Skip to content

Commit d2b3377

Browse files
nabeelalamnabeelalam
authored
[Fix] Updated DigitalOceanV2 Detector (#4050)
* updated digital ocean v2 detector * added build tags in dov2 detector integration test * updated unexpected error test case name * updated refresh token verification function to return boolean
1 parent b9ab701 commit d2b3377

File tree

2 files changed

+135
-51
lines changed

2 files changed

+135
-51
lines changed

‎pkg/detectors/digitaloceanv2/digitaloceanv2.go

Lines changed: 104 additions & 41 deletions
Original file line numberDiff line numberDiff line change
@@ -2,6 +2,7 @@ package digitaloceanv2
22

33
import (
44
"context"
5+
"encoding/json"
56
"fmt"
67
"io"
78
"net/http"
@@ -14,13 +15,15 @@ import (
1415
"github.com/trufflesecurity/trufflehog/v3/pkg/pb/detectorspb"
1516
)
1617

17-
type Scanner struct{}
18+
type Scanner struct {
19+
client *http.Client
20+
}
1821

1922
// Ensure the Scanner satisfies the interface at compile time.
2023
var _ detectors.Detector = (*Scanner)(nil)
2124

2225
var (
23-
client = common.SaneHttpClient()
26+
defaultClient = common.SaneHttpClient()
2427

2528
// Make sure that your group is surrounded in boundary characters such as below to reduce false positives.
2629
keyPat = regexp.MustCompile(`\b((?:dop|doo|dor)_v1_[a-f0-9]{64})\b`)
@@ -36,55 +39,42 @@ func (s Scanner) Keywords() []string {
3639
func (s Scanner) FromData(ctx context.Context, verify bool, data []byte) (results []detectors.Result, err error) {
3740
dataStr := string(data)
3841

39-
matches := keyPat.FindAllStringSubmatch(dataStr, -1)
42+
var uniqueTokens = make(map[string]struct{})
4043

41-
for _, match := range matches {
42-
resMatch := strings.TrimSpace(match[1])
44+
for _, matches := range keyPat.FindAllStringSubmatch(dataStr, -1) {
45+
uniqueTokens[matches[0]] = struct{}{}
46+
}
4347

48+
for token := range uniqueTokens {
4449
s1 := detectors.Result{
4550
DetectorType: detectorspb.DetectorType_DigitalOceanV2,
46-
Raw: []byte(resMatch),
51+
Raw: []byte(token),
4752
}
4853

4954
if verify {
50-
switch {
51-
case strings.HasPrefix(resMatch, "dor_v1_"):
52-
req, err := http.NewRequestWithContext(ctx, "GET", "https://cloud.digitalocean.com/v1/oauth/token?grant_type=refresh_token&refresh_token="+resMatch, nil)
53-
if err != nil {
54-
continue
55-
}
56-
57-
res, err := client.Do(req)
58-
if err == nil {
59-
bodyBytes, err := io.ReadAll(res.Body)
60-
61-
if err != nil {
62-
continue
63-
}
64-
65-
bodyString := string(bodyBytes)
66-
validResponse := strings.Contains(bodyString, `"access_token"`)
67-
defer res.Body.Close()
55+
client := s.client
56+
if client == nil {
57+
client = defaultClient
58+
}
6859

69-
if res.StatusCode >= 200 && res.StatusCode < 300 && validResponse {
70-
s1.Verified = true
60+
// Check if the token is a refresh token or an access token
61+
switch {
62+
case strings.HasPrefix(token, "dor_v1_"):
63+
verified, verificationErr, newAccessToken := verifyRefreshToken(ctx, client, token)
64+
s1.SetVerificationError(verificationErr)
65+
s1.Verified = verified
66+
if s1.Verified {
67+
s1.AnalysisInfo = map[string]string{
68+
"key": newAccessToken,
7169
}
7270
}
73-
74-
case strings.HasPrefix(resMatch, "doo_v1_"), strings.HasPrefix(resMatch, "dop_v1_"):
75-
req, err := http.NewRequestWithContext(ctx, "GET", "https://api.digitalocean.com/v2/account", nil)
76-
if err != nil {
77-
continue
78-
}
79-
req.Header.Add("Authorization", fmt.Sprintf("Bearer %s", resMatch))
80-
res, err := client.Do(req)
81-
if err == nil {
82-
defer res.Body.Close()
83-
if res.StatusCode >= 200 && res.StatusCode < 300 {
84-
s1.Verified = true
85-
s1.AnalysisInfo = map[string]string{
86-
"key": resMatch,
87-
}
71+
case strings.HasPrefix(token, "doo_v1_"), strings.HasPrefix(token, "dop_v1_"):
72+
verified, verificationErr := verifyAccessToken(ctx, client, token)
73+
s1.Verified = verified
74+
s1.SetVerificationError(verificationErr)
75+
if s1.Verified {
76+
s1.AnalysisInfo = map[string]string{
77+
"key": token,
8878
}
8979
}
9080
}
@@ -96,6 +86,79 @@ func (s Scanner) FromData(ctx context.Context, verify bool, data []byte) (result
9686
return results, nil
9787
}
9888

89+
// verifyRefreshToken verifies the refresh token by making a request to the DigitalOcean API.
90+
// If the token is valid, it returns the new access token and no error.
91+
// If the token is invalid/expired, it returns an empty string and no error.
92+
// If an error is encountered, it returns an empty string along and the error.
93+
func verifyRefreshToken(ctx context.Context, client *http.Client, token string) (bool, error, string) {
94+
// Ref: https://docs.digitalocean.com/reference/api/oauth/
95+
96+
url := "https://cloud.digitalocean.com/v1/oauth/token?grant_type=refresh_token&refresh_token=" + token
97+
req, err := http.NewRequestWithContext(ctx, http.MethodPost, url, nil)
98+
if err != nil {
99+
return false, fmt.Errorf("failed to create request: %w", err), ""
100+
}
101+
102+
res, err := client.Do(req)
103+
if err != nil {
104+
return false, fmt.Errorf("failed to make request: %w", err), ""
105+
}
106+
107+
bodyBytes, err := io.ReadAll(res.Body)
108+
if err != nil {
109+
return false, fmt.Errorf("failed to read response body: %w", err), ""
110+
}
111+
defer res.Body.Close()
112+
113+
switch res.StatusCode {
114+
case http.StatusOK:
115+
var responseMap map[string]interface{}
116+
if err := json.Unmarshal(bodyBytes, &responseMap); err != nil {
117+
return false, fmt.Errorf("failed to parse response body: %w", err), ""
118+
}
119+
// Extract the access token from the response
120+
accessToken, exists := responseMap["access_token"].(string)
121+
if !exists {
122+
return false, fmt.Errorf("access_token not found in response: %s", string(bodyBytes)), ""
123+
}
124+
return true, nil, accessToken
125+
case http.StatusUnauthorized:
126+
return false, nil, ""
127+
default:
128+
return false, fmt.Errorf("unexpected status code: %d", res.StatusCode), ""
129+
}
130+
}
131+
132+
// verifyAccessToken verifies the access token by making a request to the DigitalOcean API.
133+
// If the token is valid, it returns true and no error.
134+
// If the token is invalid, it returns false and no error.
135+
// If an error is encountered, it returns false along with the error.
136+
func verifyAccessToken(ctx context.Context, client *http.Client, token string) (bool, error) {
137+
// Ref: https://docs.digitalocean.com/reference/api/digitalocean/#tag/Account
138+
139+
url := "https://api.digitalocean.com/v2/account"
140+
req, err := http.NewRequestWithContext(ctx, http.MethodGet, url, nil)
141+
if err != nil {
142+
return false, fmt.Errorf("failed to create request: %w", err)
143+
}
144+
145+
req.Header.Add("Authorization", fmt.Sprintf("Bearer %s", token))
146+
res, err := client.Do(req)
147+
if err != nil {
148+
return false, fmt.Errorf("failed to make request: %w", err)
149+
}
150+
defer res.Body.Close()
151+
152+
switch res.StatusCode {
153+
case http.StatusOK:
154+
return true, nil
155+
case http.StatusUnauthorized:
156+
return false, nil
157+
default:
158+
return false, fmt.Errorf("unexpected status code: %d", res.StatusCode)
159+
}
160+
}
161+
99162
func (s Scanner) Type() detectorspb.DetectorType {
100163
return detectorspb.DetectorType_DigitalOceanV2
101164
}

‎pkg/detectors/digitaloceanv2/digitaloceanv2_integration_test.go

Lines changed: 31 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -9,7 +9,8 @@ import (
99
"testing"
1010
"time"
1111

12-
"github.com/kylelemons/godebug/pretty"
12+
"github.com/google/go-cmp/cmp"
13+
"github.com/google/go-cmp/cmp/cmpopts"
1314

1415
"github.com/trufflesecurity/trufflehog/v3/pkg/common"
1516
"github.com/trufflesecurity/trufflehog/v3/pkg/detectors"
@@ -32,11 +33,12 @@ func TestDigitalOceanV2_FromChunk(t *testing.T) {
3233
verify bool
3334
}
3435
tests := []struct {
35-
name string
36-
s Scanner
37-
args args
38-
want []detectors.Result
39-
wantErr bool
36+
name string
37+
s Scanner
38+
args args
39+
want []detectors.Result
40+
wantErr bool
41+
wantVerificationErr bool
4042
}{
4143
{
4244
name: "found, verified",
@@ -81,11 +83,27 @@ func TestDigitalOceanV2_FromChunk(t *testing.T) {
8183
want: nil,
8284
wantErr: false,
8385
},
86+
{
87+
name: "found verifiable secret, verification failed due to unexpected API response",
88+
s: Scanner{client: common.ConstantResponseHttpClient(404, "")},
89+
args: args{
90+
ctx: context.Background(),
91+
data: []byte(fmt.Sprintf("You can find a digitaloceanv2 secret %s within", secret)),
92+
verify: true,
93+
},
94+
want: []detectors.Result{
95+
{
96+
DetectorType: detectorspb.DetectorType_DigitalOceanV2,
97+
Verified: false,
98+
},
99+
},
100+
wantErr: false,
101+
wantVerificationErr: true,
102+
},
84103
}
85104
for _, tt := range tests {
86105
t.Run(tt.name, func(t *testing.T) {
87-
s := Scanner{}
88-
got, err := s.FromData(tt.args.ctx, tt.args.verify, tt.args.data)
106+
got, err := tt.s.FromData(tt.args.ctx, tt.args.verify, tt.args.data)
89107
if (err != nil) != tt.wantErr {
90108
t.Errorf("DigitalOceanV2.FromData() error = %v, wantErr %v", err, tt.wantErr)
91109
return
@@ -94,9 +112,12 @@ func TestDigitalOceanV2_FromChunk(t *testing.T) {
94112
if len(got[i].Raw) == 0 {
95113
t.Fatalf("no raw secret present: \n %+v", got[i])
96114
}
97-
got[i].Raw = nil
115+
if (got[i].VerificationError() != nil) != tt.wantVerificationErr {
116+
t.Fatalf("wantVerificationError = %v, verification error = %v", tt.wantVerificationErr, got[i].VerificationError())
117+
}
98118
}
99-
if diff := pretty.Compare(got, tt.want); diff != "" {
119+
ignoreOpts := cmpopts.IgnoreFields(detectors.Result{}, "Raw", "RawV2", "verificationError", "AnalysisInfo")
120+
if diff := cmp.Diff(got, tt.want, ignoreOpts); diff != "" {
100121
t.Errorf("DigitalOceanV2.FromData() %s diff: (-got +want)\n%s", tt.name, diff)
101122
}
102123
})

0 commit comments

Comments
 (0)