[Detector]-Detector for tableau personal access token #4261
Conversation
|
|
…o detector/tableau-personal-access-token
…ub.com/SyedAliHamad/trufflehog into detector/tableau-personal-access-token
|
Description: Detection Strategy: The detector identifies potential findings by looking for a combination of components: Token names using flexible patterns (tableau_token_name, pat_name, personal_access_token_name, etc.) It intelligently creates findings for all possible combinations of token names and secrets found within a given data chunk, testing against discovered URLs. Format Validation: The detector includes comprehensive secret format validation, ensuring tokens match Tableau's specific structure (base64-encoded prefix with colon separator and alphanumeric suffix) to minimize false positives. API Verification: A robust verification function validates found credentials using Tableau's REST API authentication endpoint (/api/3.26/auth/signin). The verifier correctly distinguishes between: Valid credential pairs (200 OK with authentication token) Comprehensive Testing: The detector is supported by a full test suite ensuring reliability: Pattern Tests: Validates regex patterns and format validation logic against various credential formats |
SyedAliHamad
force-pushed
the
detector/tableau-personal-access-token
branch
from
c96fa18 to
743acc1
Compare
| case http.StatusUnauthorized, http.StatusBadRequest, http.StatusForbidden: | ||
| return false, extraData, nil |
There was a problem hiding this comment.
Could you please confirm the expected behavior of this API?
Typically, when an authenticated API is accessed with incorrect credentials, it returns a 401 Unauthorized. On the other hand, if the credentials are valid but do not have the necessary permissions to access a specific resource, the response is usually 403 Forbidden, indicating that the credentials are valid, but access is denied.
In our current implementation, we're treating both 401 and 403 as unverified (i.e., returning false for the verification status). I just want to confirm if this is the correct approach or if we should be handling them differently.
There was a problem hiding this comment.
Great observation. You’re right that typically 403 is handled differently, but since this is just a sign-in API, I don’t believe we’d ever encounter a scenario where valid credentials result in a 403. Will have another look at the docs.
|
Apart from Kashif's feedback, looks good. |
| invalidTableauURL = "prod.tabeau.com" | ||
| ) | ||
|
|
||
| func TestTableau_Pattern(t *testing.T) { |
There was a problem hiding this comment.
Excellent work on test coverage ❤️
…ub.com/SyedAliHamad/trufflehog into detector/tableau-personal-access-token
SyedAliHamad
force-pushed
the
detector/tableau-personal-access-token
branch
from
60d0242 to
3123533
Compare
|
Thank you for patiently addressing all my comments. Really appreciate it! |
…y#4261) * add detector for tableau personal access token * add test for tableau detector * removed unnecessary checks * add cloud endpoint for tableau * cleanup: simplify map copying with maps.Copy * resolve comments * added correct detector type for tableau * updated tableau PAT key and corrected integration tests * resolved comments * updated test cases * resolved comments * fixed integration tests * removed redundant validation * resolved false positive issue * updated regex for pat-name * resolved comments * update regex for better token name extraction * simplify prefix regex for tableau pat name * merged main into origin/detector/tableau-personal-access-token --------- Co-authored-by: Amaan Ullah <[email protected]>
Description:
This PR adds new detector for Tableau Personal Access Tokens
Checklist:
make test-community)?make lintthis requires golangci-lint)?