Skip to content

Commit 2e5a7e6

Browse files
ggmollyggmolly
authored
feat(typeform): add v2 detector for new key formats (#3660)
docs: - https://www.typeform.com/developers/get-started/personal-access-token/ 40 to 59 chars is set because we've seen tokens with an extra 15 bytes at the end, the base key is 40 bytes long
1 parent 2169808 commit 2e5a7e6

File tree

6 files changed

+352
-3
lines changed

6 files changed

+352
-3
lines changed

‎pkg/detectors/typeform/typeform.go ‎pkg/detectors/typeform/v1/typeform.go

+4-1
Original file line numberDiff line numberDiff line change
@@ -3,10 +3,11 @@ package typeform
33
import (
44
"context"
55
"fmt"
6-
regexp "github.com/wasilibs/go-re2"
76
"net/http"
87
"strings"
98

9+
regexp "github.com/wasilibs/go-re2"
10+
1011
"github.com/trufflesecurity/trufflehog/v3/pkg/common"
1112
"github.com/trufflesecurity/trufflehog/v3/pkg/detectors"
1213
"github.com/trufflesecurity/trufflehog/v3/pkg/pb/detectorspb"
@@ -24,6 +25,8 @@ var (
2425
keyPat = regexp.MustCompile(detectors.PrefixRegex([]string{"typeform"}) + `\b([0-9A-Za-z]{44})\b`)
2526
)
2627

28+
func (s Scanner) Version() int { return 1 }
29+
2730
// Keywords are used for efficiently pre-filtering chunks.
2831
// Use identifiers in the secret preferably, or the provider name.
2932
func (s Scanner) Keywords() []string {

‎pkg/detectors/typeform/typeform_test.go ‎pkg/detectors/typeform/v1/typeform_test.go

File renamed without changes.

‎pkg/detectors/typeform/v2/typeform.go

+104
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,104 @@
1+
package typeform
2+
3+
import (
4+
"context"
5+
"encoding/json"
6+
"fmt"
7+
"net/http"
8+
9+
regexp "github.com/wasilibs/go-re2"
10+
11+
"github.com/trufflesecurity/trufflehog/v3/pkg/common"
12+
"github.com/trufflesecurity/trufflehog/v3/pkg/detectors"
13+
"github.com/trufflesecurity/trufflehog/v3/pkg/pb/detectorspb"
14+
)
15+
16+
type Scanner struct{}
17+
18+
// Ensure the Scanner satisfies the interface at compile time.
19+
var _ detectors.Detector = (*Scanner)(nil)
20+
21+
var (
22+
client = common.SaneHttpClient()
23+
24+
keyPat = regexp.MustCompile(`\btfp_[a-zA-Z0-9_]{40,59}\b`)
25+
)
26+
27+
func (s Scanner) Version() int { return 2 }
28+
29+
// Keywords are used for efficiently pre-filtering chunks.
30+
// Use identifiers in the secret preferably, or the provider name.
31+
func (s Scanner) Keywords() []string {
32+
return []string{"tfp_"}
33+
}
34+
35+
type TypeFormResponse struct {
36+
UserID string `json:"user_id,omitempty"`
37+
Email string `json:"email,omitempty"`
38+
Alias string `json:"alias,omitempty"`
39+
Language string `json:"language,omitempty"`
40+
}
41+
42+
// FromData will find and optionally verify Typeform secrets in a given set of bytes.
43+
func (s Scanner) FromData(ctx context.Context, verify bool, data []byte) (results []detectors.Result, err error) {
44+
dataStr := string(data)
45+
46+
matches := keyPat.FindAllString(dataStr, -1)
47+
48+
for _, match := range matches {
49+
s1 := detectors.Result{
50+
DetectorType: detectorspb.DetectorType_Typeform,
51+
Raw: []byte(match),
52+
}
53+
54+
if verify {
55+
verified, typeformResponse, requestErr := verifyMatch(ctx, client, match)
56+
s1.Verified = verified
57+
if requestErr != nil {
58+
s1.SetVerificationError(err, match)
59+
} else {
60+
s1.ExtraData = map[string]string{
61+
"UserId": typeformResponse.UserID,
62+
"Email": typeformResponse.Email,
63+
"Alias": typeformResponse.Alias,
64+
"Language": typeformResponse.Language,
65+
}
66+
}
67+
}
68+
results = append(results, s1)
69+
70+
}
71+
72+
return results, nil
73+
}
74+
75+
func verifyMatch(ctx context.Context, client *http.Client, secret string) (bool, TypeFormResponse, error) {
76+
var response TypeFormResponse
77+
78+
req, err := http.NewRequestWithContext(ctx, "GET", "https://api.typeform.com/me", nil)
79+
if err != nil {
80+
return false, response, nil
81+
}
82+
req.Header.Add("Authorization", fmt.Sprintf("Bearer %s", secret))
83+
res, err := client.Do(req)
84+
if err != nil {
85+
return false, response, err
86+
}
87+
defer res.Body.Close()
88+
if err = json.NewDecoder(res.Body).Decode(&response); err != nil {
89+
return false, response, err
90+
}
91+
if res.StatusCode == 200 {
92+
return true, response, nil
93+
} else {
94+
return false, response, fmt.Errorf("unexpected status code %d", res.StatusCode)
95+
}
96+
}
97+
98+
func (s Scanner) Type() detectorspb.DetectorType {
99+
return detectorspb.DetectorType_Typeform
100+
}
101+
102+
func (s Scanner) Description() string {
103+
return "Typeform is a service for creating forms and surveys. Typeform API keys can be used to access and manage forms and responses."
104+
}

‎pkg/detectors/typeform/v2/typeform_integration_test.go

+161
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,161 @@
1+
//go:build detectors
2+
// +build detectors
3+
4+
package typeform
5+
6+
import (
7+
"context"
8+
"fmt"
9+
"testing"
10+
"time"
11+
12+
"github.com/google/go-cmp/cmp"
13+
"github.com/google/go-cmp/cmp/cmpopts"
14+
15+
"github.com/trufflesecurity/trufflehog/v3/pkg/common"
16+
"github.com/trufflesecurity/trufflehog/v3/pkg/detectors"
17+
"github.com/trufflesecurity/trufflehog/v3/pkg/pb/detectorspb"
18+
)
19+
20+
func TestTypeform_FromChunk(t *testing.T) {
21+
ctx, cancel := context.WithTimeout(context.Background(), time.Second*5)
22+
defer cancel()
23+
testSecrets, err := common.GetSecret(ctx, "trufflehog-testing", "detectors5")
24+
if err != nil {
25+
t.Fatalf("could not get test secrets from GCP: %s", err)
26+
}
27+
secret := testSecrets.MustGetField("TYPEFORM_V2")
28+
inactiveSecret := testSecrets.MustGetField("TYPEFORM_V2_INACTIVE")
29+
30+
type args struct {
31+
ctx context.Context
32+
data []byte
33+
verify bool
34+
}
35+
tests := []struct {
36+
name string
37+
s Scanner
38+
args args
39+
want []detectors.Result
40+
wantErr bool
41+
wantVerificationErr bool
42+
}{
43+
{
44+
name: "found, verified",
45+
s: Scanner{},
46+
args: args{
47+
ctx: context.Background(),
48+
data: []byte(fmt.Sprintf("You can find a typeform secret %s within", secret)),
49+
verify: true,
50+
},
51+
want: []detectors.Result{
52+
{
53+
DetectorType: detectorspb.DetectorType_Typeform,
54+
Verified: true,
55+
},
56+
},
57+
wantErr: false,
58+
wantVerificationErr: false,
59+
},
60+
{
61+
name: "found, unverified",
62+
s: Scanner{},
63+
args: args{
64+
ctx: context.Background(),
65+
data: []byte(fmt.Sprintf("You can find a typeform secret %s within but not valid", inactiveSecret)), // the secret would satisfy the regex but not pass validation
66+
verify: true,
67+
},
68+
want: []detectors.Result{
69+
{
70+
DetectorType: detectorspb.DetectorType_Typeform,
71+
Verified: false,
72+
},
73+
},
74+
wantErr: false,
75+
wantVerificationErr: false,
76+
},
77+
{
78+
name: "not found",
79+
s: Scanner{},
80+
args: args{
81+
ctx: context.Background(),
82+
data: []byte("You cannot find the secret within"),
83+
verify: true,
84+
},
85+
want: nil,
86+
wantErr: false,
87+
wantVerificationErr: false,
88+
},
89+
{
90+
name: "found, would be verified if not for timeout",
91+
s: Scanner{client: common.SaneHttpClientTimeOut(1 * time.Microsecond)},
92+
args: args{
93+
ctx: context.Background(),
94+
data: []byte(fmt.Sprintf("You can find a typeform secret %s within", secret)),
95+
verify: true,
96+
},
97+
want: []detectors.Result{
98+
{
99+
DetectorType: detectorspb.DetectorType_Typeform,
100+
Verified: false,
101+
},
102+
},
103+
wantErr: false,
104+
wantVerificationErr: true,
105+
},
106+
{
107+
name: "found, verified but unexpected api surface",
108+
s: Scanner{client: common.ConstantResponseHttpClient(404, "")},
109+
args: args{
110+
ctx: context.Background(),
111+
data: []byte(fmt.Sprintf("You can find a typeform secret %s within", secret)),
112+
verify: true,
113+
},
114+
want: []detectors.Result{
115+
{
116+
DetectorType: detectorspb.DetectorType_Typeform,
117+
Verified: false,
118+
},
119+
},
120+
wantErr: false,
121+
wantVerificationErr: true,
122+
},
123+
}
124+
for _, tt := range tests {
125+
t.Run(tt.name, func(t *testing.T) {
126+
got, err := tt.s.FromData(tt.args.ctx, tt.args.verify, tt.args.data)
127+
if (err != nil) != tt.wantErr {
128+
t.Errorf("TypeForm.FromData() error = %v, wantErr %v", err, tt.wantErr)
129+
return
130+
}
131+
for i := range got {
132+
if len(got[i].Raw) == 0 {
133+
t.Fatalf("no raw secret present: \n %+v", got[i])
134+
}
135+
if (got[i].VerificationError() != nil) != tt.wantVerificationErr {
136+
t.Fatalf("wantVerificationError = %v, verification error = %v", tt.wantVerificationErr, got[i].VerificationError())
137+
}
138+
}
139+
ignoreOpts := cmpopts.IgnoreFields(detectors.Result{}, "Raw", "verificationError")
140+
if diff := cmp.Diff(got, tt.want, ignoreOpts); diff != "" {
141+
t.Errorf("TypeForm.FromData() %s diff: (-got +want)\n%s", tt.name, diff)
142+
}
143+
})
144+
}
145+
}
146+
147+
func BenchmarkFromData(benchmark *testing.B) {
148+
ctx := context.Background()
149+
s := Scanner{}
150+
for name, data := range detectors.MustGetBenchmarkData() {
151+
benchmark.Run(name, func(b *testing.B) {
152+
b.ResetTimer()
153+
for n := 0; n < b.N; n++ {
154+
_, err := s.FromData(ctx, false, data)
155+
if err != nil {
156+
b.Fatal(err)
157+
}
158+
}
159+
})
160+
}
161+
}

‎pkg/detectors/typeform/v2/typeform_test.go

+79
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,79 @@
1+
package typeform
2+
3+
import (
4+
"context"
5+
"testing"
6+
7+
"github.com/google/go-cmp/cmp"
8+
"github.com/trufflesecurity/trufflehog/v3/pkg/detectors"
9+
"github.com/trufflesecurity/trufflehog/v3/pkg/engine/ahocorasick"
10+
)
11+
12+
func TestTypeformV2_Pattern(t *testing.T) {
13+
d := Scanner{}
14+
ahoCorasickCore := ahocorasick.NewAhoCorasickCore([]detectors.Detector{d})
15+
tests := []struct {
16+
name string
17+
input string
18+
want []string
19+
}{
20+
{
21+
name: "typical pattern (v2)",
22+
input: "typeform_token = 'tfp_ABCDEfghijKLMNOPqrstuvWXYZ0123456789ABCDEFGH_ijK12340qqqBBB'",
23+
want: []string{"tfp_ABCDEfghijKLMNOPqrstuvWXYZ0123456789ABCDEFGH_ijK12340qqqBBB"},
24+
},
25+
{
26+
name: "finds all matches (v2)",
27+
input: `typeform_token1 = 'tfp_ABCDEfghijKLMNOPqrstuvWXYZ0123456789ABCDEFGH_ijK12340qqqBBB'
28+
typeform_token2 = 'tfp_943af478d3ff3d4d760020c11af102b79c440513'`,
29+
want: []string{"tfp_ABCDEfghijKLMNOPqrstuvWXYZ0123456789ABCDEFGH_ijK12340qqqBBB", "tfp_943af478d3ff3d4d760020c11af102b79c440513"},
30+
},
31+
{
32+
name: "invalid pattern",
33+
input: "typeform_token = 'tfp_1'",
34+
want: []string{},
35+
},
36+
}
37+
38+
for _, test := range tests {
39+
t.Run(test.name, func(t *testing.T) {
40+
matchedDetectors := ahoCorasickCore.FindDetectorMatches([]byte(test.input))
41+
if len(matchedDetectors) == 0 {
42+
t.Errorf("keywords '%v' not matched by: %s", d.Keywords(), test.input)
43+
return
44+
}
45+
46+
results, err := d.FromData(context.Background(), false, []byte(test.input))
47+
if err != nil {
48+
t.Errorf("error = %v", err)
49+
return
50+
}
51+
52+
if len(results) != len(test.want) {
53+
if len(results) == 0 {
54+
t.Errorf("did not receive result")
55+
} else {
56+
t.Errorf("expected %d results, only received %d", len(test.want), len(results))
57+
}
58+
return
59+
}
60+
61+
actual := make(map[string]struct{}, len(results))
62+
for _, r := range results {
63+
if len(r.RawV2) > 0 {
64+
actual[string(r.RawV2)] = struct{}{}
65+
} else {
66+
actual[string(r.Raw)] = struct{}{}
67+
}
68+
}
69+
expected := make(map[string]struct{}, len(test.want))
70+
for _, v := range test.want {
71+
expected[v] = struct{}{}
72+
}
73+
74+
if diff := cmp.Diff(expected, actual); diff != "" {
75+
t.Errorf("%s diff: (-want +got)\n%s", test.name, diff)
76+
}
77+
})
78+
}
79+
}

‎pkg/engine/defaults/defaults.go

+4-2
Original file line numberDiff line numberDiff line change
@@ -743,7 +743,8 @@ import (
743743
twitterv2 "github.com/trufflesecurity/trufflehog/v3/pkg/detectors/twitter/v2"
744744
"github.com/trufflesecurity/trufflehog/v3/pkg/detectors/twitterconsumerkey"
745745
"github.com/trufflesecurity/trufflehog/v3/pkg/detectors/tyntec"
746-
"github.com/trufflesecurity/trufflehog/v3/pkg/detectors/typeform"
746+
typeformv1 "github.com/trufflesecurity/trufflehog/v3/pkg/detectors/typeform/v1"
747+
typeformv2 "github.com/trufflesecurity/trufflehog/v3/pkg/detectors/typeform/v2"
747748
"github.com/trufflesecurity/trufflehog/v3/pkg/detectors/typetalk"
748749
"github.com/trufflesecurity/trufflehog/v3/pkg/detectors/ubidots"
749750
"github.com/trufflesecurity/trufflehog/v3/pkg/detectors/uclassify"
@@ -1586,7 +1587,8 @@ func buildDetectorList() []detectors.Detector {
15861587
&twitterv1.Scanner{},
15871588
&twitterv2.Scanner{},
15881589
&tyntec.Scanner{},
1589-
&typeform.Scanner{},
1590+
&typeformv1.Scanner{},
1591+
&typeformv2.Scanner{},
15901592
&typetalk.Scanner{},
15911593
&ubidots.Scanner{},
15921594
&uclassify.Scanner{},

0 commit comments

Comments
 (0)