feat(detectors): add JumpCloud API Key v2 detector (jca_ prefix)#4975
Open
mangod12 wants to merge 2 commits into
Open
feat(detectors): add JumpCloud API Key v2 detector (jca_ prefix)#4975mangod12 wants to merge 2 commits into
mangod12 wants to merge 2 commits into
Conversation
Add a new v2 detector for JumpCloud API keys that use the `jca_` prefix
format. The new format is self-identifying (40 chars: `jca_` + 36
alphanumeric), reducing false positives compared to the v1 detector
which relies on the keyword "jumpcloud" near a generic 40-char string.
Changes:
- Restructure jumpcloud detector into v1/v2 subdirectories
- Add Versioner interface to v1 scanner
- Create v2 scanner with `jca_[a-zA-Z0-9]{36}` pattern
- Add pattern tests with realistic input scenarios
- Use same verification endpoint (JumpCloud systemgroups API)
- Deduplicate matches and drain response body for connection reuse
- Register both v1 and v2 in defaults.go
Fixes trufflesecurity#4624
|
|
![cursor[bot]](https://avatars.githubusercontent.com/in/1210556?s=60&v=4){kind=small}
There was a problem hiding this comment.
Cursor Bugbot has reviewed your changes and found 1 potential issue.
Reviewed by Cursor Bugbot for commit b833426. Configure here.
The "valid pattern - config file" test key had 39 alphanumeric characters after the jca_ prefix, but the regex requires exactly 36. Trimmed to 36 so the pattern match succeeds. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
Add a new v2 detector for JumpCloud API keys that use the
jca_prefix format (reference).Why: The existing v1 detector matches generic 40-character alphanumeric strings only when the keyword "jumpcloud" is nearby, which can lead to false positives. JumpCloud's new API key format uses a
jca_prefix, making keys self-identifying and significantly reducing false positives.What:
jumpclouddetector intov1/andv2/subdirectoriesVersionerinterface to both v1 and v2 scannersjca_[a-zA-Z0-9]{36}(40 chars total)jca_(self-identifying, no context needed)GET https://console.jumpcloud.com/api/v2/systemgroupswithx-api-keyheaderdefaults.goKey Format
jca_(4 characters)jca_[a-zA-Z0-9]{36}Test plan
make test-community(Go not available locally — CI will verify)Checklist
make test-community)?make lint)?Fixes #4624
Note
Medium Risk
Adds a new JumpCloud detector and changes default detector registration, which will affect what secrets are flagged and may increase verification HTTP calls during scans.
Overview
Adds a new JumpCloud v2 detector that matches self-identifying API keys with the
jca_prefix, deduplicates matches, and performs stricter verification response handling (including draining response bodies) while recording the detector version in result metadata.Refactors the existing JumpCloud detector into
jumpcloud/v1and registers both v1 and v2 scanners indefaults.go, with v1 updated to implementVersion()/Versionerfor multi-version support.Reviewed by Cursor Bugbot for commit 49a8ddf. Bugbot is set up for automated code reviews on this repo. Configure here.