Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Detector-Competition-Fix: Update formio regex to match Jwt token #1935

Merged
merged 2 commits into from
Oct 30, 2023

Conversation

fumblehool
Copy link
Contributor

@fumblehool fumblehool commented Oct 21, 2023

Description:

The Regex for Formio (https://portal.form.io) JWT token fails to match token as length of token is less.
It has a hard limit of 310 characters but while testing, my token only had 228 characters.
So this PR sets this length to a variable b/w 200 and 310 to avoid detection failures.

Checklist:

  • Tests passing (make test-community)?
  • Lint passing (make lint this requires golangci-lint)?

Running Tests Locally

Screenshot 2023-10-21 at 10 15 31 PM

Running formio locally:

In order to run formio locally using Docker, follow the official guide:
https://help.form.io/deployments/deployment-guide/local-deployment

@dustin-decker dustin-decker added the Hacktoberfest-Detector-Competition-Fix Apply this label if you are fixing a detector for the detector competition label Oct 24, 2023
@zricethezav
Copy link
Collaborator

@fumblehool

So this PR sets this length to a variable b/w 200 and 310 to avoid detection failures.

Any reason why 200? Any risk of this being lower than 200?

@fumblehool
Copy link
Contributor Author

@zricethezav the length depends on the payload data.
Currently, it follows this structure:

{
  "user": {
    "_id": XXXXX
  },
  "iss": "https://api.form.io",
  "sub": XXXXX,
  "jti": XXXXX,
  "iat": XXXXX,
  "exp": XXXXXX
}

For this structure, the length is around 310.
If I convert user object into a user_id string, the length comes out to be 210 (close to original 228 limit).

I've converted this into a range to avoid updating the regex frequently.

@zricethezav
Copy link
Collaborator

For this structure, the length is around 310.
If I convert user object into a user_id string, the length comes out to be 210 (close to original 228 limit).
I've converted this into a range to avoid updating the regex frequently.

Makes sense, thanks for the explanation

@zricethezav zricethezav merged commit 244ba3a into trufflesecurity:main Oct 30, 2023
haraldh referenced this pull request in matter-labs/vault-auth-tee Nov 3, 2023
[![Mend
Renovate](https://app.renovatebot.com/images/banner.svg)](https://renovatebot.com)

This PR contains the following updates:

| Package | Type | Update | Change |
|---|---|---|---|
|
[trufflesecurity/trufflehog](https://togithub.com/trufflesecurity/trufflehog)
| action | minor | `v3.60.4` -> `v3.62.1` |

---

### Release Notes

<details>
<summary>trufflesecurity/trufflehog
(trufflesecurity/trufflehog)</summary>

###
[`v3.62.1`](https://togithub.com/trufflesecurity/trufflehog/releases/tag/v3.62.1)

[Compare
Source](https://togithub.com/trufflesecurity/trufflehog/compare/v3.62.0...v3.62.1)

#### What's Changed

- update kingpin import by
[@&#8203;dustin-decker](https://togithub.com/dustin-decker) in
[https://github.com/trufflesecurity/trufflehog/pull/2053](https://togithub.com/trufflesecurity/trufflehog/pull/2053)
- Re-add detector version by
[@&#8203;rosecodym](https://togithub.com/rosecodym) in
[https://github.com/trufflesecurity/trufflehog/pull/2060](https://togithub.com/trufflesecurity/trufflehog/pull/2060)
- Detector-Competition-Fix: Fix currencycloud.com API key by
[@&#8203;lc](https://togithub.com/lc) in
[https://github.com/trufflesecurity/trufflehog/pull/1917](https://togithub.com/trufflesecurity/trufflehog/pull/1917)
- Detector-Competition-Fix: Fix Bitcoin Average detector by
[@&#8203;lc](https://togithub.com/lc) in
[https://github.com/trufflesecurity/trufflehog/pull/1929](https://togithub.com/trufflesecurity/trufflehog/pull/1929)
- Detector-Competition-Fix: Update formio regex to match Jwt token by
[@&#8203;fumblehool](https://togithub.com/fumblehool) in
[https://github.com/trufflesecurity/trufflehog/pull/1935](https://togithub.com/trufflesecurity/trufflehog/pull/1935)
- Detector-Competition-Fix: Fix SalesBlink Detection & Verification by
[@&#8203;lc](https://togithub.com/lc) in
[https://github.com/trufflesecurity/trufflehog/pull/1950](https://togithub.com/trufflesecurity/trufflehog/pull/1950)
- Support multiple custom detectors by
[@&#8203;rosecodym](https://togithub.com/rosecodym) in
[https://github.com/trufflesecurity/trufflehog/pull/2064](https://togithub.com/trufflesecurity/trufflehog/pull/2064)
- \[chore] Fix SourceManager flaky test by
[@&#8203;mcastorina](https://togithub.com/mcastorina) in
[https://github.com/trufflesecurity/trufflehog/pull/2059](https://togithub.com/trufflesecurity/trufflehog/pull/2059)
- Centralize logic for checking archive extraction tools by
[@&#8203;ahrav](https://togithub.com/ahrav) in
[https://github.com/trufflesecurity/trufflehog/pull/2063](https://togithub.com/trufflesecurity/trufflehog/pull/2063)

**Full Changelog**:
trufflesecurity/trufflehog@v3.62.0...v3.62.1

###
[`v3.62.0`](https://togithub.com/trufflesecurity/trufflehog/releases/tag/v3.62.0)

[Compare
Source](https://togithub.com/trufflesecurity/trufflehog/compare/v3.61.0...v3.62.0)

#### What's Changed

- Update module github.com/aws/aws-sdk-go to v1.46.6 by
[@&#8203;renovate](https://togithub.com/renovate) in
[https://github.com/trufflesecurity/trufflehog/pull/2013](https://togithub.com/trufflesecurity/trufflehog/pull/2013)
- Update module github.com/bradleyfalzon/ghinstallation/v2 to v2.8.0 by
[@&#8203;renovate](https://togithub.com/renovate) in
[https://github.com/trufflesecurity/trufflehog/pull/2014](https://togithub.com/trufflesecurity/trufflehog/pull/2014)
- Update module github.com/charmbracelet/lipgloss to v0.9.1 by
[@&#8203;renovate](https://togithub.com/renovate) in
[https://github.com/trufflesecurity/trufflehog/pull/2015](https://togithub.com/trufflesecurity/trufflehog/pull/2015)
- Update module github.com/go-logr/logr to v1.3.0 by
[@&#8203;renovate](https://togithub.com/renovate) in
[https://github.com/trufflesecurity/trufflehog/pull/2025](https://togithub.com/trufflesecurity/trufflehog/pull/2025)
- Update module github.com/getsentry/sentry-go to v0.25.0 by
[@&#8203;renovate](https://togithub.com/renovate) in
[https://github.com/trufflesecurity/trufflehog/pull/2022](https://togithub.com/trufflesecurity/trufflehog/pull/2022)
- Update module github.com/google/go-containerregistry to v0.16.1 by
[@&#8203;renovate](https://togithub.com/renovate) in
[https://github.com/trufflesecurity/trufflehog/pull/2026](https://togithub.com/trufflesecurity/trufflehog/pull/2026)
- Update module github.com/google/uuid to v1.4.0 by
[@&#8203;renovate](https://togithub.com/renovate) in
[https://github.com/trufflesecurity/trufflehog/pull/2027](https://togithub.com/trufflesecurity/trufflehog/pull/2027)
- Update module github.com/hashicorp/golang-lru to v0.6.0 by
[@&#8203;renovate](https://togithub.com/renovate) in
[https://github.com/trufflesecurity/trufflehog/pull/2028](https://togithub.com/trufflesecurity/trufflehog/pull/2028)
- Update module github.com/rabbitmq/amqp091-go to v1.9.0 by
[@&#8203;renovate](https://togithub.com/renovate) in
[https://github.com/trufflesecurity/trufflehog/pull/2030](https://togithub.com/trufflesecurity/trufflehog/pull/2030)
- Detector-Competition-Feat: Added LemonSqueezy API token detector by
[@&#8203;fumblehool](https://togithub.com/fumblehool) in
[https://github.com/trufflesecurity/trufflehog/pull/2017](https://togithub.com/trufflesecurity/trufflehog/pull/2017)
- Update module github.com/prometheus/client_golang to v1.17.0 by
[@&#8203;renovate](https://togithub.com/renovate) in
[https://github.com/trufflesecurity/trufflehog/pull/2029](https://togithub.com/trufflesecurity/trufflehog/pull/2029)
- Detector-Competition-Feat: Added Budibase API token detector by
[@&#8203;fumblehool](https://togithub.com/fumblehool) in
[https://github.com/trufflesecurity/trufflehog/pull/2016](https://togithub.com/trufflesecurity/trufflehog/pull/2016)
- Update github.com/bodgit/sevenzip to v1.4.3 by
[@&#8203;rgmz](https://togithub.com/rgmz) in
[https://github.com/trufflesecurity/trufflehog/pull/2039](https://togithub.com/trufflesecurity/trufflehog/pull/2039)
- Update module go.uber.org/mock to v0.3.0 by
[@&#8203;renovate](https://togithub.com/renovate) in
[https://github.com/trufflesecurity/trufflehog/pull/2038](https://togithub.com/trufflesecurity/trufflehog/pull/2038)
- Update module github.com/xanzy/go-gitlab to v0.93.2 by
[@&#8203;renovate](https://togithub.com/renovate) in
[https://github.com/trufflesecurity/trufflehog/pull/2031](https://togithub.com/trufflesecurity/trufflehog/pull/2031)
- Update module github.com/snowflakedb/gosnowflake to v1.6.25 by
[@&#8203;renovate](https://togithub.com/renovate) in
[https://github.com/trufflesecurity/trufflehog/pull/2042](https://togithub.com/trufflesecurity/trufflehog/pull/2042)
- Update module github.com/launchdarkly/go-server-sdk/v6 to v6.1.1 by
[@&#8203;renovate](https://togithub.com/renovate) in
[https://github.com/trufflesecurity/trufflehog/pull/2043](https://togithub.com/trufflesecurity/trufflehog/pull/2043)
- Update module go.uber.org/zap to v1.26.0 by
[@&#8203;renovate](https://togithub.com/renovate) in
[https://github.com/trufflesecurity/trufflehog/pull/2044](https://togithub.com/trufflesecurity/trufflehog/pull/2044)
- Update module google.golang.org/api to v0.148.0 by
[@&#8203;renovate](https://togithub.com/renovate) in
[https://github.com/trufflesecurity/trufflehog/pull/2045](https://togithub.com/trufflesecurity/trufflehog/pull/2045)
- Developed Deno Deploy Detector by
[@&#8203;rgmz](https://togithub.com/rgmz) in
[https://github.com/trufflesecurity/trufflehog/pull/2040](https://togithub.com/trufflesecurity/trufflehog/pull/2040)
- Detector-Competition-Feat: Added Stripo API token detector by
[@&#8203;fumblehool](https://togithub.com/fumblehool) in
[https://github.com/trufflesecurity/trufflehog/pull/2018](https://togithub.com/trufflesecurity/trufflehog/pull/2018)
- fix(deps): update module sigs.k8s.io/yaml to v1.4.0 by
[@&#8203;renovate](https://togithub.com/renovate) in
[https://github.com/trufflesecurity/trufflehog/pull/2047](https://togithub.com/trufflesecurity/trufflehog/pull/2047)
- Detector-Competition-Feat: Added Reply.io API token detector by
[@&#8203;fumblehool](https://togithub.com/fumblehool) in
[https://github.com/trufflesecurity/trufflehog/pull/2019](https://togithub.com/trufflesecurity/trufflehog/pull/2019)
- fix(deps): update module github.com/go-git/go-git/v5 to v5.10.0 by
[@&#8203;renovate](https://togithub.com/renovate) in
[https://github.com/trufflesecurity/trufflehog/pull/2023](https://togithub.com/trufflesecurity/trufflehog/pull/2023)
- adding 'token' keyword to regex for github_old by
[@&#8203;ankushgoel27](https://togithub.com/ankushgoel27) in
[https://github.com/trufflesecurity/trufflehog/pull/2037](https://togithub.com/trufflesecurity/trufflehog/pull/2037)
- Remove verify flag from Aho-Corasick core by
[@&#8203;rosecodym](https://togithub.com/rosecodym) in
[https://github.com/trufflesecurity/trufflehog/pull/2010](https://togithub.com/trufflesecurity/trufflehog/pull/2010)
- Add TravisCI source by
[@&#8203;dustin-decker](https://togithub.com/dustin-decker) in
[https://github.com/trufflesecurity/trufflehog/pull/1877](https://togithub.com/trufflesecurity/trufflehog/pull/1877)

**Full Changelog**:
trufflesecurity/trufflehog@v3.61.0...v3.62.0

###
[`v3.61.0`](https://togithub.com/trufflesecurity/trufflehog/releases/tag/v3.61.0)

[Compare
Source](https://togithub.com/trufflesecurity/trufflehog/compare/v3.60.4...v3.61.0)

#### What's Changed

- Detector-Competition-Fix: Fix/Remove Happi Detection & Verification by
[@&#8203;lc](https://togithub.com/lc) in
[https://github.com/trufflesecurity/trufflehog/pull/2003](https://togithub.com/trufflesecurity/trufflehog/pull/2003)
- Detector-Competition-Fix: Fix/Remove Flowdock detector by
[@&#8203;lc](https://togithub.com/lc) in
[https://github.com/trufflesecurity/trufflehog/pull/2004](https://togithub.com/trufflesecurity/trufflehog/pull/2004)
- Add temp directory management by
[@&#8203;codevbus](https://togithub.com/codevbus) in
[https://github.com/trufflesecurity/trufflehog/pull/1878](https://togithub.com/trufflesecurity/trufflehog/pull/1878)
- Fix binary handling by
[@&#8203;bill-rich](https://togithub.com/bill-rich) in
[https://github.com/trufflesecurity/trufflehog/pull/1999](https://togithub.com/trufflesecurity/trufflehog/pull/1999)
- Detector-Competition-Fix: Fix SurveyBot Verification by
[@&#8203;lc](https://togithub.com/lc) in
[https://github.com/trufflesecurity/trufflehog/pull/1948](https://togithub.com/trufflesecurity/trufflehog/pull/1948)
- Detector-Competition-Feat: Added BetterStack API token detector by
[@&#8203;fumblehool](https://togithub.com/fumblehool) in
[https://github.com/trufflesecurity/trufflehog/pull/1987](https://togithub.com/trufflesecurity/trufflehog/pull/1987)
- Detector-Competition-Feat: Added ZeroTier API token detector by
[@&#8203;fumblehool](https://togithub.com/fumblehool) in
[https://github.com/trufflesecurity/trufflehog/pull/1988](https://togithub.com/trufflesecurity/trufflehog/pull/1988)
- Detector-Competition-Feat: Added AppOptics API token detector by
[@&#8203;fumblehool](https://togithub.com/fumblehool) in
[https://github.com/trufflesecurity/trufflehog/pull/1989](https://togithub.com/trufflesecurity/trufflehog/pull/1989)
- Detector-Competition-Feat: Add Metabase Session Secret Detector by
[@&#8203;fumblehool](https://togithub.com/fumblehool) in
[https://github.com/trufflesecurity/trufflehog/pull/1902](https://togithub.com/trufflesecurity/trufflehog/pull/1902)
- Add Coinbase Wallet-as-a-Service detector by
[@&#8203;rgmz](https://togithub.com/rgmz) in
[https://github.com/trufflesecurity/trufflehog/pull/1895](https://togithub.com/trufflesecurity/trufflehog/pull/1895)
- Chore(deps): Bump google.golang.org/grpc from 1.56.2 to 1.56.3 by
[@&#8203;dependabot](https://togithub.com/dependabot) in
[https://github.com/trufflesecurity/trufflehog/pull/2009](https://togithub.com/trufflesecurity/trufflehog/pull/2009)
- Update module github.com/TheZeroSlave/zapsentry to v1.19.0 by
[@&#8203;renovate](https://togithub.com/renovate) in
[https://github.com/trufflesecurity/trufflehog/pull/2012](https://togithub.com/trufflesecurity/trufflehog/pull/2012)
- Update module cloud.google.com/go/secretmanager to v1.11.3 by
[@&#8203;renovate](https://togithub.com/renovate) in
[https://github.com/trufflesecurity/trufflehog/pull/2011](https://togithub.com/trufflesecurity/trufflehog/pull/2011)

**Full Changelog**:
trufflesecurity/trufflehog@v3.60.4...v3.61.0

</details>

---

### Configuration

📅 **Schedule**: Branch creation - At any time (no schedule defined),
Automerge - At any time (no schedule defined).

🚦 **Automerge**: Disabled by config. Please merge this manually once you
are satisfied.

♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the
rebase/retry checkbox.

🔕 **Ignore**: Close this PR and you won't be reminded about this update
again.

---

- [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check
this box

---

This PR has been generated by [Mend
Renovate](https://www.mend.io/free-developer-tools/renovate/). View
repository job log
[here](https://developer.mend.io/github/matter-labs/vault-auth-tee).

<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiIzNy4zMS41IiwidXBkYXRlZEluVmVyIjoiMzcuMzEuNSIsInRhcmdldEJyYW5jaCI6Im1haW4ifQ==-->

Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
Hacktoberfest-Detector-Competition-Fix Apply this label if you are fixing a detector for the detector competition
Development

Successfully merging this pull request may close these issues.

3 participants