diff --git a/pkg/detectors/codeclimate/codeclimate.go b/pkg/detectors/codeclimate/codeclimate.go index 5820ad333717..aaf23de10517 100644 --- a/pkg/detectors/codeclimate/codeclimate.go +++ b/pkg/detectors/codeclimate/codeclimate.go @@ -2,6 +2,7 @@ package codeclimate import ( "context" + "encoding/json" "fmt" "net/http" "regexp" @@ -30,6 +31,12 @@ func (s Scanner) Keywords() []string { return []string{"codeclimate"} } +type response struct { + Data struct { + Id string `json:"id"` + } `json:"data"` +} + // FromData will find and optionally verify Codeclimate secrets in a given set of bytes. func (s Scanner) FromData(ctx context.Context, verify bool, data []byte) (results []detectors.Result, err error) { dataStr := string(data) @@ -58,7 +65,14 @@ func (s Scanner) FromData(ctx context.Context, verify bool, data []byte) (result if err == nil { defer res.Body.Close() if res.StatusCode >= 200 && res.StatusCode < 300 { - s1.Verified = true + var r response + if err := json.NewDecoder(res.Body).Decode(&r); err != nil { + s1.VerificationError = err + continue + } + if r.Data.Id != "" { + s1.Verified = true + } } else { // This function will check false positives for common test words, but also it will make sure the key appears 'random' enough to be a real key if detectors.IsKnownFalsePositive(resMatch, detectors.DefaultFalsePositives, true) {