Skip to content

Commit 985eb75

Browse files
abmussaniabmussani
authored
[fix] False Positive Verification in Auth0oauth Detectors (#3901)
### Description: This PR addresses an issue where a buggy verification process was incorrectly marking false-positive credentials as verified. The following cases are now handled properly: - Malformed `authorization_code` Request: If an invalid authorization_code request is sent for verification, the API responds with a 403 Forbidden status and an invalid_grant error code. Fix: These credentials will now be marked as verified in this case. - Unauthorized Client: If the credentials do not have permission to make an authorization_code request, the API returns a 403 Forbidden status with the unauthorized_client error code. Fix: No change in behavior; this case continues to be handled correctly. - Invalid Domain: If the provided domain is not valid, the API returns a 404 Not Found status. Fix: These credentials will now be correctly marked as unverified. - Invalid ID/Secret: If the client ID or secret is invalid, the API responds with a 401 Unauthorized status. Fix: These credentials will now be correctly marked as unverified. This PR ensures a more accurate verification process and reduces false positives. Here is the results of modified test results: ![image](https://github.com/user-attachments/assets/51eb6498-39da-4c6c-aa90-224786fb6518) ### Checklist: * [ ] Tests passing (`make test-community`)? * [x] Lint passing (`make lint` this requires [golangci-lint](https://golangci-lint.run/welcome/install/#local-installation))?
1 parent b10342e commit 985eb75

File tree

3 files changed

+112
-39
lines changed

3 files changed

+112
-39
lines changed

‎pkg/detectors/auth0oauth/auth0oauth.go

Lines changed: 67 additions & 35 deletions
Original file line numberDiff line numberDiff line change
@@ -2,6 +2,7 @@ package auth0oauth
22

33
import (
44
"context"
5+
"fmt"
56
"io"
67
"net/http"
78
"net/url"
@@ -15,13 +16,14 @@ import (
1516

1617
type Scanner struct {
1718
detectors.DefaultMultiPartCredentialProvider
19+
client *http.Client
1820
}
1921

2022
// Ensure the Scanner satisfies the interface at compile time.
2123
var _ detectors.Detector = (*Scanner)(nil)
2224

2325
var (
24-
client = detectors.DetectorHttpClientWithLocalAddresses
26+
defaultClient = detectors.DetectorHttpClientWithLocalAddresses
2527

2628
clientIdPat = regexp.MustCompile(detectors.PrefixRegex([]string{"auth0"}) + `\b([a-zA-Z0-9_-]{32,60})\b`)
2729
clientSecretPat = regexp.MustCompile(`\b([a-zA-Z0-9_-]{64,})\b`)
@@ -61,42 +63,17 @@ func (s Scanner) FromData(ctx context.Context, verify bool, data []byte) (result
6163
}
6264

6365
if verify {
64-
/*
65-
curl --request POST \
66-
--url 'https://YOUR_DOMAIN/oauth/token' \
67-
--header 'content-type: application/x-www-form-urlencoded' \
68-
--data 'grant_type=authorization_code&client_id=W44JmL3qD6LxHeEJyKe9lMuhcwvPOaOq&client_secret=YOUR_CLIENT_SECRET&code=AUTHORIZATION_CODE&redirect_uri=undefined'
69-
*/
70-
71-
data := url.Values{}
72-
data.Set("grant_type", "authorization_code")
73-
data.Set("client_id", clientIdRes)
74-
data.Set("client_secret", clientSecretRes)
75-
data.Set("code", "AUTHORIZATION_CODE")
76-
data.Set("redirect_uri", "undefined")
77-
78-
req, err := http.NewRequestWithContext(ctx, http.MethodPost, "https://"+domainRes+"/oauth/token", strings.NewReader(data.Encode())) // URL-encoded payload
79-
if err != nil {
80-
continue
66+
67+
client := s.client
68+
if client == nil {
69+
client = defaultClient
8170
}
82-
req.Header.Add("Content-Type", "application/x-www-form-urlencoded")
83-
res, err := client.Do(req)
84-
if err == nil {
85-
defer res.Body.Close()
86-
bodyBytes, err := io.ReadAll(res.Body)
87-
if err != nil {
88-
continue
89-
}
90-
body := string(bodyBytes)
91-
92-
// if client_id and client_secret is valid -> 403 {"error":"invalid_grant","error_description":"Invalid authorization code"}
93-
// if invalid -> 401 {"error":"access_denied","error_description":"Unauthorized"}
94-
// ingenious!
95-
96-
if !strings.Contains(body, "access_denied") {
97-
s1.Verified = true
98-
}
71+
72+
isVerified, err := verifyTuple(ctx, client, domainRes, clientIdRes, clientSecretRes)
73+
if err != nil {
74+
s1.SetVerificationError(err, clientIdRes)
9975
}
76+
s1.Verified = isVerified
10077
}
10178

10279
results = append(results, s1)
@@ -107,6 +84,61 @@ func (s Scanner) FromData(ctx context.Context, verify bool, data []byte) (result
10784
return results, nil
10885
}
10986

87+
func verifyTuple(ctx context.Context, client *http.Client, domainRes, clientId, clientSecret string) (bool, error) {
88+
/*
89+
curl --request POST \
90+
--url 'https://YOUR_DOMAIN/oauth/token' \
91+
--header 'content-type: application/x-www-form-urlencoded' \
92+
--data 'grant_type=authorization_code&client_id=W44JmL3qD6LxHeEJyKe9lMuhcwvPOaOq&client_secret=YOUR_CLIENT_SECRET&code=AUTHORIZATION_CODE&redirect_uri=undefined'
93+
*/
94+
95+
data := url.Values{}
96+
data.Set("grant_type", "authorization_code")
97+
data.Set("client_id", clientId)
98+
data.Set("client_secret", clientSecret)
99+
data.Set("code", "AUTHORIZATION_CODE")
100+
data.Set("redirect_uri", "undefined")
101+
102+
req, err := http.NewRequestWithContext(ctx, http.MethodPost, "https://"+domainRes+"/oauth/token", strings.NewReader(data.Encode())) // URL-encoded payload
103+
if err != nil {
104+
return false, err
105+
}
106+
req.Header.Add("Content-Type", "application/x-www-form-urlencoded")
107+
resp, err := client.Do(req)
108+
if err != nil {
109+
return false, err
110+
}
111+
112+
defer func() {
113+
_, _ = io.Copy(io.Discard, resp.Body)
114+
_ = resp.Body.Close()
115+
}()
116+
117+
switch resp.StatusCode {
118+
case http.StatusOK:
119+
// This condition will never meet due to invalid request body
120+
return true, nil
121+
case http.StatusUnauthorized:
122+
return false, nil
123+
case http.StatusForbidden:
124+
// cross check about 'invalid_grant' or 'unauthorized_client' in response body
125+
bodyBytes, err := io.ReadAll(resp.Body)
126+
if err != nil {
127+
return false, err
128+
}
129+
bodyStr := string(bodyBytes)
130+
if strings.Contains(bodyStr, "invalid_grant") || strings.Contains(bodyStr, "unauthorized_client") {
131+
return true, nil
132+
}
133+
return false, nil
134+
case http.StatusNotFound:
135+
// domain does not exists - 404 not found
136+
return false, nil
137+
default:
138+
return false, fmt.Errorf("unexpected HTTP response status %d", resp.StatusCode)
139+
}
140+
}
141+
110142
func (s Scanner) Type() detectorspb.DetectorType {
111143
return detectorspb.DetectorType_Auth0oauth
112144
}

‎pkg/detectors/auth0oauth/auth0oauth_integeration_test.go

Lines changed: 43 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -10,23 +10,29 @@ import (
1010
"time"
1111

1212
"github.com/kylelemons/godebug/pretty"
13+
"github.com/trufflesecurity/trufflehog/v3/pkg/common"
1314
"github.com/trufflesecurity/trufflehog/v3/pkg/detectors"
1415

15-
"github.com/trufflesecurity/trufflehog/v3/pkg/common"
1616
"github.com/trufflesecurity/trufflehog/v3/pkg/pb/detectorspb"
1717
)
1818

1919
func TestAuth0oauth_FromChunk(t *testing.T) {
2020
ctx, cancel := context.WithTimeout(context.Background(), time.Second*5)
2121
defer cancel()
22-
testSecrets, err := common.GetSecret(ctx, "trufflehog-testing", "detectors3")
22+
testSecrets, err := common.GetSecret(ctx, "trufflehog-testing", "detectors5")
2323
if err != nil {
2424
t.Fatalf("could not get test secrets from GCP: %s", err)
2525
}
2626

2727
domain := testSecrets.MustGetField("AUTH0_DOMAIN")
28-
clientId := testSecrets.MustGetField("AUTH0_CLIENT_ID") // there is AUTH0_CLIENT_ID2 and AUTH0_CLIENT_SECRET2 pair as well
28+
clientId := testSecrets.MustGetField("AUTH0_CLIENT_ID")
2929
clientSecret := testSecrets.MustGetField("AUTH0_CLIENT_SECRET")
30+
31+
domainUnauthorized := testSecrets.MustGetField("AUTH0_DOMAIN_UNAUTHORIZED")
32+
clientIdUnauthorized := testSecrets.MustGetField("AUTH0_CLIENT_ID_UNAUTHORIZED")
33+
clientSecretUnauthorized := testSecrets.MustGetField("AUTH0_CLIENT_SECRET_UNAUTHORIZED")
34+
35+
notFoundDomain := testSecrets.MustGetField("AUTH0_DOMAIN_NOT_FOUND")
3036
inactiveClientSecret := testSecrets.MustGetField("AUTH0_CLIENT_SECRET_INACTIVE")
3137

3238
type args struct {
@@ -58,6 +64,23 @@ func TestAuth0oauth_FromChunk(t *testing.T) {
5864
},
5965
wantErr: false,
6066
},
67+
{
68+
name: "found, verified but unauthorized",
69+
s: Scanner{},
70+
args: args{
71+
ctx: context.Background(),
72+
data: []byte(fmt.Sprintf("You can find a auth0 client id %s client secret %s domain %s", clientIdUnauthorized, clientSecretUnauthorized, domainUnauthorized)),
73+
verify: true,
74+
},
75+
want: []detectors.Result{
76+
{
77+
DetectorType: detectorspb.DetectorType_Auth0oauth,
78+
Redacted: clientIdUnauthorized,
79+
Verified: true,
80+
},
81+
},
82+
wantErr: false,
83+
},
6184
{
6285
name: "found, unverified",
6386
s: Scanner{},
@@ -86,6 +109,23 @@ func TestAuth0oauth_FromChunk(t *testing.T) {
86109
want: nil,
87110
wantErr: false,
88111
},
112+
{
113+
name: "domain does not exists",
114+
s: Scanner{},
115+
args: args{
116+
ctx: context.Background(),
117+
data: []byte(fmt.Sprintf("You can find a auth0 client id %s client secret %s domain %s", clientId, clientSecret, notFoundDomain)),
118+
verify: true,
119+
},
120+
want: []detectors.Result{
121+
{
122+
DetectorType: detectorspb.DetectorType_Auth0oauth,
123+
Redacted: clientId,
124+
Verified: false,
125+
},
126+
},
127+
wantErr: false,
128+
},
89129
}
90130
for _, tt := range tests {
91131
t.Run(tt.name, func(t *testing.T) {

‎pkg/engine/defaults/defaults.go

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -54,6 +54,7 @@ import (
5454
atlassianv2 "github.com/trufflesecurity/trufflehog/v3/pkg/detectors/atlassian/v2"
5555
"github.com/trufflesecurity/trufflehog/v3/pkg/detectors/audd"
5656
"github.com/trufflesecurity/trufflehog/v3/pkg/detectors/auth0managementapitoken"
57+
"github.com/trufflesecurity/trufflehog/v3/pkg/detectors/auth0oauth"
5758
"github.com/trufflesecurity/trufflehog/v3/pkg/detectors/autodesk"
5859
"github.com/trufflesecurity/trufflehog/v3/pkg/detectors/autoklose"
5960
"github.com/trufflesecurity/trufflehog/v3/pkg/detectors/autopilot"
@@ -882,7 +883,7 @@ func buildDetectorList() []detectors.Detector {
882883
&atlassianv2.Scanner{},
883884
&audd.Scanner{},
884885
&auth0managementapitoken.Scanner{},
885-
// &auth0oauth.Scanner{},
886+
&auth0oauth.Scanner{},
886887
&autodesk.Scanner{},
887888
&autoklose.Scanner{},
888889
&autopilot.Scanner{},

0 commit comments

Comments
 (0)