Merge pull request #84 from gladstone-9/BasicAuth_checker

For API Token Scanner, SCAN_FUNCTIONS=1 by default and updated description.

Author: gladstone-9

crates/forge_analyzer/src/checkers.rs

@@ -1203,10 +1203,10 @@ impl IntoVuln for AuthHeaderVuln {
             AuthHeaderVulnKind::BasicAuth => Vulnerability {
                 check_name: format!("Custom-Check-Basic-Auth-{}", self.api_call),
                 description: format!(
-                    "HTTP Basic authentication detected in {} {} call(s).",
+                    "Our API Token Scanner has identified in {} {} call(s) that your app is currently using Atlassian API tokens for authentication. Under the [updated guidance](https://www.atlassian.com/blog/developer/building-secure-and-scalable-integrations-our-guidance-for-third-party-apps) on app authentication ([FAQ](https://developer.atlassian.com/platform/marketplace/security-requirements-faq/#are-apps-prohibited-from-collecting-atlassian-user-account-api-tokens-even-after-taking-the-user-s-consent-) page) apps collecting customer API tokens are now required to migrate to [Forge authentication](https://developer.atlassian.com/platform/forge/security/#simple-and-secure-authentication) to ensure alignment with cloud app [security requirements](https://developer.atlassian.com/platform/marketplace/security-requirements/#security-requirements-for-cloud-apps). Refer to this [announcement](https://community.developer.atlassian.com/t/reminder-migrate-from-using-api-tokens-to-officially-supported-authentication-for-atlassian-apps-integrations/97221) for more details.",
                     count, self.api_call
                 ),
-                recommendation: "Use supported authentication mechanisms (such as OAuth 2.0 or Forge authentication). If you anticipate any blockers or require support, contact the Atlassian Ecosystem Security team.",
+                recommendation: "Use supported authentication mechanisms (such as OAuth 2.0 or Forge authentication). If you anticipate any blockers or require support, contact the Atlassian Ecosystem Support.",
                 proof: format!(
                     "Basic Authorization header found: {}",
                     proof_lines.join("; ")
@@ -1220,10 +1220,10 @@ impl IntoVuln for AuthHeaderVuln {
             AuthHeaderVulnKind::BearerAdmin => Vulnerability {
                 check_name: "Bearer-Admin".to_string(),
                 description: format!(
-                    "Bearer token used with Atlassian admin API in {} {} call(s).",
+                    "Our API Token Scanner has identified in {} {} call(s) that your app is currently using Atlassian API tokens for authentication. Under the [updated guidance](https://www.atlassian.com/blog/developer/building-secure-and-scalable-integrations-our-guidance-for-third-party-apps) on app authentication ([FAQ](https://developer.atlassian.com/platform/marketplace/security-requirements-faq/#are-apps-prohibited-from-collecting-atlassian-user-account-api-tokens-even-after-taking-the-user-s-consent-) page) apps collecting customer API tokens are now required to migrate to [Forge authentication](https://developer.atlassian.com/platform/forge/security/#simple-and-secure-authentication) to ensure alignment with cloud app [security requirements](https://developer.atlassian.com/platform/marketplace/security-requirements/#security-requirements-for-cloud-apps). Refer to this [announcement](https://community.developer.atlassian.com/t/reminder-migrate-from-using-api-tokens-to-officially-supported-authentication-for-atlassian-apps-integrations/97221) for more details.",
                     count, self.api_call
                 ),
-                recommendation: "Use supported authentication mechanisms (such as OAuth 2.0 or Forge authentication). If you anticipate any blockers or require support, contact the Atlassian Ecosystem Security team.",
+                recommendation: "Use supported authentication mechanisms (such as OAuth 2.0 or Forge authentication). If you anticipate any blockers or require support, contact the Atlassian Ecosystem Support.",
                 proof: format!(
                     "Bearer token on Atlassian admin API found: {}",
                     proof_lines.join("; ")

crates/fsrt/src/main.rs

@@ -95,7 +95,7 @@ pub struct Args {
     scanners: Option<String>,
 
     /// Scan all function/closure bodies for auth-header issues, not just entrypoint-reachable code.
-    #[arg(long)]
+    #[arg(long, default_value_t = true)]
     scan_functions: bool,
 
     /// The directory to scan. Assumes there is a `manifest.ya?ml` file in the top level

crates/fsrt/src/test.rs

@@ -930,31 +930,6 @@ fn basic_auth_on_platform_api_shims() {
     }
 }
 
-// Unreachable class methods (not on an entry-point call chain) must not be
-// flagged by default — the analyzer only follows reachable code.
-#[test]
-fn basic_auth_in_unreachable_class_method_not_flagged() {
-    let src = "// src/index.jsx
-        import ForgeUI, { render, Macro, Fragment, Text } from '@forge/ui';
-        import { requestJira, route } from '@forge/api';
-
-        export class BackupAdapter {
-            async generateBackup(authKey) {
-                await requestJira(route`/rest/backup/1/export/runbackup`, {
-                    method: 'POST',
-                    headers: { Authorization: `Basic ${authKey}`, Accept: 'application/json' },
-                });
-            }
-        }
-
-        function App() { return <Fragment><Text>Hello</Text></Fragment>; }
-        export const run = render(<Macro app={<App />} />);";
-
-    let result = scan_directory_test(MockForgeProject::files_from_string(src));
-    assert!(result.contains_basic_auth_vuln(0));
-    assert!(result.contains_secret_vuln(0));
-}
-
 #[test]
 // Disabling test due to SSA Form fix changes.
 fn secret_vuln_fetch_header_reassigned() {