Detector-Competition-Feat: Add Metabase Session Secret Detector #1902
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
|
hi @fumblehool, thanks for the contributions and participation in our Hacktoberfest detector competition. Would you mind completing the documentation steps as listed on the detector competition page? https://github.com/trufflesecurity/hacktoberfest2023/blob/main/README.md#1-documentation We need a screenshot of passing tests |
zricethezav
added
the
Hacktoberfest-Detector-Competition-New
fumblehool
force-pushed
the
fumblehool/add-metabase
branch
from
28c20b0
to
b9523ef
Compare
zricethezav
reviewed
Oct 25, 2023
fumblehool
force-pushed
the
fumblehool/add-metabase
branch
from
b9523ef
to
25d3451
Compare
|
@zricethezav Updated the code, please review and merge 😃 |
Phoenix591
pushed a commit
to Phoenix591/trufflehog
that referenced
this pull request
Oct 27, 2023
…flesecurity#1902) Co-authored-by: Ahrav Dutta <[email protected]>
haraldh
referenced
this pull request
in matter-labs/vault-auth-tee
Nov 3, 2023
[](https://renovatebot.com) This PR contains the following updates: | Package | Type | Update | Change | |---|---|---|---| | [trufflesecurity/trufflehog](https://togithub.com/trufflesecurity/trufflehog) | action | minor | `v3.60.4` -> `v3.62.1` | --- ### Release Notes <details> <summary>trufflesecurity/trufflehog (trufflesecurity/trufflehog)</summary> ### [`v3.62.1`](https://togithub.com/trufflesecurity/trufflehog/releases/tag/v3.62.1) [Compare Source](https://togithub.com/trufflesecurity/trufflehog/compare/v3.62.0...v3.62.1) #### What's Changed - update kingpin import by [@​dustin-decker](https://togithub.com/dustin-decker) in [https://github.com/trufflesecurity/trufflehog/pull/2053](https://togithub.com/trufflesecurity/trufflehog/pull/2053) - Re-add detector version by [@​rosecodym](https://togithub.com/rosecodym) in [https://github.com/trufflesecurity/trufflehog/pull/2060](https://togithub.com/trufflesecurity/trufflehog/pull/2060) - Detector-Competition-Fix: Fix currencycloud.com API key by [@​lc](https://togithub.com/lc) in [https://github.com/trufflesecurity/trufflehog/pull/1917](https://togithub.com/trufflesecurity/trufflehog/pull/1917) - Detector-Competition-Fix: Fix Bitcoin Average detector by [@​lc](https://togithub.com/lc) in [https://github.com/trufflesecurity/trufflehog/pull/1929](https://togithub.com/trufflesecurity/trufflehog/pull/1929) - Detector-Competition-Fix: Update formio regex to match Jwt token by [@​fumblehool](https://togithub.com/fumblehool) in [https://github.com/trufflesecurity/trufflehog/pull/1935](https://togithub.com/trufflesecurity/trufflehog/pull/1935) - Detector-Competition-Fix: Fix SalesBlink Detection & Verification by [@​lc](https://togithub.com/lc) in [https://github.com/trufflesecurity/trufflehog/pull/1950](https://togithub.com/trufflesecurity/trufflehog/pull/1950) - Support multiple custom detectors by [@​rosecodym](https://togithub.com/rosecodym) in [https://github.com/trufflesecurity/trufflehog/pull/2064](https://togithub.com/trufflesecurity/trufflehog/pull/2064) - \[chore] Fix SourceManager flaky test by [@​mcastorina](https://togithub.com/mcastorina) in [https://github.com/trufflesecurity/trufflehog/pull/2059](https://togithub.com/trufflesecurity/trufflehog/pull/2059) - Centralize logic for checking archive extraction tools by [@​ahrav](https://togithub.com/ahrav) in [https://github.com/trufflesecurity/trufflehog/pull/2063](https://togithub.com/trufflesecurity/trufflehog/pull/2063) **Full Changelog**: trufflesecurity/trufflehog@v3.62.0...v3.62.1 ### [`v3.62.0`](https://togithub.com/trufflesecurity/trufflehog/releases/tag/v3.62.0) [Compare Source](https://togithub.com/trufflesecurity/trufflehog/compare/v3.61.0...v3.62.0) #### What's Changed - Update module github.com/aws/aws-sdk-go to v1.46.6 by [@​renovate](https://togithub.com/renovate) in [https://github.com/trufflesecurity/trufflehog/pull/2013](https://togithub.com/trufflesecurity/trufflehog/pull/2013) - Update module github.com/bradleyfalzon/ghinstallation/v2 to v2.8.0 by [@​renovate](https://togithub.com/renovate) in [https://github.com/trufflesecurity/trufflehog/pull/2014](https://togithub.com/trufflesecurity/trufflehog/pull/2014) - Update module github.com/charmbracelet/lipgloss to v0.9.1 by [@​renovate](https://togithub.com/renovate) in [https://github.com/trufflesecurity/trufflehog/pull/2015](https://togithub.com/trufflesecurity/trufflehog/pull/2015) - Update module github.com/go-logr/logr to v1.3.0 by [@​renovate](https://togithub.com/renovate) in [https://github.com/trufflesecurity/trufflehog/pull/2025](https://togithub.com/trufflesecurity/trufflehog/pull/2025) - Update module github.com/getsentry/sentry-go to v0.25.0 by [@​renovate](https://togithub.com/renovate) in [https://github.com/trufflesecurity/trufflehog/pull/2022](https://togithub.com/trufflesecurity/trufflehog/pull/2022) - Update module github.com/google/go-containerregistry to v0.16.1 by [@​renovate](https://togithub.com/renovate) in [https://github.com/trufflesecurity/trufflehog/pull/2026](https://togithub.com/trufflesecurity/trufflehog/pull/2026) - Update module github.com/google/uuid to v1.4.0 by [@​renovate](https://togithub.com/renovate) in [https://github.com/trufflesecurity/trufflehog/pull/2027](https://togithub.com/trufflesecurity/trufflehog/pull/2027) - Update module github.com/hashicorp/golang-lru to v0.6.0 by [@​renovate](https://togithub.com/renovate) in [https://github.com/trufflesecurity/trufflehog/pull/2028](https://togithub.com/trufflesecurity/trufflehog/pull/2028) - Update module github.com/rabbitmq/amqp091-go to v1.9.0 by [@​renovate](https://togithub.com/renovate) in [https://github.com/trufflesecurity/trufflehog/pull/2030](https://togithub.com/trufflesecurity/trufflehog/pull/2030) - Detector-Competition-Feat: Added LemonSqueezy API token detector by [@​fumblehool](https://togithub.com/fumblehool) in [https://github.com/trufflesecurity/trufflehog/pull/2017](https://togithub.com/trufflesecurity/trufflehog/pull/2017) - Update module github.com/prometheus/client_golang to v1.17.0 by [@​renovate](https://togithub.com/renovate) in [https://github.com/trufflesecurity/trufflehog/pull/2029](https://togithub.com/trufflesecurity/trufflehog/pull/2029) - Detector-Competition-Feat: Added Budibase API token detector by [@​fumblehool](https://togithub.com/fumblehool) in [https://github.com/trufflesecurity/trufflehog/pull/2016](https://togithub.com/trufflesecurity/trufflehog/pull/2016) - Update github.com/bodgit/sevenzip to v1.4.3 by [@​rgmz](https://togithub.com/rgmz) in [https://github.com/trufflesecurity/trufflehog/pull/2039](https://togithub.com/trufflesecurity/trufflehog/pull/2039) - Update module go.uber.org/mock to v0.3.0 by [@​renovate](https://togithub.com/renovate) in [https://github.com/trufflesecurity/trufflehog/pull/2038](https://togithub.com/trufflesecurity/trufflehog/pull/2038) - Update module github.com/xanzy/go-gitlab to v0.93.2 by [@​renovate](https://togithub.com/renovate) in [https://github.com/trufflesecurity/trufflehog/pull/2031](https://togithub.com/trufflesecurity/trufflehog/pull/2031) - Update module github.com/snowflakedb/gosnowflake to v1.6.25 by [@​renovate](https://togithub.com/renovate) in [https://github.com/trufflesecurity/trufflehog/pull/2042](https://togithub.com/trufflesecurity/trufflehog/pull/2042) - Update module github.com/launchdarkly/go-server-sdk/v6 to v6.1.1 by [@​renovate](https://togithub.com/renovate) in [https://github.com/trufflesecurity/trufflehog/pull/2043](https://togithub.com/trufflesecurity/trufflehog/pull/2043) - Update module go.uber.org/zap to v1.26.0 by [@​renovate](https://togithub.com/renovate) in [https://github.com/trufflesecurity/trufflehog/pull/2044](https://togithub.com/trufflesecurity/trufflehog/pull/2044) - Update module google.golang.org/api to v0.148.0 by [@​renovate](https://togithub.com/renovate) in [https://github.com/trufflesecurity/trufflehog/pull/2045](https://togithub.com/trufflesecurity/trufflehog/pull/2045) - Developed Deno Deploy Detector by [@​rgmz](https://togithub.com/rgmz) in [https://github.com/trufflesecurity/trufflehog/pull/2040](https://togithub.com/trufflesecurity/trufflehog/pull/2040) - Detector-Competition-Feat: Added Stripo API token detector by [@​fumblehool](https://togithub.com/fumblehool) in [https://github.com/trufflesecurity/trufflehog/pull/2018](https://togithub.com/trufflesecurity/trufflehog/pull/2018) - fix(deps): update module sigs.k8s.io/yaml to v1.4.0 by [@​renovate](https://togithub.com/renovate) in [https://github.com/trufflesecurity/trufflehog/pull/2047](https://togithub.com/trufflesecurity/trufflehog/pull/2047) - Detector-Competition-Feat: Added Reply.io API token detector by [@​fumblehool](https://togithub.com/fumblehool) in [https://github.com/trufflesecurity/trufflehog/pull/2019](https://togithub.com/trufflesecurity/trufflehog/pull/2019) - fix(deps): update module github.com/go-git/go-git/v5 to v5.10.0 by [@​renovate](https://togithub.com/renovate) in [https://github.com/trufflesecurity/trufflehog/pull/2023](https://togithub.com/trufflesecurity/trufflehog/pull/2023) - adding 'token' keyword to regex for github_old by [@​ankushgoel27](https://togithub.com/ankushgoel27) in [https://github.com/trufflesecurity/trufflehog/pull/2037](https://togithub.com/trufflesecurity/trufflehog/pull/2037) - Remove verify flag from Aho-Corasick core by [@​rosecodym](https://togithub.com/rosecodym) in [https://github.com/trufflesecurity/trufflehog/pull/2010](https://togithub.com/trufflesecurity/trufflehog/pull/2010) - Add TravisCI source by [@​dustin-decker](https://togithub.com/dustin-decker) in [https://github.com/trufflesecurity/trufflehog/pull/1877](https://togithub.com/trufflesecurity/trufflehog/pull/1877) **Full Changelog**: trufflesecurity/trufflehog@v3.61.0...v3.62.0 ### [`v3.61.0`](https://togithub.com/trufflesecurity/trufflehog/releases/tag/v3.61.0) [Compare Source](https://togithub.com/trufflesecurity/trufflehog/compare/v3.60.4...v3.61.0) #### What's Changed - Detector-Competition-Fix: Fix/Remove Happi Detection & Verification by [@​lc](https://togithub.com/lc) in [https://github.com/trufflesecurity/trufflehog/pull/2003](https://togithub.com/trufflesecurity/trufflehog/pull/2003) - Detector-Competition-Fix: Fix/Remove Flowdock detector by [@​lc](https://togithub.com/lc) in [https://github.com/trufflesecurity/trufflehog/pull/2004](https://togithub.com/trufflesecurity/trufflehog/pull/2004) - Add temp directory management by [@​codevbus](https://togithub.com/codevbus) in [https://github.com/trufflesecurity/trufflehog/pull/1878](https://togithub.com/trufflesecurity/trufflehog/pull/1878) - Fix binary handling by [@​bill-rich](https://togithub.com/bill-rich) in [https://github.com/trufflesecurity/trufflehog/pull/1999](https://togithub.com/trufflesecurity/trufflehog/pull/1999) - Detector-Competition-Fix: Fix SurveyBot Verification by [@​lc](https://togithub.com/lc) in [https://github.com/trufflesecurity/trufflehog/pull/1948](https://togithub.com/trufflesecurity/trufflehog/pull/1948) - Detector-Competition-Feat: Added BetterStack API token detector by [@​fumblehool](https://togithub.com/fumblehool) in [https://github.com/trufflesecurity/trufflehog/pull/1987](https://togithub.com/trufflesecurity/trufflehog/pull/1987) - Detector-Competition-Feat: Added ZeroTier API token detector by [@​fumblehool](https://togithub.com/fumblehool) in [https://github.com/trufflesecurity/trufflehog/pull/1988](https://togithub.com/trufflesecurity/trufflehog/pull/1988) - Detector-Competition-Feat: Added AppOptics API token detector by [@​fumblehool](https://togithub.com/fumblehool) in [https://github.com/trufflesecurity/trufflehog/pull/1989](https://togithub.com/trufflesecurity/trufflehog/pull/1989) - Detector-Competition-Feat: Add Metabase Session Secret Detector by [@​fumblehool](https://togithub.com/fumblehool) in [https://github.com/trufflesecurity/trufflehog/pull/1902](https://togithub.com/trufflesecurity/trufflehog/pull/1902) - Add Coinbase Wallet-as-a-Service detector by [@​rgmz](https://togithub.com/rgmz) in [https://github.com/trufflesecurity/trufflehog/pull/1895](https://togithub.com/trufflesecurity/trufflehog/pull/1895) - Chore(deps): Bump google.golang.org/grpc from 1.56.2 to 1.56.3 by [@​dependabot](https://togithub.com/dependabot) in [https://github.com/trufflesecurity/trufflehog/pull/2009](https://togithub.com/trufflesecurity/trufflehog/pull/2009) - Update module github.com/TheZeroSlave/zapsentry to v1.19.0 by [@​renovate](https://togithub.com/renovate) in [https://github.com/trufflesecurity/trufflehog/pull/2012](https://togithub.com/trufflesecurity/trufflehog/pull/2012) - Update module cloud.google.com/go/secretmanager to v1.11.3 by [@​renovate](https://togithub.com/renovate) in [https://github.com/trufflesecurity/trufflehog/pull/2011](https://togithub.com/trufflesecurity/trufflehog/pull/2011) **Full Changelog**: trufflesecurity/trufflehog@v3.60.4...v3.61.0 </details> --- ### Configuration 📅 **Schedule**: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined). 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR has been generated by [Mend Renovate](https://www.mend.io/free-developer-tools/renovate/). View repository job log [here](https://developer.mend.io/github/matter-labs/vault-auth-tee). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiIzNy4zMS41IiwidXBkYXRlZEluVmVyIjoiMzcuMzEuNSIsInRhcmdldEJyYW5jaCI6Im1haW4ifQ==--> Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
](https://renovatebot.com){kind=link}
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Description:
PR adds detector for https://www.metabase.com/
As per the authentication flow, user will follow https://www.metabase.com/learn/administration/metabase-api#getting-started-with-the-metabase-api to generate Session Token.
After this, this token is passed in Header as
X-Metabase-Session.Verification: