Skip to content

Commit

Permalink
add tristate verification to twitch (#1830)
Browse files Browse the repository at this point in the history 
* add tristate verification to twitch

* return early

* small nits
  • Loading branch information
@0x1
0x1 authored Sep 29, 2023
1 parent b9a582b commit 24748b3
Show file tree
Hide file tree
Showing 2 changed files with 152 additions and 37 deletions.
78 changes: 52 additions & 26 deletions pkg/detectors/twitch/twitch.go
View file
Original file line number Diff line number Diff line change
Expand Up @@ -2,6 +2,7 @@ package twitch

import (
"context"
"fmt"
"net/http"
"net/url"
"regexp"
Expand All @@ -13,13 +14,17 @@ import (
"github.com/trufflesecurity/trufflehog/v3/pkg/pb/detectorspb"
)

type Scanner struct{}
type Scanner struct {
client *http.Client
}

// Ensure the Scanner satisfies the interface at compile time
var _ detectors.Detector = (*Scanner)(nil)

const verifyURL = "https://id.twitch.tv/oauth2/token"

var (
client = common.SaneHttpClient()
defaultClient = common.SaneHttpClient()

// Make sure that your group is surrounded in boundary characters such as below to reduce false positives
keyPat = regexp.MustCompile(detectors.PrefixRegex([]string{"twitch"}) + `\b([0-9a-z]{30})\b`)
Expand Down Expand Up @@ -49,7 +54,6 @@ func (s Scanner) FromData(ctx context.Context, verify bool, data []byte) (result
if len(idMatch) != 2 {
continue
}

resIdMatch := strings.TrimSpace(idMatch[1])

s1 := detectors.Result{
Expand All @@ -58,37 +62,59 @@ func (s Scanner) FromData(ctx context.Context, verify bool, data []byte) (result
}

if verify {
data := url.Values{}
data.Set("client_id", resIdMatch)
data.Set("client_secret", resMatch)
data.Set("grant_type", "client_credentials")
encodedData := data.Encode()
req, err := http.NewRequestWithContext(ctx, "POST", "https://id.twitch.tv/oauth2/token", strings.NewReader(encodedData))
if err != nil {
continue
}
req.Header.Add("Content-Type", "application/x-www-form-urlencoded")
req.Header.Add("Content-Length", strconv.Itoa(len(data.Encode())))
res, err := client.Do(req)
if err == nil {
defer res.Body.Close()
if res.StatusCode >= 200 && res.StatusCode < 300 {
s1.Verified = true
} else {
// This function will check false positives for common test words, but also it will make sure the key appears 'random' enough to be a real key
if detectors.IsKnownFalsePositive(resMatch, detectors.DefaultFalsePositives, true) {
continue
}
}
}
client := s.getClient()
isVerified, verificationErr := verifyTwitch(ctx, client, resMatch, resIdMatch)
s1.Verified = isVerified
s1.VerificationError = verificationErr
}

// This function will check false positives for common test words, but also it will make sure the key appears 'random' enough to be a real key
if !s1.Verified && detectors.IsKnownFalsePositive(resMatch, detectors.DefaultFalsePositives, true) {
continue
}
results = append(results, s1)
}
}
return results, nil
}

func (s Scanner) getClient() *http.Client {
if s.client != nil {
return s.client
}
return defaultClient
}

func verifyTwitch(ctx context.Context, client *http.Client, resMatch string, resIdMatch string) (bool, error) {
data := url.Values{}
data.Set("client_id", resIdMatch)
data.Set("client_secret", resMatch)
data.Set("grant_type", "client_credentials")
encodedData := data.Encode()

req, err := http.NewRequestWithContext(ctx, http.MethodPost, verifyURL, strings.NewReader(encodedData))
if err != nil {
return false, err
}

req.Header.Add("Content-Type", "application/x-www-form-urlencoded")
req.Header.Add("Content-Length", strconv.Itoa(len(data.Encode())))
res, err := client.Do(req)
if err != nil {
return false, err
}
defer res.Body.Close()

switch res.StatusCode {
case http.StatusOK:
return true, nil
case http.StatusBadRequest, http.StatusForbidden:
return false, nil
default:
return false, fmt.Errorf("unexpected http response status %d", res.StatusCode)
}
}

func (s Scanner) Type() detectorspb.DetectorType {
return detectorspb.DetectorType_Twitch
}
111 changes: 100 additions & 11 deletions pkg/detectors/twitch/twitch_test.go
View file
Original file line number Diff line number Diff line change
Expand Up @@ -9,10 +9,11 @@ import (
"testing"
"time"

"github.com/kylelemons/godebug/pretty"
"github.com/google/go-cmp/cmp"
"github.com/google/go-cmp/cmp/cmpopts"
"github.com/trufflesecurity/trufflehog/v3/pkg/common"
"github.com/trufflesecurity/trufflehog/v3/pkg/detectors"

"github.com/trufflesecurity/trufflehog/v3/pkg/common"
"github.com/trufflesecurity/trufflehog/v3/pkg/pb/detectorspb"
)

Expand All @@ -33,11 +34,12 @@ func TestTwitch_FromChunk(t *testing.T) {
verify bool
}
tests := []struct {
name string
s Scanner
args args
want []detectors.Result
wantErr bool
name string
s Scanner
args args
want []detectors.Result
wantErr bool
wantVerificationErr bool
}{
{
name: "found, verified",
Expand All @@ -47,14 +49,87 @@ func TestTwitch_FromChunk(t *testing.T) {
data: []byte(fmt.Sprintf("You can find a twitch secret %s within twitch %s", secret, id)),
verify: true,
},
// the detector will try every combination of the secret and id for
// client_id and client_secret, so we expect 4 results
// but only 1 of them will be verified
want: []detectors.Result{
{
DetectorType: detectorspb.DetectorType_Twitch,
Verified: false,
},
{
DetectorType: detectorspb.DetectorType_Twitch,
Verified: true,
},
{
DetectorType: detectorspb.DetectorType_Twitch,
Verified: false,
},
{
DetectorType: detectorspb.DetectorType_Twitch,
Verified: false,
},
},
wantErr: false,
},
{
name: "found, would be verified if not for timeout",
s: Scanner{client: common.SaneHttpClientTimeOut(1 * time.Microsecond)},
args: args{
ctx: context.Background(),
data: []byte(fmt.Sprintf("You can find a twitch secret %s within twitch %s", secret, id)),
verify: true,
},
want: []detectors.Result{
{
DetectorType: detectorspb.DetectorType_Twitch,
Verified: false,
},
{
DetectorType: detectorspb.DetectorType_Twitch,
Verified: false,
},
{
DetectorType: detectorspb.DetectorType_Twitch,
Verified: false,
},
{
DetectorType: detectorspb.DetectorType_Twitch,
Verified: false,
},
},
wantErr: false,
wantVerificationErr: true,
},
{
name: "found, verified but unexpected api surface",
s: Scanner{client: common.ConstantResponseHttpClient(404, "")},
args: args{
ctx: context.Background(),
data: []byte(fmt.Sprintf("You can find a twitch secret %s within twitch %s", secret, id)),
verify: true,
},
want: []detectors.Result{
{
DetectorType: detectorspb.DetectorType_Twitch,
Verified: false,
},
{
DetectorType: detectorspb.DetectorType_Twitch,
Verified: false,
},
{
DetectorType: detectorspb.DetectorType_Twitch,
Verified: false,
},
{
DetectorType: detectorspb.DetectorType_Twitch,
Verified: false,
},
},
wantErr: false,
wantVerificationErr: true,
},
{
name: "found, unverified",
s: Scanner{},
Expand All @@ -68,6 +143,18 @@ func TestTwitch_FromChunk(t *testing.T) {
DetectorType: detectorspb.DetectorType_Twitch,
Verified: false,
},
{
DetectorType: detectorspb.DetectorType_Twitch,
Verified: false,
},
{
DetectorType: detectorspb.DetectorType_Twitch,
Verified: false,
},
{
DetectorType: detectorspb.DetectorType_Twitch,
Verified: false,
},
},
wantErr: false,
},
Expand All @@ -85,8 +172,7 @@ func TestTwitch_FromChunk(t *testing.T) {
}
for _, tt := range tests {
t.Run(tt.name, func(t *testing.T) {
s := Scanner{}
got, err := s.FromData(tt.args.ctx, tt.args.verify, tt.args.data)
got, err := tt.s.FromData(tt.args.ctx, tt.args.verify, tt.args.data)
if (err != nil) != tt.wantErr {
t.Errorf("Twitch.FromData() error = %v, wantErr %v", err, tt.wantErr)
return
Expand All @@ -95,9 +181,12 @@ func TestTwitch_FromChunk(t *testing.T) {
if len(got[i].Raw) == 0 {
t.Fatalf("no raw secret present: \n %+v", got[i])
}
got[i].Raw = nil
if (got[i].VerificationError != nil) != tt.wantVerificationErr {
t.Errorf("Twitch.FromData() verificationError = %v, wantVerificationErr %v", got[i].VerificationError, tt.wantVerificationErr)
}
}
if diff := pretty.Compare(got, tt.want); diff != "" {
ignoreOpts := cmpopts.IgnoreFields(detectors.Result{}, "Raw", "VerificationError")
if diff := cmp.Diff(got, tt.want, ignoreOpts); diff != "" {
t.Errorf("Twitch.FromData() %s diff: (-got +want)\n%s", tt.name, diff)
}
})
Expand Down

0 comments on commit 24748b3

Please sign in to comment.