|
||||||
// Hashes, like those for git, do technically match the secret pattern.
|
// Hashes, like those for git, do technically match the secret pattern.
|
||||||
// But they are extremely unlikely to be generated as an actual AWS secret.
|
// But they are extremely unlikely to be generated as an actual AWS secret.
|
||||||
// So when we find them, if they're not verified, we should ignore the result.
|
// So when we find them, if they're not verified, we should ignore the result.
|
||||||
@@ -81,7 +81,6 @@ func (s Scanner) FromData(ctx context.Context, verify bool, data []byte) (result
|
|||||||
DetectorType: detectorspb.DetectorType_AWS,
|
DetectorType: detectorspb.DetectorType_AWS,
|
||||||
Raw: []byte(resIDMatch),
|
Raw: []byte(resIDMatch),
|
||||||
Redacted: resIDMatch,
|
Redacted: resIDMatch,
|
||||||
RawV2: []byte(resIDMatch + resSecretMatch),
|
|
||||||
}
|
}
|
||||||
|
|
||||||
if verify {
|
if verify {
|
||||||
|
|||||||
@@ -144,23 +144,6 @@ func TestAWS_FromChunk(t *testing.T) {
|
|||||||
},
|
},
|
||||||
wantErr: false,
|
wantErr: false,
|
||||||
},
|
},
|
||||||
{
|
|
||||||
name: "found, unverified, with leading +",
|
|
||||||
s: Scanner{},
|
|
||||||
args: args{
|
|
||||||
ctx: context.Background(),
|
|
||||||
data: []byte(fmt.Sprintf("You can find a aws secret %s within aws %s but not valid", "+HaNv9cTwheDKGJaws/+BMF2GgybQgBWdhcOOdfF", id)), // the secret would satisfy the regex but not pass validation
|
|
||||||
verify: true,
|
|
||||||
},
|
|
||||||
want: []detectors.Result{
|
|
||||||
{
|
|
||||||
DetectorType: detectorspb.DetectorType_AWS,
|
|
||||||
Verified: false,
|
|
||||||
Redacted: "AKIAWARWQKZNHMZBLY4I",
|
|
||||||
},
|
|
||||||
},
|
|
||||||
wantErr: false,
|
|
||||||
},
|
|
||||||
}
|
}
|
||||||
for _, tt := range tests {
|
for _, tt := range tests {
|
||||||
t.Run(tt.name, func(t *testing.T) {
|
t.Run(tt.name, func(t *testing.T) {
|
||||||
|
|||||||
@@ -52,7 +52,6 @@ func (s Scanner) FromData(ctx context.Context, verify bool, data []byte) (result
|
|||||||
s1 := detectors.Result{
|
s1 := detectors.Result{
|
||||||
DetectorType: detectorspb.DetectorType_Aylien,
|
DetectorType: detectorspb.DetectorType_Aylien,
|
||||||
Raw: []byte(resMatch),
|
Raw: []byte(resMatch),
|
||||||
RawV2: []byte(resMatch + resIdMatch),
|
|
||||||
}
|
}
|
||||||
if verify {
|
if verify {
|
||||||
req, err := http.NewRequestWithContext(ctx, "GET", "https://api.aylien.com/news/stories", nil)
|
req, err := http.NewRequestWithContext(ctx, "GET", "https://api.aylien.com/news/stories", nil)
|
||||||
|
|||||||
@@ -52,7 +52,6 @@ func (s Scanner) FromData(ctx context.Context, verify bool, data []byte) (result
|
|||||||
s1 := detectors.Result{
|
s1 := detectors.Result{
|
||||||
DetectorType: detectorspb.DetectorType_Billomat,
|
DetectorType: detectorspb.DetectorType_Billomat,
|
||||||
Raw: []byte(resMatch),
|
Raw: []byte(resMatch),
|
||||||
RawV2: []byte(resMatch + resId),
|
|
||||||
}
|
}
|
||||||
|
|
||||||
if verify {
|
if verify {
|
||||||
|
|||||||
@@ -58,7 +58,6 @@ func (s Scanner) FromData(ctx context.Context, verify bool, data []byte) (result
|
|||||||
s1 := detectors.Result{
|
s1 := detectors.Result{
|
||||||
DetectorType: detectorspb.DetectorType_Bitmex,
|
DetectorType: detectorspb.DetectorType_Bitmex,
|
||||||
Raw: []byte(resSecretMatch),
|
Raw: []byte(resSecretMatch),
|
||||||
RawV2: []byte(resMatch + resSecretMatch),
|
|
||||||
}
|
}
|
||||||
|
|
||||||
if verify {
|
if verify {
|
||||||
|
|||||||
@@ -52,7 +52,6 @@ func (s Scanner) FromData(ctx context.Context, verify bool, data []byte) (result
|
|||||||
s1 := detectors.Result{
|
s1 := detectors.Result{
|
||||||
DetectorType: detectorspb.DetectorType_BrowserStack,
|
DetectorType: detectorspb.DetectorType_BrowserStack,
|
||||||
Raw: []byte(resMatch),
|
Raw: []byte(resMatch),
|
||||||
RawV2: []byte(resMatch + resUserMatch),
|
|
||||||
}
|
}
|
||||||
|
|
||||||
if verify {
|
if verify {
|
||||||
|
|||||||
@@ -2,11 +2,11 @@ package bulksms
|
|||||||
|
|
||||||
import (
|
import (
|
||||||
"context"
|
"context"
|
||||||
b64 "encoding/base64"
|
|
||||||
"fmt"
|
"fmt"
|
||||||
"net/http"
|
"net/http"
|
||||||
"regexp"
|
"regexp"
|
||||||
"strings"
|
"strings"
|
||||||
|
b64 "encoding/base64"
|
||||||
|
|
||||||
"github.com/trufflesecurity/trufflehog/v3/pkg/common"
|
"github.com/trufflesecurity/trufflehog/v3/pkg/common"
|
||||||
"github.com/trufflesecurity/trufflehog/v3/pkg/detectors"
|
"github.com/trufflesecurity/trufflehog/v3/pkg/detectors"
|
||||||
@@ -21,9 +21,10 @@ var _ detectors.Detector = (*Scanner)(nil)
|
|||||||
var (
|
var (
|
||||||
client = common.SaneHttpClient()
|
client = common.SaneHttpClient()
|
||||||
|
|
||||||
// Make sure that your group is surrounded in boundry characters such as below to reduce false positives
|
//Make sure that your group is surrounded in boundry characters such as below to reduce false positives
|
||||||
keyPat = regexp.MustCompile(detectors.PrefixRegex([]string{"bulksms"}) + `\b([a-fA-Z0-9*]{29})\b`)
|
keyPat = regexp.MustCompile(detectors.PrefixRegex([]string{"bulksms"}) + `\b([a-fA-Z0-9*]{29})\b`)
|
||||||
idPat = regexp.MustCompile(detectors.PrefixRegex([]string{"bulksms"}) + `\b([A-F0-9-]{37})\b`)
|
idPat = regexp.MustCompile(detectors.PrefixRegex([]string{"bulksms"}) + `\b([A-F0-9-]{37})\b`)
|
||||||
|
|
||||||
)
|
)
|
||||||
|
|
||||||
// Keywords are used for efficiently pre-filtering chunks.
|
// Keywords are used for efficiently pre-filtering chunks.
|
||||||
@@ -53,11 +54,10 @@ func (s Scanner) FromData(ctx context.Context, verify bool, data []byte) (result
|
|||||||
s1 := detectors.Result{
|
s1 := detectors.Result{
|
||||||
DetectorType: detectorspb.DetectorType_Bulksms,
|
DetectorType: detectorspb.DetectorType_Bulksms,
|
||||||
Raw: []byte(resMatch),
|
Raw: []byte(resMatch),
|
||||||
RawV2: []byte(resMatch + resIdMatch),
|
|
||||||
}
|
}
|
||||||
|
|
||||||
if verify {
|
if verify {
|
||||||
data := fmt.Sprintf("%s:%s", resIdMatch, resMatch)
|
data := fmt.Sprintf("%s:%s", resIdMatch,resMatch)
|
||||||
sEnc := b64.StdEncoding.EncodeToString([]byte(data))
|
sEnc := b64.StdEncoding.EncodeToString([]byte(data))
|
||||||
req, err := http.NewRequestWithContext(ctx, "GET", "https://api.bulksms.com/v1/messages", nil)
|
req, err := http.NewRequestWithContext(ctx, "GET", "https://api.bulksms.com/v1/messages", nil)
|
||||||
if err != nil {
|
if err != nil {
|
||||||
@@ -70,7 +70,7 @@ func (s Scanner) FromData(ctx context.Context, verify bool, data []byte) (result
|
|||||||
if res.StatusCode >= 200 && res.StatusCode < 300 {
|
if res.StatusCode >= 200 && res.StatusCode < 300 {
|
||||||
s1.Verified = true
|
s1.Verified = true
|
||||||
} else {
|
} else {
|
||||||
// This function will check false positives for common test words, but also it will make sure the key appears 'random' enough to be a real key
|
//This function will check false positives for common test words, but also it will make sure the key appears 'random' enough to be a real key
|
||||||
if detectors.IsKnownFalsePositive(resMatch, detectors.DefaultFalsePositives, true) {
|
if detectors.IsKnownFalsePositive(resMatch, detectors.DefaultFalsePositives, true) {
|
||||||
continue
|
continue
|
||||||
}
|
}
|
||||||
|
|||||||
@@ -52,7 +52,6 @@ func (s Scanner) FromData(ctx context.Context, verify bool, data []byte) (result
|
|||||||
s1 := detectors.Result{
|
s1 := detectors.Result{
|
||||||
DetectorType: detectorspb.DetectorType_CaptainData,
|
DetectorType: detectorspb.DetectorType_CaptainData,
|
||||||
Raw: []byte(resMatch),
|
Raw: []byte(resMatch),
|
||||||
RawV2: []byte(resProjIdMatch + resMatch),
|
|
||||||
}
|
}
|
||||||
|
|
||||||
if verify {
|
if verify {
|
||||||
|
|||||||
@@ -54,7 +54,6 @@ func (s Scanner) FromData(ctx context.Context, verify bool, data []byte) (result
|
|||||||
s1 := detectors.Result{
|
s1 := detectors.Result{
|
||||||
DetectorType: detectorspb.DetectorType_Cashboard,
|
DetectorType: detectorspb.DetectorType_Cashboard,
|
||||||
Raw: []byte(resMatch),
|
Raw: []byte(resMatch),
|
||||||
RawV2: []byte(resMatch + resUser),
|
|
||||||
}
|
}
|
||||||
|
|
||||||
if verify {
|
if verify {
|
||||||
|
|||||||
@@ -63,7 +63,6 @@ func (s Scanner) FromData(ctx context.Context, verify bool, data []byte) (result
|
|||||||
s1 := detectors.Result{
|
s1 := detectors.Result{
|
||||||
DetectorType: detectorspb.DetectorType_Caspio,
|
DetectorType: detectorspb.DetectorType_Caspio,
|
||||||
Raw: []byte(resMatch),
|
Raw: []byte(resMatch),
|
||||||
RawV2: []byte(resMatch + resIdMatch + resDomainMatch),
|
|
||||||
}
|
}
|
||||||
|
|
||||||
if verify {
|
if verify {
|
||||||
|
|||||||
@@ -51,7 +51,6 @@ func (s Scanner) FromData(ctx context.Context, verify bool, data []byte) (result
|
|||||||
s1 := detectors.Result{
|
s1 := detectors.Result{
|
||||||
DetectorType: detectorspb.DetectorType_Censys,
|
DetectorType: detectorspb.DetectorType_Censys,
|
||||||
Raw: []byte(tokenPatMatch),
|
Raw: []byte(tokenPatMatch),
|
||||||
RawV2: []byte(tokenPatMatch + userPatMatch),
|
|
||||||
}
|
}
|
||||||
|
|
||||||
if verify {
|
if verify {
|
||||||
|
|||||||
@@ -69,7 +69,6 @@ func (s Scanner) FromData(ctx context.Context, verify bool, data []byte) (result
|
|||||||
s1 := detectors.Result{
|
s1 := detectors.Result{
|
||||||
DetectorType: detectorspb.DetectorType_CexIO,
|
DetectorType: detectorspb.DetectorType_CexIO,
|
||||||
Raw: []byte(resKeyMatch),
|
Raw: []byte(resKeyMatch),
|
||||||
RawV2: []byte(resUserIdMatch + resSecretMatch),
|
|
||||||
}
|
}
|
||||||
|
|
||||||
if verify {
|
if verify {
|
||||||
@@ -103,9 +102,7 @@ func (s Scanner) FromData(ctx context.Context, verify bool, data []byte) (result
|
|||||||
}
|
}
|
||||||
|
|
||||||
var responseObject Response
|
var responseObject Response
|
||||||
if err := json.Unmarshal(body, &responseObject); err != nil {
|
json.Unmarshal(body, &responseObject)
|
||||||
continue
|
|
||||||
}
|
|
||||||
|
|
||||||
if res.StatusCode >= 200 && res.StatusCode < 300 && validResponse {
|
if res.StatusCode >= 200 && res.StatusCode < 300 && validResponse {
|
||||||
s1.Verified = true
|
s1.Verified = true
|
||||||
|
|||||||
@@ -20,7 +20,7 @@ var (
|
|||||||
client = common.SaneHttpClient()
|
client = common.SaneHttpClient()
|
||||||
|
|
||||||
// Make sure that your group is surrounded in boundary characters such as below to reduce false positives.
|
// Make sure that your group is surrounded in boundary characters such as below to reduce false positives.
|
||||||
// Tokens starting with sk_test are used for the app's sandbox environment while tokens starting with sk only are for production environment
|
//Tokens starting with sk_test are used for the app's sandbox environment while tokens starting with sk only are for production environment
|
||||||
keyPat = regexp.MustCompile(detectors.PrefixRegex([]string{"checkout"}) + `\b((sk_|sk_test_)[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12})\b`)
|
keyPat = regexp.MustCompile(detectors.PrefixRegex([]string{"checkout"}) + `\b((sk_|sk_test_)[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12})\b`)
|
||||||
idPat = regexp.MustCompile(detectors.PrefixRegex([]string{"checkout"}) + `\b(cus_[0-9a-zA-Z]{26})\b`)
|
idPat = regexp.MustCompile(detectors.PrefixRegex([]string{"checkout"}) + `\b(cus_[0-9a-zA-Z]{26})\b`)
|
||||||
)
|
)
|
||||||
@@ -53,11 +53,10 @@ func (s Scanner) FromData(ctx context.Context, verify bool, data []byte) (result
|
|||||||
s1 := detectors.Result{
|
s1 := detectors.Result{
|
||||||
DetectorType: detectorspb.DetectorType_Checkout,
|
DetectorType: detectorspb.DetectorType_Checkout,
|
||||||
Raw: []byte(resMatch),
|
Raw: []byte(resMatch),
|
||||||
RawV2: []byte(resMatch + resIdMatch),
|
|
||||||
}
|
}
|
||||||
|
|
||||||
if verify {
|
if verify {
|
||||||
// Used the app's sandbox environment for this case since I can't create a live account.
|
//Used the app's sandbox environment for this case since I can't create a live account.
|
||||||
req, err := http.NewRequestWithContext(ctx, "GET", "https://api.sandbox.checkout.com/customers/"+resIdMatch, nil)
|
req, err := http.NewRequestWithContext(ctx, "GET", "https://api.sandbox.checkout.com/customers/"+resIdMatch, nil)
|
||||||
if err != nil {
|
if err != nil {
|
||||||
continue
|
continue
|
||||||
|
|||||||
@@ -53,7 +53,6 @@ func (s Scanner) FromData(ctx context.Context, verify bool, data []byte) (result
|
|||||||
s1 := detectors.Result{
|
s1 := detectors.Result{
|
||||||
DetectorType: detectorspb.DetectorType_Checkvist,
|
DetectorType: detectorspb.DetectorType_Checkvist,
|
||||||
Raw: []byte(resMatch),
|
Raw: []byte(resMatch),
|
||||||
RawV2: []byte(resMatch + resEmailMatch),
|
|
||||||
}
|
}
|
||||||
|
|
||||||
if verify {
|
if verify {
|
||||||
|
|||||||
@@ -61,7 +61,6 @@ func (s Scanner) FromData(ctx context.Context, verify bool, data []byte) (result
|
|||||||
s1 := detectors.Result{
|
s1 := detectors.Result{
|
||||||
DetectorType: detectorspb.DetectorType_ClickHelp,
|
DetectorType: detectorspb.DetectorType_ClickHelp,
|
||||||
Raw: []byte(resServer),
|
Raw: []byte(resServer),
|
||||||
RawV2: []byte(resServer + resEmail),
|
|
||||||
}
|
}
|
||||||
|
|
||||||
if verify {
|
if verify {
|
||||||
|
|||||||
@@ -50,7 +50,6 @@ func (s Scanner) FromData(ctx context.Context, verify bool, data []byte) (result
|
|||||||
s1 := detectors.Result{
|
s1 := detectors.Result{
|
||||||
DetectorType: detectorspb.DetectorType_ClickSendsms,
|
DetectorType: detectorspb.DetectorType_ClickSendsms,
|
||||||
Raw: []byte(resMatch),
|
Raw: []byte(resMatch),
|
||||||
RawV2: []byte(resMatch + resIdMatch),
|
|
||||||
}
|
}
|
||||||
|
|
||||||
if verify {
|
if verify {
|
||||||
|
|||||||
@@ -52,7 +52,6 @@ func (s Scanner) FromData(ctx context.Context, verify bool, data []byte) (result
|
|||||||
s1 := detectors.Result{
|
s1 := detectors.Result{
|
||||||
DetectorType: detectorspb.DetectorType_ClockworkSMS,
|
DetectorType: detectorspb.DetectorType_ClockworkSMS,
|
||||||
Raw: []byte(resMatch),
|
Raw: []byte(resMatch),
|
||||||
RawV2: []byte(resMatch + tokenRes),
|
|
||||||
}
|
}
|
||||||
|
|
||||||
if verify {
|
if verify {
|
||||||
|
|||||||
@@ -54,7 +54,6 @@ func (s Scanner) FromData(ctx context.Context, verify bool, data []byte) (result
|
|||||||
s1 := detectors.Result{
|
s1 := detectors.Result{
|
||||||
DetectorType: detectorspb.DetectorType_CloudElements,
|
DetectorType: detectorspb.DetectorType_CloudElements,
|
||||||
Raw: []byte(resMatch),
|
Raw: []byte(resMatch),
|
||||||
RawV2: []byte(resMatch + resOrgMatch),
|
|
||||||
}
|
}
|
||||||
|
|
||||||
if verify {
|
if verify {
|
||||||
|
|||||||
@@ -60,7 +60,6 @@ func (s Scanner) FromData(ctx context.Context, verify bool, data []byte) (result
|
|||||||
DetectorType: detectorspb.DetectorType_CloudflareGlobalApiKey,
|
DetectorType: detectorspb.DetectorType_CloudflareGlobalApiKey,
|
||||||
Redacted: emailRes,
|
Redacted: emailRes,
|
||||||
Raw: []byte(apiKeyRes),
|
Raw: []byte(apiKeyRes),
|
||||||
RawV2: []byte(apiKeyRes + emailRes),
|
|
||||||
}
|
}
|
||||||
|
|
||||||
if verify {
|
if verify {
|
||||||
|
|||||||
@@ -53,7 +53,6 @@ func (s Scanner) FromData(ctx context.Context, verify bool, data []byte) (result
|
|||||||
s1 := detectors.Result{
|
s1 := detectors.Result{
|
||||||
DetectorType: detectorspb.DetectorType_CompanyHub,
|
DetectorType: detectorspb.DetectorType_CompanyHub,
|
||||||
Raw: []byte(resMatch),
|
Raw: []byte(resMatch),
|
||||||
RawV2: []byte(resMatch + resIdMatch),
|
|
||||||
}
|
}
|
||||||
|
|
||||||
if verify {
|
if verify {
|
||||||
|
|||||||
@@ -54,7 +54,6 @@ func (s Scanner) FromData(ctx context.Context, verify bool, data []byte) (result
|
|||||||
s1 := detectors.Result{
|
s1 := detectors.Result{
|
||||||
DetectorType: detectorspb.DetectorType_Confluent,
|
DetectorType: detectorspb.DetectorType_Confluent,
|
||||||
Raw: []byte(resMatch),
|
Raw: []byte(resMatch),
|
||||||
RawV2: []byte(resMatch + resSecret),
|
|
||||||
}
|
}
|
||||||
|
|
||||||
if verify {
|
if verify {
|
||||||
|
|||||||
@@ -51,7 +51,6 @@ func (s Scanner) FromData(ctx context.Context, verify bool, data []byte) (result
|
|||||||
s1 := detectors.Result{
|
s1 := detectors.Result{
|
||||||
DetectorType: detectorspb.DetectorType_Copper,
|
DetectorType: detectorspb.DetectorType_Copper,
|
||||||
Raw: []byte(resMatch),
|
Raw: []byte(resMatch),
|
||||||
RawV2: []byte(resMatch + resIdMatch),
|
|
||||||
}
|
}
|
||||||
|
|
||||||
if verify {
|
if verify {
|
||||||
|
|||||||
@@ -51,7 +51,6 @@ func (s Scanner) FromData(ctx context.Context, verify bool, data []byte) (result
|
|||||||
s1 := detectors.Result{
|
s1 := detectors.Result{
|
||||||
DetectorType: detectorspb.DetectorType_CrossBrowserTesting,
|
DetectorType: detectorspb.DetectorType_CrossBrowserTesting,
|
||||||
Raw: []byte(resMatch),
|
Raw: []byte(resMatch),
|
||||||
RawV2: []byte(resMatch + resIdMatch),
|
|
||||||
}
|
}
|
||||||
|
|
||||||
if verify {
|
if verify {
|
||||||
|
|||||||
@@ -52,7 +52,6 @@ func (s Scanner) FromData(ctx context.Context, verify bool, data []byte) (result
|
|||||||
s1 := detectors.Result{
|
s1 := detectors.Result{
|
||||||
DetectorType: detectorspb.DetectorType_CustomerGuru,
|
DetectorType: detectorspb.DetectorType_CustomerGuru,
|
||||||
Raw: []byte(resMatch),
|
Raw: []byte(resMatch),
|
||||||
RawV2: []byte(resMatch + resIdMatch),
|
|
||||||
}
|
}
|
||||||
|
|
||||||
if verify {
|
if verify {
|
||||||
|
|||||||
@@ -52,7 +52,6 @@ func (s Scanner) FromData(ctx context.Context, verify bool, data []byte) (result
|
|||||||
s1 := detectors.Result{
|
s1 := detectors.Result{
|
||||||
DetectorType: detectorspb.DetectorType_CustomerIO,
|
DetectorType: detectorspb.DetectorType_CustomerIO,
|
||||||
Raw: []byte(resMatch),
|
Raw: []byte(resMatch),
|
||||||
RawV2: []byte(resMatch + resIdMatch),
|
|
||||||
}
|
}
|
||||||
|
|
||||||
if verify {
|
if verify {
|
||||||
|
|||||||
@@ -29,9 +29,6 @@ type Result struct {
|
|||||||
Verified bool
|
Verified bool
|
||||||
// Raw contains the raw secret identifier data. Prefer IDs over secrets since it is used for deduping after hashing.
|
// Raw contains the raw secret identifier data. Prefer IDs over secrets since it is used for deduping after hashing.
|
||||||
Raw []byte
|
Raw []byte
|
||||||
// RawV2 contains the raw secret identifier that is a combination of both the ID and the secret.
|
|
||||||
// This is used for secrets that are multi part and could have the same ID. Ex: AWS credentials
|
|
||||||
RawV2 []byte
|
|
||||||
// Redacted contains the redacted version of the raw secret identification data for display purposes.
|
// Redacted contains the redacted version of the raw secret identification data for display purposes.
|
||||||
// A secret ID should be used if available.
|
// A secret ID should be used if available.
|
||||||
Redacted string
|
Redacted string
|
||||||
@@ -99,9 +96,9 @@ func PrefixRegex(keywords []string) string {
|
|||||||
return pre + middle + post
|
return pre + middle + post
|
||||||
}
|
}
|
||||||
|
|
||||||
// KeyIsRandom is a Low cost check to make sure that 'keys' include a number to reduce FPs.
|
//KeyIsRandom is a Low cost check to make sure that 'keys' include a number to reduce FPs.
|
||||||
// Golang doesnt support regex lookaheads, so must be done in separate calls.
|
//Golang doesnt support regex lookaheads, so must be done in separate calls.
|
||||||
// TODO improve checks. Shannon entropy did not work well.
|
//TODO improve checks. Shannon entropy did not work well.
|
||||||
func KeyIsRandom(key string) bool {
|
func KeyIsRandom(key string) bool {
|
||||||
for _, ch := range key {
|
for _, ch := range key {
|
||||||
if unicode.IsDigit(ch) {
|
if unicode.IsDigit(ch) {
|
||||||
|
|||||||
@@ -51,7 +51,6 @@ func (s Scanner) FromData(ctx context.Context, verify bool, data []byte) (result
|
|||||||
DetectorType: detectorspb.DetectorType_DiscordBotToken,
|
DetectorType: detectorspb.DetectorType_DiscordBotToken,
|
||||||
Redacted: resId,
|
Redacted: resId,
|
||||||
Raw: []byte(resMatch),
|
Raw: []byte(resMatch),
|
||||||
RawV2: []byte(resMatch + resId),
|
|
||||||
}
|
}
|
||||||
|
|
||||||
if verify {
|
if verify {
|
||||||
|
|||||||
@@ -52,7 +52,6 @@ func (s Scanner) FromData(ctx context.Context, verify bool, data []byte) (result
|
|||||||
s1 := detectors.Result{
|
s1 := detectors.Result{
|
||||||
DetectorType: detectorspb.DetectorType_Dnscheck,
|
DetectorType: detectorspb.DetectorType_Dnscheck,
|
||||||
Raw: []byte(resMatch),
|
Raw: []byte(resMatch),
|
||||||
RawV2: []byte(resMatch + resIdMatch),
|
|
||||||
}
|
}
|
||||||
|
|
||||||
if verify {
|
if verify {
|
||||||
|
|||||||
@@ -56,7 +56,6 @@ func (s Scanner) FromData(ctx context.Context, verify bool, data []byte) (result
|
|||||||
s1 := detectors.Result{
|
s1 := detectors.Result{
|
||||||
DetectorType: detectorspb.DetectorType_Dwolla,
|
DetectorType: detectorspb.DetectorType_Dwolla,
|
||||||
Raw: []byte(idMatch),
|
Raw: []byte(idMatch),
|
||||||
RawV2: []byte(idMatch + secretMatch),
|
|
||||||
}
|
}
|
||||||
|
|
||||||
if verify {
|
if verify {
|
||||||
|
|||||||
@@ -2,12 +2,13 @@ package easyinsight
|
|||||||
|
|
||||||
import (
|
import (
|
||||||
"context"
|
"context"
|
||||||
b64 "encoding/base64"
|
|
||||||
"fmt"
|
"fmt"
|
||||||
"net/http"
|
|
||||||
"regexp"
|
"regexp"
|
||||||
"strings"
|
"strings"
|
||||||
|
|
||||||
|
b64 "encoding/base64"
|
||||||
|
"net/http"
|
||||||
|
|
||||||
"github.com/trufflesecurity/trufflehog/v3/pkg/common"
|
"github.com/trufflesecurity/trufflehog/v3/pkg/common"
|
||||||
"github.com/trufflesecurity/trufflehog/v3/pkg/detectors"
|
"github.com/trufflesecurity/trufflehog/v3/pkg/detectors"
|
||||||
"github.com/trufflesecurity/trufflehog/v3/pkg/pb/detectorspb"
|
"github.com/trufflesecurity/trufflehog/v3/pkg/pb/detectorspb"
|
||||||
@@ -54,7 +55,6 @@ func (s Scanner) FromData(ctx context.Context, verify bool, data []byte) (result
|
|||||||
s1 := detectors.Result{
|
s1 := detectors.Result{
|
||||||
DetectorType: detectorspb.DetectorType_EasyInsight,
|
DetectorType: detectorspb.DetectorType_EasyInsight,
|
||||||
Raw: []byte(resMatch),
|
Raw: []byte(resMatch),
|
||||||
RawV2: []byte(resMatch + resIdMatch),
|
|
||||||
}
|
}
|
||||||
|
|
||||||
if verify {
|
if verify {
|
||||||
|
|||||||
@@ -51,7 +51,6 @@ func (s Scanner) FromData(ctx context.Context, verify bool, data []byte) (result
|
|||||||
s1 := detectors.Result{
|
s1 := detectors.Result{
|
||||||
DetectorType: detectorspb.DetectorType_Edamam,
|
DetectorType: detectorspb.DetectorType_Edamam,
|
||||||
Raw: []byte(resMatch),
|
Raw: []byte(resMatch),
|
||||||
RawV2: []byte(resMatch + resId),
|
|
||||||
}
|
}
|
||||||
|
|
||||||
if verify {
|
if verify {
|
||||||
|
|||||||
@@ -55,7 +55,6 @@ func (s Scanner) FromData(ctx context.Context, verify bool, data []byte) (result
|
|||||||
s1 := detectors.Result{
|
s1 := detectors.Result{
|
||||||
DetectorType: detectorspb.DetectorType_EightxEight,
|
DetectorType: detectorspb.DetectorType_EightxEight,
|
||||||
Raw: []byte(resMatch),
|
Raw: []byte(resMatch),
|
||||||
RawV2: []byte(resMatch + resIdMatch),
|
|
||||||
}
|
}
|
||||||
|
|
||||||
if verify {
|
if verify {
|
||||||
|
|||||||
@@ -54,7 +54,6 @@ func (s Scanner) FromData(ctx context.Context, verify bool, data []byte) (result
|
|||||||
DetectorType: detectorspb.DetectorType_FacebookOAuth,
|
DetectorType: detectorspb.DetectorType_FacebookOAuth,
|
||||||
Redacted: apiIdRes,
|
Redacted: apiIdRes,
|
||||||
Raw: []byte(apiSecretRes),
|
Raw: []byte(apiSecretRes),
|
||||||
RawV2: []byte(apiIdRes + apiSecretRes),
|
|
||||||
}
|
}
|
||||||
|
|
||||||
if verify {
|
if verify {
|
||||||
|
|||||||
@@ -52,7 +52,6 @@ func (s Scanner) FromData(ctx context.Context, verify bool, data []byte) (result
|
|||||||
s1 := detectors.Result{
|
s1 := detectors.Result{
|
||||||
DetectorType: detectorspb.DetectorType_FacePlusPlus,
|
DetectorType: detectorspb.DetectorType_FacePlusPlus,
|
||||||
Raw: []byte(resMatch),
|
Raw: []byte(resMatch),
|
||||||
RawV2: []byte(resMatch + resSecret),
|
|
||||||
}
|
}
|
||||||
|
|
||||||
if verify {
|
if verify {
|
||||||
|
|||||||
@@ -51,7 +51,6 @@ func (s Scanner) FromData(ctx context.Context, verify bool, data []byte) (result
|
|||||||
s1 := detectors.Result{
|
s1 := detectors.Result{
|
||||||
DetectorType: detectorspb.DetectorType_FourSquare,
|
DetectorType: detectorspb.DetectorType_FourSquare,
|
||||||
Raw: []byte(resMatch),
|
Raw: []byte(resMatch),
|
||||||
RawV2: []byte(resMatch + resSecret),
|
|
||||||
}
|
}
|
||||||
|
|
||||||
if verify {
|
if verify {
|
||||||
|
|||||||
@@ -28,7 +28,7 @@ var (
|
|||||||
client = common.SaneHttpClient()
|
client = common.SaneHttpClient()
|
||||||
|
|
||||||
// Make sure that your group is surrounded in boundary characters such as below to reduce false positives.
|
// Make sure that your group is surrounded in boundary characters such as below to reduce false positives.
|
||||||
// Removed bounds since there are some cases where the start and end of the token is a special character
|
//Removed bounds since there are some cases where the start and end of the token is a special character
|
||||||
keyPat = regexp.MustCompile(detectors.PrefixRegex([]string{"gengo"}) + `([ ]{0,1}[0-9a-zA-Z\[\]\-\(\)\{\}|_^@$=~]{64}[ \r\n]{1})`)
|
keyPat = regexp.MustCompile(detectors.PrefixRegex([]string{"gengo"}) + `([ ]{0,1}[0-9a-zA-Z\[\]\-\(\)\{\}|_^@$=~]{64}[ \r\n]{1})`)
|
||||||
secretPat = regexp.MustCompile(detectors.PrefixRegex([]string{"gengo"}) + `([ ]{0,1}[0-9a-zA-Z\[\]\-\(\)\{\}|_^@$=~]{64}[ \r\n]{1})`)
|
secretPat = regexp.MustCompile(detectors.PrefixRegex([]string{"gengo"}) + `([ ]{0,1}[0-9a-zA-Z\[\]\-\(\)\{\}|_^@$=~]{64}[ \r\n]{1})`)
|
||||||
)
|
)
|
||||||
@@ -61,7 +61,6 @@ func (s Scanner) FromData(ctx context.Context, verify bool, data []byte) (result
|
|||||||
s1 := detectors.Result{
|
s1 := detectors.Result{
|
||||||
DetectorType: detectorspb.DetectorType_Gengo,
|
DetectorType: detectorspb.DetectorType_Gengo,
|
||||||
Raw: []byte(resSecretMatch),
|
Raw: []byte(resSecretMatch),
|
||||||
RawV2: []byte(resMatch + resSecretMatch),
|
|
||||||
}
|
}
|
||||||
|
|
||||||
if verify {
|
if verify {
|
||||||
@@ -81,9 +80,7 @@ func (s Scanner) FromData(ctx context.Context, verify bool, data []byte) (result
|
|||||||
|
|
||||||
if errBody == nil {
|
if errBody == nil {
|
||||||
var response Response
|
var response Response
|
||||||
if err := json.Unmarshal(body, &response); err != nil {
|
json.Unmarshal(body, &response)
|
||||||
continue
|
|
||||||
}
|
|
||||||
|
|
||||||
if res.StatusCode >= 200 && res.StatusCode < 300 && response.OpStat == "ok" {
|
if res.StatusCode >= 200 && res.StatusCode < 300 && response.OpStat == "ok" {
|
||||||
s1.Verified = true
|
s1.Verified = true
|
||||||
|
|||||||
@@ -52,7 +52,6 @@ func (s Scanner) FromData(ctx context.Context, verify bool, data []byte) (result
|
|||||||
s1 := detectors.Result{
|
s1 := detectors.Result{
|
||||||
DetectorType: detectorspb.DetectorType_Geocodio,
|
DetectorType: detectorspb.DetectorType_Geocodio,
|
||||||
Raw: []byte(resMatch),
|
Raw: []byte(resMatch),
|
||||||
RawV2: []byte(resMatch + resSearchMatch),
|
|
||||||
}
|
}
|
||||||
|
|
||||||
if verify {
|
if verify {
|
||||||
|
|||||||
@@ -76,9 +76,7 @@ func (s Scanner) FromData(ctx context.Context, verify bool, data []byte) (result
|
|||||||
|
|
||||||
if errBody == nil {
|
if errBody == nil {
|
||||||
response := Response{}
|
response := Response{}
|
||||||
if err := xml.Unmarshal(body, &response); err != nil {
|
xml.Unmarshal(body, &response)
|
||||||
continue
|
|
||||||
}
|
|
||||||
|
|
||||||
if res.StatusCode >= 200 && res.StatusCode < 300 && response.Error == nil {
|
if res.StatusCode >= 200 && res.StatusCode < 300 && response.Error == nil {
|
||||||
s1.Verified = true
|
s1.Verified = true
|
||||||
|
|||||||
@@ -2,10 +2,6 @@ package kraken
|
|||||||
|
|
||||||
import (
|
import (
|
||||||
"context"
|
"context"
|
||||||
"crypto/hmac"
|
|
||||||
"crypto/sha256"
|
|
||||||
"crypto/sha512"
|
|
||||||
"encoding/base64"
|
|
||||||
"io"
|
"io"
|
||||||
"net/http"
|
"net/http"
|
||||||
"net/url"
|
"net/url"
|
||||||
@@ -14,6 +10,11 @@ import (
|
|||||||
"strings"
|
"strings"
|
||||||
"time"
|
"time"
|
||||||
|
|
||||||
|
"crypto/hmac"
|
||||||
|
"crypto/sha256"
|
||||||
|
"crypto/sha512"
|
||||||
|
"encoding/base64"
|
||||||
|
|
||||||
"github.com/trufflesecurity/trufflehog/v3/pkg/common"
|
"github.com/trufflesecurity/trufflehog/v3/pkg/common"
|
||||||
"github.com/trufflesecurity/trufflehog/v3/pkg/detectors"
|
"github.com/trufflesecurity/trufflehog/v3/pkg/detectors"
|
||||||
"github.com/trufflesecurity/trufflehog/v3/pkg/pb/detectorspb"
|
"github.com/trufflesecurity/trufflehog/v3/pkg/pb/detectorspb"
|
||||||
@@ -28,7 +29,7 @@ var (
|
|||||||
client = common.SaneHttpClient()
|
client = common.SaneHttpClient()
|
||||||
|
|
||||||
// Make sure that your group is surrounded in boundary characters such as below to reduce false positives.
|
// Make sure that your group is surrounded in boundary characters such as below to reduce false positives.
|
||||||
// Bounds have been removed because there are some cases that tokens have trailing frontslash(/) or plus sign (+)
|
//Bounds have been removed because there are some cases that tokens have trailing frontslash(/) or plus sign (+)
|
||||||
keyPat = regexp.MustCompile(detectors.PrefixRegex([]string{"kraken"}) + `\b([0-9A-Za-z\/\+=]{56}[ "'\r\n]{1})`)
|
keyPat = regexp.MustCompile(detectors.PrefixRegex([]string{"kraken"}) + `\b([0-9A-Za-z\/\+=]{56}[ "'\r\n]{1})`)
|
||||||
privKeyPat = regexp.MustCompile(detectors.PrefixRegex([]string{"kraken"}) + `\b([0-9A-Za-z\/\+=]{86,88}[ "'\r\n]{1})`)
|
privKeyPat = regexp.MustCompile(detectors.PrefixRegex([]string{"kraken"}) + `\b([0-9A-Za-z\/\+=]{86,88}[ "'\r\n]{1})`)
|
||||||
)
|
)
|
||||||
@@ -61,12 +62,11 @@ func (s Scanner) FromData(ctx context.Context, verify bool, data []byte) (result
|
|||||||
s1 := detectors.Result{
|
s1 := detectors.Result{
|
||||||
DetectorType: detectorspb.DetectorType_Kraken,
|
DetectorType: detectorspb.DetectorType_Kraken,
|
||||||
Raw: []byte(resMatch),
|
Raw: []byte(resMatch),
|
||||||
RawV2: []byte(resMatch + resPrivKeyMatch),
|
|
||||||
}
|
}
|
||||||
|
|
||||||
if verify {
|
if verify {
|
||||||
|
|
||||||
// Increasing 64-bit integer, for each request that is made with a particular API key.
|
//Increasing 64-bit integer, for each request that is made with a particular API key.
|
||||||
apiNonce := strconv.FormatInt(time.Now().Unix(), 10)
|
apiNonce := strconv.FormatInt(time.Now().Unix(), 10)
|
||||||
|
|
||||||
payload := url.Values{}
|
payload := url.Values{}
|
||||||
@@ -106,7 +106,7 @@ func (s Scanner) FromData(ctx context.Context, verify bool, data []byte) (result
|
|||||||
return detectors.CleanResults(results), nil
|
return detectors.CleanResults(results), nil
|
||||||
}
|
}
|
||||||
|
|
||||||
// Code from https://docs.kraken.com/rest/#section/Authentication/Headers-and-Signature
|
//Code from https://docs.kraken.com/rest/#section/Authentication/Headers-and-Signature
|
||||||
func getKrakenSignature(url_path string, values url.Values, secret []byte) string {
|
func getKrakenSignature(url_path string, values url.Values, secret []byte) string {
|
||||||
|
|
||||||
sha := sha256.New()
|
sha := sha256.New()
|
||||||
|
|||||||
@@ -65,7 +65,6 @@ func (s Scanner) FromData(ctx context.Context, verify bool, data []byte) (result
|
|||||||
s1 := detectors.Result{
|
s1 := detectors.Result{
|
||||||
DetectorType: detectorspb.DetectorType_KuCoin,
|
DetectorType: detectorspb.DetectorType_KuCoin,
|
||||||
Raw: []byte(resKeyMatch),
|
Raw: []byte(resKeyMatch),
|
||||||
RawV2: []byte(resKeyMatch + resPassphraseMatch),
|
|
||||||
}
|
}
|
||||||
|
|
||||||
if verify {
|
if verify {
|
||||||
|
|||||||
@@ -53,7 +53,6 @@ func (s Scanner) FromData(ctx context.Context, verify bool, data []byte) (result
|
|||||||
s1 := detectors.Result{
|
s1 := detectors.Result{
|
||||||
DetectorType: detectorspb.DetectorType_MattermostPersonalToken,
|
DetectorType: detectorspb.DetectorType_MattermostPersonalToken,
|
||||||
Raw: []byte(resMatch),
|
Raw: []byte(resMatch),
|
||||||
RawV2: []byte(resMatch + serverRes),
|
|
||||||
}
|
}
|
||||||
|
|
||||||
if verify {
|
if verify {
|
||||||
|
|||||||
@@ -52,7 +52,6 @@ func (s Scanner) FromData(ctx context.Context, verify bool, data []byte) (result
|
|||||||
s1 := detectors.Result{
|
s1 := detectors.Result{
|
||||||
DetectorType: detectorspb.DetectorType_Mux,
|
DetectorType: detectorspb.DetectorType_Mux,
|
||||||
Raw: []byte(resMatch),
|
Raw: []byte(resMatch),
|
||||||
RawV2: []byte(resMatch + resSecretMatch),
|
|
||||||
}
|
}
|
||||||
|
|
||||||
if verify {
|
if verify {
|
||||||
|
|||||||
@@ -51,7 +51,6 @@ func (s Scanner) FromData(ctx context.Context, verify bool, data []byte) (result
|
|||||||
s1 := detectors.Result{
|
s1 := detectors.Result{
|
||||||
DetectorType: detectorspb.DetectorType_NexmoApiKey,
|
DetectorType: detectorspb.DetectorType_NexmoApiKey,
|
||||||
Raw: []byte(resMatch),
|
Raw: []byte(resMatch),
|
||||||
RawV2: []byte(resMatch + resSecret),
|
|
||||||
}
|
}
|
||||||
|
|
||||||
if verify {
|
if verify {
|
||||||
|
|||||||
@@ -52,7 +52,6 @@ func (s Scanner) FromData(ctx context.Context, verify bool, data []byte) (result
|
|||||||
DetectorType: detectorspb.DetectorType_Plivo,
|
DetectorType: detectorspb.DetectorType_Plivo,
|
||||||
Redacted: id,
|
Redacted: id,
|
||||||
Raw: []byte(resMatch),
|
Raw: []byte(resMatch),
|
||||||
RawV2: []byte(resMatch + id),
|
|
||||||
}
|
}
|
||||||
stringResMatch := fmt.Sprintf("%s:%s", id, resMatch)
|
stringResMatch := fmt.Sprintf("%s:%s", id, resMatch)
|
||||||
decodeSecret := b64.StdEncoding.EncodeToString([]byte(stringResMatch))
|
decodeSecret := b64.StdEncoding.EncodeToString([]byte(stringResMatch))
|
||||||
|
|||||||
@@ -58,7 +58,6 @@ func (s Scanner) FromData(ctx context.Context, verify bool, data []byte) (result
|
|||||||
s1 := detectors.Result{
|
s1 := detectors.Result{
|
||||||
DetectorType: detectorspb.DetectorType_Poloniex,
|
DetectorType: detectorspb.DetectorType_Poloniex,
|
||||||
Raw: []byte(resSecretMatch),
|
Raw: []byte(resSecretMatch),
|
||||||
RawV2: []byte(resMatch + resSecretMatch),
|
|
||||||
}
|
}
|
||||||
|
|
||||||
if verify {
|
if verify {
|
||||||
|
|||||||
@@ -72,7 +72,6 @@ func (s Scanner) FromData(ctx context.Context, verify bool, data []byte) (result
|
|||||||
s1 := detectors.Result{
|
s1 := detectors.Result{
|
||||||
DetectorType: detectorspb.DetectorType_PusherChannelKey,
|
DetectorType: detectorspb.DetectorType_PusherChannelKey,
|
||||||
Raw: []byte(resappMatch),
|
Raw: []byte(resappMatch),
|
||||||
RawV2: []byte(resappMatch + reskeyMatch),
|
|
||||||
}
|
}
|
||||||
|
|
||||||
if verify {
|
if verify {
|
||||||
|
|||||||
@@ -54,7 +54,6 @@ func (s Scanner) FromData(ctx context.Context, verify bool, data []byte) (result
|
|||||||
s1 := detectors.Result{
|
s1 := detectors.Result{
|
||||||
DetectorType: detectorspb.DetectorType_Roaring,
|
DetectorType: detectorspb.DetectorType_Roaring,
|
||||||
Raw: []byte(resClient),
|
Raw: []byte(resClient),
|
||||||
RawV2: []byte(resClient + resSecret),
|
|
||||||
}
|
}
|
||||||
|
|
||||||
if verify {
|
if verify {
|
||||||
|
|||||||
@@ -61,7 +61,6 @@ func (s Scanner) FromData(ctx context.Context, verify bool, data []byte) (result
|
|||||||
s1 := detectors.Result{
|
s1 := detectors.Result{
|
||||||
DetectorType: detectorspb.DetectorType_Rownd,
|
DetectorType: detectorspb.DetectorType_Rownd,
|
||||||
Raw: []byte(keyMatch),
|
Raw: []byte(keyMatch),
|
||||||
RawV2: []byte(keyMatch + secretMatch),
|
|
||||||
}
|
}
|
||||||
|
|
||||||
if verify {
|
if verify {
|
||||||
|
|||||||
@@ -62,7 +62,6 @@ func (s Scanner) FromData(ctx context.Context, verify bool, data []byte) (result
|
|||||||
s1 := detectors.Result{
|
s1 := detectors.Result{
|
||||||
DetectorType: detectorspb.DetectorType_SatismeterProjectkey,
|
DetectorType: detectorspb.DetectorType_SatismeterProjectkey,
|
||||||
Raw: []byte(resMatch),
|
Raw: []byte(resMatch),
|
||||||
RawV2: []byte(resMatch + resPassMatch),
|
|
||||||
}
|
}
|
||||||
|
|
||||||
if verify {
|
if verify {
|
||||||
|
|||||||
@@ -69,9 +69,7 @@ func (s Scanner) FromData(ctx context.Context, verify bool, data []byte) (result
|
|||||||
if err == nil {
|
if err == nil {
|
||||||
defer res.Body.Close()
|
defer res.Body.Close()
|
||||||
var authResponse authRes
|
var authResponse authRes
|
||||||
if err := json.NewDecoder(res.Body).Decode(&authResponse); err != nil {
|
json.NewDecoder(res.Body).Decode(&authResponse)
|
||||||
continue
|
|
||||||
}
|
|
||||||
s.Verified = authResponse.Ok
|
s.Verified = authResponse.Ok
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
|
|||||||
@@ -54,7 +54,6 @@ func (s Scanner) FromData(ctx context.Context, verify bool, data []byte) (result
|
|||||||
s1 := detectors.Result{
|
s1 := detectors.Result{
|
||||||
DetectorType: detectorspb.DetectorType_Smooch,
|
DetectorType: detectorspb.DetectorType_Smooch,
|
||||||
Raw: []byte(resMatch),
|
Raw: []byte(resMatch),
|
||||||
RawV2: []byte(resMatch + resSecret),
|
|
||||||
}
|
}
|
||||||
|
|
||||||
if verify {
|
if verify {
|
||||||
|
|||||||
@@ -60,7 +60,6 @@ func (s Scanner) FromData(ctx context.Context, verify bool, data []byte) (result
|
|||||||
s1 := detectors.Result{
|
s1 := detectors.Result{
|
||||||
DetectorType: detectorspb.DetectorType_Strava,
|
DetectorType: detectorspb.DetectorType_Strava,
|
||||||
Raw: []byte(resId),
|
Raw: []byte(resId),
|
||||||
RawV2: []byte(resId + resSecret),
|
|
||||||
}
|
}
|
||||||
|
|
||||||
if verify {
|
if verify {
|
||||||
|
|||||||
@@ -54,7 +54,6 @@ func (s Scanner) FromData(ctx context.Context, verify bool, data []byte) (result
|
|||||||
s1 := detectors.Result{
|
s1 := detectors.Result{
|
||||||
DetectorType: detectorspb.DetectorType_Textmagic,
|
DetectorType: detectorspb.DetectorType_Textmagic,
|
||||||
Raw: []byte(resMatch),
|
Raw: []byte(resMatch),
|
||||||
RawV2: []byte(resMatch + resUser),
|
|
||||||
}
|
}
|
||||||
|
|
||||||
if verify {
|
if verify {
|
||||||
|
|||||||
@@ -53,7 +53,6 @@ func (s Scanner) FromData(ctx context.Context, verify bool, data []byte) (result
|
|||||||
s1 := detectors.Result{
|
s1 := detectors.Result{
|
||||||
DetectorType: detectorspb.DetectorType_Tru,
|
DetectorType: detectorspb.DetectorType_Tru,
|
||||||
Raw: []byte(resMatch),
|
Raw: []byte(resMatch),
|
||||||
RawV2: []byte(resMatch + resSecret),
|
|
||||||
}
|
}
|
||||||
|
|
||||||
if verify {
|
if verify {
|
||||||
|
|||||||
@@ -54,7 +54,6 @@ func (s Scanner) FromData(ctx context.Context, verify bool, data []byte) (result
|
|||||||
s1 := detectors.Result{
|
s1 := detectors.Result{
|
||||||
DetectorType: detectorspb.DetectorType_Vouchery,
|
DetectorType: detectorspb.DetectorType_Vouchery,
|
||||||
Raw: []byte(resMatch),
|
Raw: []byte(resMatch),
|
||||||
RawV2: []byte(resMatch + subMatch),
|
|
||||||
}
|
}
|
||||||
|
|
||||||
if verify {
|
if verify {
|
||||||
|
|||||||
@@ -6,18 +6,15 @@ import (
|
|||||||
|
|
||||||
"github.com/go-errors/errors"
|
"github.com/go-errors/errors"
|
||||||
"github.com/sirupsen/logrus"
|
"github.com/sirupsen/logrus"
|
||||||
|
"github.com/trufflesecurity/trufflehog/v3/pkg/pb/sourcespb"
|
||||||
|
"github.com/trufflesecurity/trufflehog/v3/pkg/sources/filesystem"
|
||||||
"google.golang.org/protobuf/proto"
|
"google.golang.org/protobuf/proto"
|
||||||
"google.golang.org/protobuf/types/known/anypb"
|
"google.golang.org/protobuf/types/known/anypb"
|
||||||
|
|
||||||
"github.com/trufflesecurity/trufflehog/v3/pkg/pb/sourcespb"
|
|
||||||
"github.com/trufflesecurity/trufflehog/v3/pkg/sources"
|
|
||||||
"github.com/trufflesecurity/trufflehog/v3/pkg/sources/filesystem"
|
|
||||||
)
|
)
|
||||||
|
|
||||||
// ScanFileSystem scans a given file system.
|
func (e *Engine) ScanFileSystem(ctx context.Context, directories []string) error {
|
||||||
func (e *Engine) ScanFileSystem(ctx context.Context, c sources.Config) error {
|
|
||||||
connection := &sourcespb.Filesystem{
|
connection := &sourcespb.Filesystem{
|
||||||
Directories: c.Directories,
|
Directories: directories,
|
||||||
}
|
}
|
||||||
var conn anypb.Any
|
var conn anypb.Any
|
||||||
err := anypb.MarshalFrom(&conn, connection, proto.MarshalOptions{})
|
err := anypb.MarshalFrom(&conn, connection, proto.MarshalOptions{})
|
||||||
|
|||||||
+28
-29
@@ -6,40 +6,39 @@ import (
|
|||||||
"runtime"
|
"runtime"
|
||||||
|
|
||||||
"github.com/go-errors/errors"
|
"github.com/go-errors/errors"
|
||||||
|
"github.com/go-git/go-git/v5/plumbing/object"
|
||||||
|
|
||||||
gogit "github.com/go-git/go-git/v5"
|
gogit "github.com/go-git/go-git/v5"
|
||||||
"github.com/go-git/go-git/v5/plumbing"
|
"github.com/go-git/go-git/v5/plumbing"
|
||||||
"github.com/go-git/go-git/v5/plumbing/object"
|
|
||||||
"github.com/sirupsen/logrus"
|
"github.com/sirupsen/logrus"
|
||||||
|
"github.com/trufflesecurity/trufflehog/v3/pkg/common"
|
||||||
"github.com/trufflesecurity/trufflehog/v3/pkg/pb/source_metadatapb"
|
"github.com/trufflesecurity/trufflehog/v3/pkg/pb/source_metadatapb"
|
||||||
"github.com/trufflesecurity/trufflehog/v3/pkg/pb/sourcespb"
|
"github.com/trufflesecurity/trufflehog/v3/pkg/pb/sourcespb"
|
||||||
"github.com/trufflesecurity/trufflehog/v3/pkg/sources"
|
|
||||||
"github.com/trufflesecurity/trufflehog/v3/pkg/sources/git"
|
"github.com/trufflesecurity/trufflehog/v3/pkg/sources/git"
|
||||||
)
|
)
|
||||||
|
|
||||||
// ScanGit scans any git source.
|
func (e *Engine) ScanGit(ctx context.Context, repoPath, headRef, baseRef string, maxDepth int, filter *common.Filter) error {
|
||||||
func (e *Engine) ScanGit(ctx context.Context, c sources.Config) error {
|
|
||||||
logOptions := &gogit.LogOptions{}
|
logOptions := &gogit.LogOptions{}
|
||||||
opts := []git.ScanOption{
|
opts := []git.ScanOption{
|
||||||
git.ScanOptionFilter(c.Filter),
|
git.ScanOptionFilter(filter),
|
||||||
git.ScanOptionLogOptions(logOptions),
|
git.ScanOptionLogOptions(logOptions),
|
||||||
}
|
}
|
||||||
|
|
||||||
repo, err := gogit.PlainOpenWithOptions(c.RepoPath, &gogit.PlainOpenOptions{DetectDotGit: true})
|
repo, err := gogit.PlainOpenWithOptions(repoPath, &gogit.PlainOpenOptions{DetectDotGit: true})
|
||||||
if err != nil {
|
if err != nil {
|
||||||
return fmt.Errorf("could open repo: %s: %w", c.RepoPath, err)
|
return fmt.Errorf("could open repo: %s: %w", repoPath, err)
|
||||||
}
|
}
|
||||||
|
|
||||||
var baseCommit *object.Commit
|
var baseCommit *object.Commit
|
||||||
if len(c.BaseRef) > 0 {
|
if len(baseRef) > 0 {
|
||||||
baseHash := plumbing.NewHash(c.BaseRef)
|
baseHash := plumbing.NewHash(baseRef)
|
||||||
if !plumbing.IsHash(c.BaseRef) {
|
if !plumbing.IsHash(baseRef) {
|
||||||
base, err := git.TryAdditionalBaseRefs(repo, c.BaseRef)
|
base, err := git.TryAdditionalBaseRefs(repo, baseRef)
|
||||||
if err != nil {
|
if err != nil {
|
||||||
return errors.WrapPrefix(err, "unable to resolve base ref", 0)
|
return errors.WrapPrefix(err, "unable to resolve base ref", 0)
|
||||||
} else {
|
} else {
|
||||||
c.BaseRef = base.String()
|
baseRef = base.String()
|
||||||
baseCommit, _ = repo.CommitObject(plumbing.NewHash(c.BaseRef))
|
baseCommit, _ = repo.CommitObject(plumbing.NewHash(baseRef))
|
||||||
}
|
}
|
||||||
} else {
|
} else {
|
||||||
baseCommit, err = repo.CommitObject(baseHash)
|
baseCommit, err = repo.CommitObject(baseHash)
|
||||||
@@ -50,15 +49,15 @@ func (e *Engine) ScanGit(ctx context.Context, c sources.Config) error {
|
|||||||
}
|
}
|
||||||
|
|
||||||
var headCommit *object.Commit
|
var headCommit *object.Commit
|
||||||
if len(c.HeadRef) > 0 {
|
if len(headRef) > 0 {
|
||||||
headHash := plumbing.NewHash(c.HeadRef)
|
headHash := plumbing.NewHash(headRef)
|
||||||
if !plumbing.IsHash(c.HeadRef) {
|
if !plumbing.IsHash(headRef) {
|
||||||
head, err := git.TryAdditionalBaseRefs(repo, c.HeadRef)
|
head, err := git.TryAdditionalBaseRefs(repo, headRef)
|
||||||
if err != nil {
|
if err != nil {
|
||||||
return errors.WrapPrefix(err, "unable to resolve head ref", 0)
|
return errors.WrapPrefix(err, "unable to resolve head ref", 0)
|
||||||
} else {
|
} else {
|
||||||
c.HeadRef = head.String()
|
headRef = head.String()
|
||||||
headCommit, _ = repo.CommitObject(plumbing.NewHash(c.BaseRef))
|
headCommit, _ = repo.CommitObject(plumbing.NewHash(baseRef))
|
||||||
}
|
}
|
||||||
} else {
|
} else {
|
||||||
headCommit, err = repo.CommitObject(headHash)
|
headCommit, err = repo.CommitObject(headHash)
|
||||||
@@ -68,23 +67,23 @@ func (e *Engine) ScanGit(ctx context.Context, c sources.Config) error {
|
|||||||
}
|
}
|
||||||
}
|
}
|
||||||
|
|
||||||
// If baseCommit is an ancestor of headCommit, update c.BaseRef to be the common ancestor.
|
// If baseCommit is an ancestor of headCommit, update baseRef to be the common ancestor.
|
||||||
if headCommit != nil && baseCommit != nil {
|
if headCommit != nil && baseCommit != nil {
|
||||||
mergeBase, err := headCommit.MergeBase(baseCommit)
|
mergeBase, err := headCommit.MergeBase(baseCommit)
|
||||||
if err != nil || len(mergeBase) < 1 {
|
if err != nil || len(mergeBase) < 1 {
|
||||||
return errors.WrapPrefix(err, "could not find common base between the given references", 0)
|
return errors.WrapPrefix(err, "could not find common base between the given references", 0)
|
||||||
}
|
}
|
||||||
c.BaseRef = mergeBase[0].Hash.String()
|
baseRef = mergeBase[0].Hash.String()
|
||||||
}
|
}
|
||||||
|
|
||||||
if c.MaxDepth != 0 {
|
if maxDepth != 0 {
|
||||||
opts = append(opts, git.ScanOptionMaxDepth(int64(c.MaxDepth)))
|
opts = append(opts, git.ScanOptionMaxDepth(int64(maxDepth)))
|
||||||
}
|
}
|
||||||
if c.BaseRef != "" {
|
if baseRef != "" {
|
||||||
opts = append(opts, git.ScanOptionBaseHash(c.BaseRef))
|
opts = append(opts, git.ScanOptionBaseHash(baseRef))
|
||||||
}
|
}
|
||||||
if c.HeadRef != "" {
|
if headRef != "" {
|
||||||
opts = append(opts, git.ScanOptionHeadCommit(c.HeadRef))
|
opts = append(opts, git.ScanOptionHeadCommit(headRef))
|
||||||
}
|
}
|
||||||
scanOptions := git.NewScanOptions(opts...)
|
scanOptions := git.NewScanOptions(opts...)
|
||||||
|
|
||||||
@@ -107,7 +106,7 @@ func (e *Engine) ScanGit(ctx context.Context, c sources.Config) error {
|
|||||||
e.sourcesWg.Add(1)
|
e.sourcesWg.Add(1)
|
||||||
go func() {
|
go func() {
|
||||||
defer e.sourcesWg.Done()
|
defer e.sourcesWg.Done()
|
||||||
err := gitSource.ScanRepo(ctx, repo, c.RepoPath, scanOptions, e.ChunksChan())
|
err := gitSource.ScanRepo(ctx, repo, repoPath, scanOptions, e.ChunksChan())
|
||||||
if err != nil {
|
if err != nil {
|
||||||
logrus.WithError(err).Fatal("could not scan repo")
|
logrus.WithError(err).Fatal("could not scan repo")
|
||||||
}
|
}
|
||||||
|
|||||||
+3
-19
@@ -8,7 +8,6 @@ import (
|
|||||||
"github.com/trufflesecurity/trufflehog/v3/pkg/common"
|
"github.com/trufflesecurity/trufflehog/v3/pkg/common"
|
||||||
"github.com/trufflesecurity/trufflehog/v3/pkg/decoders"
|
"github.com/trufflesecurity/trufflehog/v3/pkg/decoders"
|
||||||
"github.com/trufflesecurity/trufflehog/v3/pkg/pb/source_metadatapb"
|
"github.com/trufflesecurity/trufflehog/v3/pkg/pb/source_metadatapb"
|
||||||
"github.com/trufflesecurity/trufflehog/v3/pkg/sources"
|
|
||||||
"github.com/trufflesecurity/trufflehog/v3/pkg/sources/git"
|
"github.com/trufflesecurity/trufflehog/v3/pkg/sources/git"
|
||||||
)
|
)
|
||||||
|
|
||||||
@@ -38,7 +37,7 @@ func TestGitEngine(t *testing.T) {
|
|||||||
"all_secrets": {
|
"all_secrets": {
|
||||||
expected: map[string]expResult{
|
expected: map[string]expResult{
|
||||||
"70001020fab32b1fcf2f1f0e5c66424eae649826": {"AKIAXYZDQCEN4B6JSJQI", 2},
|
"70001020fab32b1fcf2f1f0e5c66424eae649826": {"AKIAXYZDQCEN4B6JSJQI", 2},
|
||||||
"84e9c75e388ae3e866e121087ea2dd45a71068f2": {"AKIAILE3JG6KMS3HZGCA", 4},
|
"90c75f884c65dc3638ca1610bd9844e668f213c2": {"AKIAILE3JG6KMS3HZGCA", 4},
|
||||||
"8afb0ecd4998b1179e428db5ebbcdc8221214432": {"369963c1434c377428ca8531fbc46c0c43d037a0", 3},
|
"8afb0ecd4998b1179e428db5ebbcdc8221214432": {"369963c1434c377428ca8531fbc46c0c43d037a0", 3},
|
||||||
"27fbead3bf883cdb7de9d7825ed401f28f9398f1": {"ffc7e0f9400fb6300167009e42d2f842cd7956e2", 7},
|
"27fbead3bf883cdb7de9d7825ed401f28f9398f1": {"ffc7e0f9400fb6300167009e42d2f842cd7956e2", 7},
|
||||||
},
|
},
|
||||||
@@ -57,16 +56,7 @@ func TestGitEngine(t *testing.T) {
|
|||||||
WithDecoders(decoders.DefaultDecoders()...),
|
WithDecoders(decoders.DefaultDecoders()...),
|
||||||
WithDetectors(false, DefaultDetectors()...),
|
WithDetectors(false, DefaultDetectors()...),
|
||||||
)
|
)
|
||||||
cfg := sources.Config{
|
e.ScanGit(ctx, path, tTest.branch, tTest.base, tTest.maxDepth, tTest.filter)
|
||||||
RepoPath: path,
|
|
||||||
HeadRef: tTest.branch,
|
|
||||||
BaseRef: tTest.base,
|
|
||||||
MaxDepth: tTest.maxDepth,
|
|
||||||
Filter: tTest.filter,
|
|
||||||
}
|
|
||||||
if err := e.ScanGit(ctx, cfg); err != nil {
|
|
||||||
return
|
|
||||||
}
|
|
||||||
go e.Finish()
|
go e.Finish()
|
||||||
resultCount := 0
|
resultCount := 0
|
||||||
for result := range e.ResultsChan() {
|
for result := range e.ResultsChan() {
|
||||||
@@ -114,13 +104,7 @@ func BenchmarkGitEngine(b *testing.B) {
|
|||||||
for i := 0; i < b.N; i++ {
|
for i := 0; i < b.N; i++ {
|
||||||
// TODO: this is measuring the time it takes to initialize the source
|
// TODO: this is measuring the time it takes to initialize the source
|
||||||
// and not to do the full scan
|
// and not to do the full scan
|
||||||
cfg := sources.Config{
|
e.ScanGit(ctx, path, "", "", 0, common.FilterEmpty())
|
||||||
RepoPath: path,
|
|
||||||
Filter: common.FilterEmpty(),
|
|
||||||
}
|
|
||||||
if err := e.ScanGit(ctx, cfg); err != nil {
|
|
||||||
return
|
|
||||||
}
|
|
||||||
}
|
}
|
||||||
e.Finish()
|
e.Finish()
|
||||||
}
|
}
|
||||||
|
|||||||
+10
-11
@@ -7,35 +7,34 @@ import (
|
|||||||
"google.golang.org/protobuf/proto"
|
"google.golang.org/protobuf/proto"
|
||||||
"google.golang.org/protobuf/types/known/anypb"
|
"google.golang.org/protobuf/types/known/anypb"
|
||||||
|
|
||||||
|
"github.com/trufflesecurity/trufflehog/v3/pkg/common"
|
||||||
"github.com/trufflesecurity/trufflehog/v3/pkg/pb/sourcespb"
|
"github.com/trufflesecurity/trufflehog/v3/pkg/pb/sourcespb"
|
||||||
"github.com/trufflesecurity/trufflehog/v3/pkg/sources"
|
|
||||||
"github.com/trufflesecurity/trufflehog/v3/pkg/sources/github"
|
"github.com/trufflesecurity/trufflehog/v3/pkg/sources/github"
|
||||||
)
|
)
|
||||||
|
|
||||||
// ScanGitHub scans Github with the provided options.
|
func (e *Engine) ScanGitHub(ctx context.Context, endpoint string, repos, orgs []string, token string, includeForks bool, filter *common.Filter, concurrency int, includeMembers bool) error {
|
||||||
func (e *Engine) ScanGitHub(ctx context.Context, c sources.Config) error {
|
|
||||||
source := github.Source{}
|
source := github.Source{}
|
||||||
connection := sourcespb.GitHub{
|
connection := sourcespb.GitHub{
|
||||||
Endpoint: c.Endpoint,
|
Endpoint: endpoint,
|
||||||
Organizations: c.Orgs,
|
Organizations: orgs,
|
||||||
Repositories: c.Repos,
|
Repositories: repos,
|
||||||
ScanUsers: c.IncludeMembers,
|
ScanUsers: includeMembers,
|
||||||
}
|
}
|
||||||
if len(c.Token) > 0 {
|
if len(token) > 0 {
|
||||||
connection.Credential = &sourcespb.GitHub_Token{
|
connection.Credential = &sourcespb.GitHub_Token{
|
||||||
Token: c.Token,
|
Token: token,
|
||||||
}
|
}
|
||||||
} else {
|
} else {
|
||||||
connection.Credential = &sourcespb.GitHub_Unauthenticated{}
|
connection.Credential = &sourcespb.GitHub_Unauthenticated{}
|
||||||
}
|
}
|
||||||
connection.IncludeForks = c.IncludeForks
|
connection.IncludeForks = includeForks
|
||||||
var conn anypb.Any
|
var conn anypb.Any
|
||||||
err := anypb.MarshalFrom(&conn, &connection, proto.MarshalOptions{})
|
err := anypb.MarshalFrom(&conn, &connection, proto.MarshalOptions{})
|
||||||
if err != nil {
|
if err != nil {
|
||||||
logrus.WithError(err).Error("failed to marshal github connection")
|
logrus.WithError(err).Error("failed to marshal github connection")
|
||||||
return err
|
return err
|
||||||
}
|
}
|
||||||
err = source.Init(ctx, "trufflehog - github", 0, 0, false, &conn, c.Concurrency)
|
err = source.Init(ctx, "trufflehog - github", 0, 0, false, &conn, concurrency)
|
||||||
if err != nil {
|
if err != nil {
|
||||||
logrus.WithError(err).Error("failed to initialize github source")
|
logrus.WithError(err).Error("failed to initialize github source")
|
||||||
return err
|
return err
|
||||||
|
|||||||
+9
-12
@@ -6,34 +6,31 @@ import (
|
|||||||
|
|
||||||
"github.com/go-errors/errors"
|
"github.com/go-errors/errors"
|
||||||
"github.com/sirupsen/logrus"
|
"github.com/sirupsen/logrus"
|
||||||
|
"github.com/trufflesecurity/trufflehog/v3/pkg/pb/sourcespb"
|
||||||
|
"github.com/trufflesecurity/trufflehog/v3/pkg/sources/gitlab"
|
||||||
"golang.org/x/net/context"
|
"golang.org/x/net/context"
|
||||||
"google.golang.org/protobuf/proto"
|
"google.golang.org/protobuf/proto"
|
||||||
"google.golang.org/protobuf/types/known/anypb"
|
"google.golang.org/protobuf/types/known/anypb"
|
||||||
|
|
||||||
"github.com/trufflesecurity/trufflehog/v3/pkg/pb/sourcespb"
|
|
||||||
"github.com/trufflesecurity/trufflehog/v3/pkg/sources"
|
|
||||||
"github.com/trufflesecurity/trufflehog/v3/pkg/sources/gitlab"
|
|
||||||
)
|
)
|
||||||
|
|
||||||
// ScanGitLab scans GitLab with the provided configuration.
|
func (e *Engine) ScanGitLab(ctx context.Context, endpoint, token string, repositories []string) error {
|
||||||
func (e *Engine) ScanGitLab(ctx context.Context, c sources.Config) error {
|
|
||||||
connection := &sourcespb.GitLab{}
|
connection := &sourcespb.GitLab{}
|
||||||
|
|
||||||
switch {
|
switch {
|
||||||
case len(c.Token) > 0:
|
case len(token) > 0:
|
||||||
connection.Credential = &sourcespb.GitLab_Token{
|
connection.Credential = &sourcespb.GitLab_Token{
|
||||||
Token: c.Token,
|
Token: token,
|
||||||
}
|
}
|
||||||
default:
|
default:
|
||||||
return fmt.Errorf("must provide token")
|
return fmt.Errorf("must provide token")
|
||||||
}
|
}
|
||||||
|
|
||||||
if len(c.Endpoint) > 0 {
|
if len(endpoint) > 0 {
|
||||||
connection.Endpoint = c.Endpoint
|
connection.Endpoint = endpoint
|
||||||
}
|
}
|
||||||
|
|
||||||
if len(c.Repos) > 0 {
|
if len(repositories) > 0 {
|
||||||
connection.Repositories = c.Repos
|
connection.Repositories = repositories
|
||||||
}
|
}
|
||||||
|
|
||||||
var conn anypb.Any
|
var conn anypb.Any
|
||||||
|
|||||||
+10
-13
@@ -7,36 +7,33 @@ import (
|
|||||||
|
|
||||||
"github.com/go-errors/errors"
|
"github.com/go-errors/errors"
|
||||||
"github.com/sirupsen/logrus"
|
"github.com/sirupsen/logrus"
|
||||||
"google.golang.org/protobuf/proto"
|
|
||||||
"google.golang.org/protobuf/types/known/anypb"
|
|
||||||
|
|
||||||
"github.com/trufflesecurity/trufflehog/v3/pkg/pb/credentialspb"
|
"github.com/trufflesecurity/trufflehog/v3/pkg/pb/credentialspb"
|
||||||
"github.com/trufflesecurity/trufflehog/v3/pkg/pb/sourcespb"
|
"github.com/trufflesecurity/trufflehog/v3/pkg/pb/sourcespb"
|
||||||
"github.com/trufflesecurity/trufflehog/v3/pkg/sources"
|
|
||||||
"github.com/trufflesecurity/trufflehog/v3/pkg/sources/s3"
|
"github.com/trufflesecurity/trufflehog/v3/pkg/sources/s3"
|
||||||
|
"google.golang.org/protobuf/proto"
|
||||||
|
"google.golang.org/protobuf/types/known/anypb"
|
||||||
)
|
)
|
||||||
|
|
||||||
// ScanS3 scans S3 buckets.
|
func (e *Engine) ScanS3(ctx context.Context, key, secret string, cloudCred bool, buckets []string) error {
|
||||||
func (e *Engine) ScanS3(ctx context.Context, c sources.Config) error {
|
|
||||||
connection := &sourcespb.S3{
|
connection := &sourcespb.S3{
|
||||||
Credential: &sourcespb.S3_Unauthenticated{},
|
Credential: &sourcespb.S3_Unauthenticated{},
|
||||||
}
|
}
|
||||||
if c.CloudCred {
|
if cloudCred {
|
||||||
if len(c.Key) > 0 || len(c.Secret) > 0 {
|
if len(key) > 0 || len(secret) > 0 {
|
||||||
return fmt.Errorf("cannot use cloud credentials and basic auth together")
|
return fmt.Errorf("cannot use cloud credentials and basic auth together")
|
||||||
}
|
}
|
||||||
connection.Credential = &sourcespb.S3_CloudEnvironment{}
|
connection.Credential = &sourcespb.S3_CloudEnvironment{}
|
||||||
}
|
}
|
||||||
if len(c.Key) > 0 && len(c.Secret) > 0 {
|
if len(key) > 0 && len(secret) > 0 {
|
||||||
connection.Credential = &sourcespb.S3_AccessKey{
|
connection.Credential = &sourcespb.S3_AccessKey{
|
||||||
AccessKey: &credentialspb.KeySecret{
|
AccessKey: &credentialspb.KeySecret{
|
||||||
Key: c.Key,
|
Key: key,
|
||||||
Secret: c.Secret,
|
Secret: secret,
|
||||||
},
|
},
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
if len(c.Buckets) > 0 {
|
if len(buckets) > 0 {
|
||||||
connection.Buckets = c.Buckets
|
connection.Buckets = buckets
|
||||||
}
|
}
|
||||||
var conn anypb.Any
|
var conn anypb.Any
|
||||||
err := anypb.MarshalFrom(&conn, connection, proto.MarshalOptions{})
|
err := anypb.MarshalFrom(&conn, connection, proto.MarshalOptions{})
|
||||||
|
|||||||
+8
-10
@@ -10,26 +10,24 @@ import (
|
|||||||
"google.golang.org/protobuf/types/known/anypb"
|
"google.golang.org/protobuf/types/known/anypb"
|
||||||
|
|
||||||
"github.com/trufflesecurity/trufflehog/v3/pkg/pb/sourcespb"
|
"github.com/trufflesecurity/trufflehog/v3/pkg/pb/sourcespb"
|
||||||
"github.com/trufflesecurity/trufflehog/v3/pkg/sources"
|
|
||||||
"github.com/trufflesecurity/trufflehog/v3/pkg/sources/syslog"
|
"github.com/trufflesecurity/trufflehog/v3/pkg/sources/syslog"
|
||||||
)
|
)
|
||||||
|
|
||||||
// ScanSyslog is a source that scans syslog files.
|
func (e *Engine) ScanSyslog(ctx context.Context, address, protocol, certPath, keyPath, format string, concurrency int) error {
|
||||||
func (e *Engine) ScanSyslog(ctx context.Context, c sources.Config) error {
|
|
||||||
connection := &sourcespb.Syslog{
|
connection := &sourcespb.Syslog{
|
||||||
Protocol: c.Protocol,
|
Protocol: protocol,
|
||||||
ListenAddress: c.Address,
|
ListenAddress: address,
|
||||||
Format: c.Format,
|
Format: format,
|
||||||
}
|
}
|
||||||
|
|
||||||
if c.CertPath != "" && c.KeyPath != "" {
|
if certPath != "" && keyPath != "" {
|
||||||
cert, err := os.ReadFile(c.CertPath)
|
cert, err := os.ReadFile(certPath)
|
||||||
if err != nil {
|
if err != nil {
|
||||||
return errors.WrapPrefix(err, "could not open TLS cert file", 0)
|
return errors.WrapPrefix(err, "could not open TLS cert file", 0)
|
||||||
}
|
}
|
||||||
connection.TlsCert = string(cert)
|
connection.TlsCert = string(cert)
|
||||||
|
|
||||||
key, err := os.ReadFile(c.KeyPath)
|
key, err := os.ReadFile(keyPath)
|
||||||
if err != nil {
|
if err != nil {
|
||||||
return errors.WrapPrefix(err, "could not open TLS key file", 0)
|
return errors.WrapPrefix(err, "could not open TLS key file", 0)
|
||||||
}
|
}
|
||||||
@@ -42,7 +40,7 @@ func (e *Engine) ScanSyslog(ctx context.Context, c sources.Config) error {
|
|||||||
return errors.WrapPrefix(err, "error unmarshalling connection", 0)
|
return errors.WrapPrefix(err, "error unmarshalling connection", 0)
|
||||||
}
|
}
|
||||||
source := syslog.Source{}
|
source := syslog.Source{}
|
||||||
err = source.Init(ctx, "trufflehog - syslog", 0, 0, false, &conn, c.Concurrency)
|
err = source.Init(ctx, "trufflehog - syslog", 0, 0, false, &conn, concurrency)
|
||||||
source.InjectConnection(connection)
|
source.InjectConnection(connection)
|
||||||
if err != nil {
|
if err != nil {
|
||||||
logrus.WithError(err).Error("failed to initialize syslog source")
|
logrus.WithError(err).Error("failed to initialize syslog source")
|
||||||
|
|||||||
Some files were not shown because too many files have changed in this diff Show More
Reference in New Issue
Block a user