-
Notifications
You must be signed in to change notification settings - Fork 1.8k
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Detector-Competition-Fix: Update formio regex to match Jwt token #1935
Detector-Competition-Fix: Update formio regex to match Jwt token #1935
Conversation
Any reason why 200? Any risk of this being lower than 200? |
@zricethezav the length depends on the payload data.
For this structure, the length is around 310. I've converted this into a range to avoid updating the regex frequently. |
Makes sense, thanks for the explanation |
[](https://renovatebot.com) This PR contains the following updates: | Package | Type | Update | Change | |---|---|---|---| | [trufflesecurity/trufflehog](https://togithub.com/trufflesecurity/trufflehog) | action | minor | `v3.60.4` -> `v3.62.1` | --- ### Release Notes <details> <summary>trufflesecurity/trufflehog (trufflesecurity/trufflehog)</summary> ### [`v3.62.1`](https://togithub.com/trufflesecurity/trufflehog/releases/tag/v3.62.1) [Compare Source](https://togithub.com/trufflesecurity/trufflehog/compare/v3.62.0...v3.62.1) #### What's Changed - update kingpin import by [@​dustin-decker](https://togithub.com/dustin-decker) in [https://github.com/trufflesecurity/trufflehog/pull/2053](https://togithub.com/trufflesecurity/trufflehog/pull/2053) - Re-add detector version by [@​rosecodym](https://togithub.com/rosecodym) in [https://github.com/trufflesecurity/trufflehog/pull/2060](https://togithub.com/trufflesecurity/trufflehog/pull/2060) - Detector-Competition-Fix: Fix currencycloud.com API key by [@​lc](https://togithub.com/lc) in [https://github.com/trufflesecurity/trufflehog/pull/1917](https://togithub.com/trufflesecurity/trufflehog/pull/1917) - Detector-Competition-Fix: Fix Bitcoin Average detector by [@​lc](https://togithub.com/lc) in [https://github.com/trufflesecurity/trufflehog/pull/1929](https://togithub.com/trufflesecurity/trufflehog/pull/1929) - Detector-Competition-Fix: Update formio regex to match Jwt token by [@​fumblehool](https://togithub.com/fumblehool) in [https://github.com/trufflesecurity/trufflehog/pull/1935](https://togithub.com/trufflesecurity/trufflehog/pull/1935) - Detector-Competition-Fix: Fix SalesBlink Detection & Verification by [@​lc](https://togithub.com/lc) in [https://github.com/trufflesecurity/trufflehog/pull/1950](https://togithub.com/trufflesecurity/trufflehog/pull/1950) - Support multiple custom detectors by [@​rosecodym](https://togithub.com/rosecodym) in [https://github.com/trufflesecurity/trufflehog/pull/2064](https://togithub.com/trufflesecurity/trufflehog/pull/2064) - \[chore] Fix SourceManager flaky test by [@​mcastorina](https://togithub.com/mcastorina) in [https://github.com/trufflesecurity/trufflehog/pull/2059](https://togithub.com/trufflesecurity/trufflehog/pull/2059) - Centralize logic for checking archive extraction tools by [@​ahrav](https://togithub.com/ahrav) in [https://github.com/trufflesecurity/trufflehog/pull/2063](https://togithub.com/trufflesecurity/trufflehog/pull/2063) **Full Changelog**: trufflesecurity/trufflehog@v3.62.0...v3.62.1 ### [`v3.62.0`](https://togithub.com/trufflesecurity/trufflehog/releases/tag/v3.62.0) [Compare Source](https://togithub.com/trufflesecurity/trufflehog/compare/v3.61.0...v3.62.0) #### What's Changed - Update module github.com/aws/aws-sdk-go to v1.46.6 by [@​renovate](https://togithub.com/renovate) in [https://github.com/trufflesecurity/trufflehog/pull/2013](https://togithub.com/trufflesecurity/trufflehog/pull/2013) - Update module github.com/bradleyfalzon/ghinstallation/v2 to v2.8.0 by [@​renovate](https://togithub.com/renovate) in [https://github.com/trufflesecurity/trufflehog/pull/2014](https://togithub.com/trufflesecurity/trufflehog/pull/2014) - Update module github.com/charmbracelet/lipgloss to v0.9.1 by [@​renovate](https://togithub.com/renovate) in [https://github.com/trufflesecurity/trufflehog/pull/2015](https://togithub.com/trufflesecurity/trufflehog/pull/2015) - Update module github.com/go-logr/logr to v1.3.0 by [@​renovate](https://togithub.com/renovate) in [https://github.com/trufflesecurity/trufflehog/pull/2025](https://togithub.com/trufflesecurity/trufflehog/pull/2025) - Update module github.com/getsentry/sentry-go to v0.25.0 by [@​renovate](https://togithub.com/renovate) in [https://github.com/trufflesecurity/trufflehog/pull/2022](https://togithub.com/trufflesecurity/trufflehog/pull/2022) - Update module github.com/google/go-containerregistry to v0.16.1 by [@​renovate](https://togithub.com/renovate) in [https://github.com/trufflesecurity/trufflehog/pull/2026](https://togithub.com/trufflesecurity/trufflehog/pull/2026) - Update module github.com/google/uuid to v1.4.0 by [@​renovate](https://togithub.com/renovate) in [https://github.com/trufflesecurity/trufflehog/pull/2027](https://togithub.com/trufflesecurity/trufflehog/pull/2027) - Update module github.com/hashicorp/golang-lru to v0.6.0 by [@​renovate](https://togithub.com/renovate) in [https://github.com/trufflesecurity/trufflehog/pull/2028](https://togithub.com/trufflesecurity/trufflehog/pull/2028) - Update module github.com/rabbitmq/amqp091-go to v1.9.0 by [@​renovate](https://togithub.com/renovate) in [https://github.com/trufflesecurity/trufflehog/pull/2030](https://togithub.com/trufflesecurity/trufflehog/pull/2030) - Detector-Competition-Feat: Added LemonSqueezy API token detector by [@​fumblehool](https://togithub.com/fumblehool) in [https://github.com/trufflesecurity/trufflehog/pull/2017](https://togithub.com/trufflesecurity/trufflehog/pull/2017) - Update module github.com/prometheus/client_golang to v1.17.0 by [@​renovate](https://togithub.com/renovate) in [https://github.com/trufflesecurity/trufflehog/pull/2029](https://togithub.com/trufflesecurity/trufflehog/pull/2029) - Detector-Competition-Feat: Added Budibase API token detector by [@​fumblehool](https://togithub.com/fumblehool) in [https://github.com/trufflesecurity/trufflehog/pull/2016](https://togithub.com/trufflesecurity/trufflehog/pull/2016) - Update github.com/bodgit/sevenzip to v1.4.3 by [@​rgmz](https://togithub.com/rgmz) in [https://github.com/trufflesecurity/trufflehog/pull/2039](https://togithub.com/trufflesecurity/trufflehog/pull/2039) - Update module go.uber.org/mock to v0.3.0 by [@​renovate](https://togithub.com/renovate) in [https://github.com/trufflesecurity/trufflehog/pull/2038](https://togithub.com/trufflesecurity/trufflehog/pull/2038) - Update module github.com/xanzy/go-gitlab to v0.93.2 by [@​renovate](https://togithub.com/renovate) in [https://github.com/trufflesecurity/trufflehog/pull/2031](https://togithub.com/trufflesecurity/trufflehog/pull/2031) - Update module github.com/snowflakedb/gosnowflake to v1.6.25 by [@​renovate](https://togithub.com/renovate) in [https://github.com/trufflesecurity/trufflehog/pull/2042](https://togithub.com/trufflesecurity/trufflehog/pull/2042) - Update module github.com/launchdarkly/go-server-sdk/v6 to v6.1.1 by [@​renovate](https://togithub.com/renovate) in [https://github.com/trufflesecurity/trufflehog/pull/2043](https://togithub.com/trufflesecurity/trufflehog/pull/2043) - Update module go.uber.org/zap to v1.26.0 by [@​renovate](https://togithub.com/renovate) in [https://github.com/trufflesecurity/trufflehog/pull/2044](https://togithub.com/trufflesecurity/trufflehog/pull/2044) - Update module google.golang.org/api to v0.148.0 by [@​renovate](https://togithub.com/renovate) in [https://github.com/trufflesecurity/trufflehog/pull/2045](https://togithub.com/trufflesecurity/trufflehog/pull/2045) - Developed Deno Deploy Detector by [@​rgmz](https://togithub.com/rgmz) in [https://github.com/trufflesecurity/trufflehog/pull/2040](https://togithub.com/trufflesecurity/trufflehog/pull/2040) - Detector-Competition-Feat: Added Stripo API token detector by [@​fumblehool](https://togithub.com/fumblehool) in [https://github.com/trufflesecurity/trufflehog/pull/2018](https://togithub.com/trufflesecurity/trufflehog/pull/2018) - fix(deps): update module sigs.k8s.io/yaml to v1.4.0 by [@​renovate](https://togithub.com/renovate) in [https://github.com/trufflesecurity/trufflehog/pull/2047](https://togithub.com/trufflesecurity/trufflehog/pull/2047) - Detector-Competition-Feat: Added Reply.io API token detector by [@​fumblehool](https://togithub.com/fumblehool) in [https://github.com/trufflesecurity/trufflehog/pull/2019](https://togithub.com/trufflesecurity/trufflehog/pull/2019) - fix(deps): update module github.com/go-git/go-git/v5 to v5.10.0 by [@​renovate](https://togithub.com/renovate) in [https://github.com/trufflesecurity/trufflehog/pull/2023](https://togithub.com/trufflesecurity/trufflehog/pull/2023) - adding 'token' keyword to regex for github_old by [@​ankushgoel27](https://togithub.com/ankushgoel27) in [https://github.com/trufflesecurity/trufflehog/pull/2037](https://togithub.com/trufflesecurity/trufflehog/pull/2037) - Remove verify flag from Aho-Corasick core by [@​rosecodym](https://togithub.com/rosecodym) in [https://github.com/trufflesecurity/trufflehog/pull/2010](https://togithub.com/trufflesecurity/trufflehog/pull/2010) - Add TravisCI source by [@​dustin-decker](https://togithub.com/dustin-decker) in [https://github.com/trufflesecurity/trufflehog/pull/1877](https://togithub.com/trufflesecurity/trufflehog/pull/1877) **Full Changelog**: trufflesecurity/trufflehog@v3.61.0...v3.62.0 ### [`v3.61.0`](https://togithub.com/trufflesecurity/trufflehog/releases/tag/v3.61.0) [Compare Source](https://togithub.com/trufflesecurity/trufflehog/compare/v3.60.4...v3.61.0) #### What's Changed - Detector-Competition-Fix: Fix/Remove Happi Detection & Verification by [@​lc](https://togithub.com/lc) in [https://github.com/trufflesecurity/trufflehog/pull/2003](https://togithub.com/trufflesecurity/trufflehog/pull/2003) - Detector-Competition-Fix: Fix/Remove Flowdock detector by [@​lc](https://togithub.com/lc) in [https://github.com/trufflesecurity/trufflehog/pull/2004](https://togithub.com/trufflesecurity/trufflehog/pull/2004) - Add temp directory management by [@​codevbus](https://togithub.com/codevbus) in [https://github.com/trufflesecurity/trufflehog/pull/1878](https://togithub.com/trufflesecurity/trufflehog/pull/1878) - Fix binary handling by [@​bill-rich](https://togithub.com/bill-rich) in [https://github.com/trufflesecurity/trufflehog/pull/1999](https://togithub.com/trufflesecurity/trufflehog/pull/1999) - Detector-Competition-Fix: Fix SurveyBot Verification by [@​lc](https://togithub.com/lc) in [https://github.com/trufflesecurity/trufflehog/pull/1948](https://togithub.com/trufflesecurity/trufflehog/pull/1948) - Detector-Competition-Feat: Added BetterStack API token detector by [@​fumblehool](https://togithub.com/fumblehool) in [https://github.com/trufflesecurity/trufflehog/pull/1987](https://togithub.com/trufflesecurity/trufflehog/pull/1987) - Detector-Competition-Feat: Added ZeroTier API token detector by [@​fumblehool](https://togithub.com/fumblehool) in [https://github.com/trufflesecurity/trufflehog/pull/1988](https://togithub.com/trufflesecurity/trufflehog/pull/1988) - Detector-Competition-Feat: Added AppOptics API token detector by [@​fumblehool](https://togithub.com/fumblehool) in [https://github.com/trufflesecurity/trufflehog/pull/1989](https://togithub.com/trufflesecurity/trufflehog/pull/1989) - Detector-Competition-Feat: Add Metabase Session Secret Detector by [@​fumblehool](https://togithub.com/fumblehool) in [https://github.com/trufflesecurity/trufflehog/pull/1902](https://togithub.com/trufflesecurity/trufflehog/pull/1902) - Add Coinbase Wallet-as-a-Service detector by [@​rgmz](https://togithub.com/rgmz) in [https://github.com/trufflesecurity/trufflehog/pull/1895](https://togithub.com/trufflesecurity/trufflehog/pull/1895) - Chore(deps): Bump google.golang.org/grpc from 1.56.2 to 1.56.3 by [@​dependabot](https://togithub.com/dependabot) in [https://github.com/trufflesecurity/trufflehog/pull/2009](https://togithub.com/trufflesecurity/trufflehog/pull/2009) - Update module github.com/TheZeroSlave/zapsentry to v1.19.0 by [@​renovate](https://togithub.com/renovate) in [https://github.com/trufflesecurity/trufflehog/pull/2012](https://togithub.com/trufflesecurity/trufflehog/pull/2012) - Update module cloud.google.com/go/secretmanager to v1.11.3 by [@​renovate](https://togithub.com/renovate) in [https://github.com/trufflesecurity/trufflehog/pull/2011](https://togithub.com/trufflesecurity/trufflehog/pull/2011) **Full Changelog**: trufflesecurity/trufflehog@v3.60.4...v3.61.0 </details> --- ### Configuration 📅 **Schedule**: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined). 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR has been generated by [Mend Renovate](https://www.mend.io/free-developer-tools/renovate/). View repository job log [here](https://developer.mend.io/github/matter-labs/vault-auth-tee). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiIzNy4zMS41IiwidXBkYXRlZEluVmVyIjoiMzcuMzEuNSIsInRhcmdldEJyYW5jaCI6Im1haW4ifQ==--> Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
Description:
The Regex for Formio (https://portal.form.io) JWT token fails to match token as length of token is less.
It has a hard limit of 310 characters but while testing, my token only had 228 characters.
So this PR sets this length to a variable b/w 200 and 310 to avoid detection failures.
Checklist:
make test-community
)?make lint
this requires golangci-lint)?Running Tests Locally
Running formio locally:
In order to run formio locally using Docker, follow the official guide:
https://help.form.io/deployments/deployment-guide/local-deployment