-
Notifications
You must be signed in to change notification settings - Fork 1.7k
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
feat(hubspot): unify v1 and v2 implementation
- Loading branch information
Richard Gomez
committed
Jun 18, 2024
1 parent
c719d04
commit 1b4ca8a
Showing
6 changed files
with
120 additions
and
92 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,104 @@ | ||
| package v2 | ||
|
|
||
| import ( | ||
| "context" | ||
| "io" | ||
|
|
||
| // "log" | ||
| "fmt" | ||
| "net/http" | ||
|
|
||
| regexp "github.com/wasilibs/go-re2" | ||
|
|
||
| "github.com/trufflesecurity/trufflehog/v3/pkg/common" | ||
| "github.com/trufflesecurity/trufflehog/v3/pkg/detectors" | ||
| "github.com/trufflesecurity/trufflehog/v3/pkg/pb/detectorspb" | ||
| ) | ||
|
|
||
| type Scanner struct { | ||
| client *http.Client | ||
| } | ||
|
|
||
| func (s Scanner) Version() int { return 2 } | ||
|
|
||
| // Ensure the Scanner satisfies the interface at compile time. | ||
| var _ interface { | ||
| detectors.Detector | ||
| detectors.Versioner | ||
| } = (*Scanner)(nil) | ||
|
|
||
| var ( | ||
| defaultClient = common.SaneHttpClient() | ||
|
|
||
| keyPat = regexp.MustCompile(`\b(pat-(?:eu|na1)-[A-Za-z0-9]{8}\-[A-Za-z0-9]{4}\-[A-Za-z0-9]{4}\-[A-Za-z0-9]{4}\-[A-Za-z0-9]{12})\b`) | ||
| ) | ||
|
|
||
| // Keywords are used for efficiently pre-filtering chunks. | ||
| // Use identifiers in the secret preferably, or the provider name. | ||
| func (s Scanner) Keywords() []string { | ||
| return []string{"pat-na1-", "pat-eu1-"} | ||
| } | ||
|
|
||
| // FromData will find and optionally verify HubSpotApiKey secrets in a given set of bytes. | ||
| func (s Scanner) FromData(ctx context.Context, verify bool, data []byte) (results []detectors.Result, err error) { | ||
| dataStr := string(data) | ||
|
|
||
| uniqueMatches := make(map[string]struct{}) | ||
| for _, match := range keyPat.FindAllStringSubmatch(dataStr, -1) { | ||
| uniqueMatches[match[1]] = struct{}{} | ||
| } | ||
|
|
||
| for token := range uniqueMatches { | ||
| s1 := detectors.Result{ | ||
| DetectorType: detectorspb.DetectorType_HubSpotApiKey, | ||
| Raw: []byte(token), | ||
| Redacted: token[8:] + "...", | ||
| } | ||
|
|
||
| if verify { | ||
| client := s.client | ||
| if client == nil { | ||
| client = defaultClient | ||
| } | ||
|
|
||
| verified, verificationErr := verifyToken(ctx, client, token) | ||
| s1.Verified = verified | ||
| s1.SetVerificationError(verificationErr) | ||
| } | ||
|
|
||
| results = append(results, s1) | ||
| } | ||
|
|
||
| return results, nil | ||
| } | ||
| func verifyToken(ctx context.Context, client *http.Client, token string) (bool, error) { | ||
| req, err := http.NewRequestWithContext(ctx, http.MethodGet, "https://api.hubapi.com/account-info/v3/api-usage/daily/private-apps", nil) | ||
| if err != nil { | ||
| return false, err | ||
| } | ||
| req.Header.Set("Authorization", fmt.Sprintf("Bearer %s", token)) | ||
| res, err := client.Do(req) | ||
| if err != nil { | ||
| return false, err | ||
| } | ||
| defer func() { | ||
| _, _ = io.Copy(io.Discard, res.Body) | ||
| _ = res.Body.Close() | ||
| }() | ||
|
|
||
| switch res.StatusCode { | ||
| case http.StatusOK: | ||
| return true, nil | ||
| case http.StatusUnauthorized: | ||
| return false, nil | ||
| case http.StatusForbidden: | ||
| // The token is valid but lacks permission for the endpoint. | ||
| return true, nil | ||
| default: | ||
| return false, fmt.Errorf("unexpected HTTP response status %d", res.StatusCode) | ||
| } | ||
| } | ||
|
|
||
| func (s Scanner) Type() detectorspb.DetectorType { | ||
| return detectorspb.DetectorType_HubSpotApiKey | ||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file was deleted.
Oops, something went wrong.
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters