diff --git a/detect_secrets/plugins/telegram_token.py b/detect_secrets/plugins/telegram_token.py index 1054c64b..32869aba 100644 --- a/detect_secrets/plugins/telegram_token.py +++ b/detect_secrets/plugins/telegram_token.py @@ -15,7 +15,7 @@ class TelegramBotTokenDetector(RegexBasedDetector): denylist = [ # refs https://core.telegram.org/bots/api#authorizing-your-bot - re.compile(r'\d{8,10}:[0-9A-Za-z_-]{35}'), + re.compile(r'^\d{8,10}:[0-9A-Za-z_-]{35}$'), ] def verify(self, secret: str) -> VerifiedResult: # pragma: no cover diff --git a/tests/plugins/telegram_token_test.py b/tests/plugins/telegram_token_test.py index 74af380f..a1df2d90 100644 --- a/tests/plugins/telegram_token_test.py +++ b/tests/plugins/telegram_token_test.py @@ -8,11 +8,12 @@ class TestTelegramTokenDetector: @pytest.mark.parametrize( 'payload, should_flag', [ - ('bot110201543:AAHdqTcvCH1vGWJxfSe1ofSAs0K5PALDsaw', True), + ('bot110201543:AAHdqTcvCH1vGWJxfSe1ofSAs0K5PALDsaw', False), ('110201543:AAHdqTcvCH1vGWJxfSe1ofSAs0K5PALDsaw', True), ('7213808860:AAH1bjqpKKW3maRSPAxzIU-0v6xNuq2-NjM', True), ('foo:AAH1bjqpKKW3maRSPAxzIU-0v6xNuq2-NjM', False), ('foo', False), + ('arn:aws:sns:aaa:111122223333:aaaaaaaaaaaaaaaaaaassssssddddddddddddd', False), ], ) def test_analyze(self, payload, should_flag):