Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

fix(telegram_bot_token): Regex must match just bot tokens #878

Merged
merged 5 commits into from
Oct 7, 2024
Merged

fix(telegram_bot_token): Regex must match just bot tokens #878

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
5 commits
Select commit Hold shift + click to select a range
efc122a
fix(telegram_bot_token): Regex must match just bot tokens
jfagoagas Sep 3, 2024
5bafc1d
test(telegram_bot_token): AWS ARN should not match
jfagoagas Sep 3, 2024
41f7746
fix(telegram_bot_token): `bot` should not be in the token
jfagoagas Sep 3, 2024
2cc49a5
fix(test): something with `^bot` should not match
jfagoagas Sep 3, 2024
fe73707
fix: format trailing comma
jfagoagas Sep 13, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion detect_secrets/plugins/telegram_token.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -15,7 +15,7 @@ class TelegramBotTokenDetector(RegexBasedDetector):

denylist = [
# refs https://core.telegram.org/bots/api#authorizing-your-bot
re.compile(r'\d{8,10}:[0-9A-Za-z_-]{35}'),
re.compile(r'^\d{8,10}:[0-9A-Za-z_-]{35}$'),
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Reading the Telegram docs, I found that

The token looks something like 123456:ABC-DEF1234ghIkl-zyx57W2v1u123ew11

which I assume means there's a specific format in terms of which characters will be upper case and which will be lower case. If that's correct, would you mind making the regex more accurate?

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Hello @lorenzodb1 I'm not sure if that's accurate since they also states this in their documentation

The token is a string, like 110201543:AAHdqTcvCH1vGWJxfSeofSAs0K5PALDsaw, which is required to authorize the bot and send requests to the Bot API. Keep your token secure and store it safely, it can be used by anyone to control your bot.

https://core.telegram.org/bots/features#creating-a-new-bot

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The regex configured is the same as Trufflehog's https://github.com/trufflesecurity/trufflehog/blob/57802abf5276961426482ace808057016c714958/pkg/detectors/telegrambottoken/telegrambottoken.go#L27

]

def verify(self, secret: str) -> VerifiedResult: # pragma: no cover
Expand Down
3 changes: 2 additions & 1 deletion tests/plugins/telegram_token_test.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -8,11 +8,12 @@ class TestTelegramTokenDetector:
@pytest.mark.parametrize(
'payload, should_flag',
[
('bot110201543:AAHdqTcvCH1vGWJxfSe1ofSAs0K5PALDsaw', True),
('bot110201543:AAHdqTcvCH1vGWJxfSe1ofSAs0K5PALDsaw', False),
('110201543:AAHdqTcvCH1vGWJxfSe1ofSAs0K5PALDsaw', True),
('7213808860:AAH1bjqpKKW3maRSPAxzIU-0v6xNuq2-NjM', True),
('foo:AAH1bjqpKKW3maRSPAxzIU-0v6xNuq2-NjM', False),
('foo', False),
('arn:aws:sns:aaa:111122223333:aaaaaaaaaaaaaaaaaaassssssddddddddddddd', False),
],
)
def test_analyze(self, payload, should_flag):
Expand Down
Loading