Skip to content

Commit b2c6e51

Browse files
securenesssecureness
committed
new plugin: npmjs registry secret detector \& validator
1 parent 061de13 commit b2c6e51

File tree

27 files changed

+796
-178
lines changed

27 files changed

+796
-178
lines changed

‎binary/proto/scan_result.proto‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -698,6 +698,7 @@ message SecretData {
698698
OnePasswordRecoveryCode onepassword_recovery_code = 41;
699699
OnePasswordConnectToken onepassword_connect_token = 42;
700700
Pgpass pgpass = 43;
701+
NpmJSAccessToken npmjs_access_token = 44;
701702
}
702703

703704
message GCPSAK {
@@ -805,6 +806,10 @@ message SecretData {
805806
string key = 1;
806807
}
807808

809+
message NpmJSAccessToken {
810+
string Token = 1;
811+
}
812+
808813
message GithubAppRefreshToken {
809814
string token = 1;
810815
}

‎binary/proto/scan_result_go_proto/scan_result.pb.go‎

Lines changed: 206 additions & 140 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎binary/proto/secret.go‎

Lines changed: 21 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -39,6 +39,7 @@ import (
3939
veleshashicorpvault "github.com/google/osv-scalibr/veles/secrets/hashicorpvault"
4040
veleshashicorpcloudplatform "github.com/google/osv-scalibr/veles/secrets/hcp"
4141
"github.com/google/osv-scalibr/veles/secrets/huggingfaceapikey"
42+
"github.com/google/osv-scalibr/veles/secrets/npmjsaccesstoken"
4243
velesonepasswordkeys "github.com/google/osv-scalibr/veles/secrets/onepasswordkeys"
4344
velesopenai "github.com/google/osv-scalibr/veles/secrets/openai"
4445
velesperplexity "github.com/google/osv-scalibr/veles/secrets/perplexityapikey"
@@ -115,6 +116,8 @@ func velesSecretToProto(s veles.Secret) (*spb.SecretData, error) {
115116
return dockerHubPATToProto(t), nil
116117
case velesdigitalocean.DigitaloceanAPIToken:
117118
return digitaloceanAPIKeyToProto(t), nil
119+
case npmjsaccesstoken.NpmJSAccessToken:
120+
return npmJSAccessTokenToProto(t), nil
118121
case velesslacktoken.SlackAppConfigAccessToken:
119122
return slackAppConfigAccessTokenToProto(t), nil
120123
case velesslacktoken.SlackAppConfigRefreshToken:
@@ -217,6 +220,16 @@ func digitaloceanAPIKeyToProto(s velesdigitalocean.DigitaloceanAPIToken) *spb.Se
217220
}
218221
}
219222

223+
func npmJSAccessTokenToProto(s npmjsaccesstoken.NpmJSAccessToken) *spb.SecretData {
224+
return &spb.SecretData{
225+
Secret: &spb.SecretData_NpmjsAccessToken{
226+
NpmjsAccessToken: &spb.SecretData_NpmJSAccessToken{
227+
Token: s.Token,
228+
},
229+
},
230+
}
231+
}
232+
220233
func slackAppLevelTokenToProto(s velesslacktoken.SlackAppLevelToken) *spb.SecretData {
221234
return &spb.SecretData{
222235
Secret: &spb.SecretData_SlackAppLevelToken_{
@@ -717,6 +730,8 @@ func velesSecretToStruct(s *spb.SecretData) (veles.Secret, error) {
717730
return gitlabPATToStruct(s.GetGitlabPat()), nil
718731
case *spb.SecretData_Digitalocean:
719732
return digitalOceanAPITokenToStruct(s.GetDigitalocean()), nil
733+
case *spb.SecretData_NpmjsAccessToken:
734+
return npmJSAccessTokenToStruct(s.GetNpmjsAccessToken()), nil
720735
case *spb.SecretData_SlackAppConfigRefreshToken_:
721736
return slackAppConfigRefreshTokenToStruct(s.GetSlackAppConfigRefreshToken()), nil
722737
case *spb.SecretData_SlackAppConfigAccessToken_:
@@ -834,6 +849,12 @@ func digitalOceanAPITokenToStruct(kPB *spb.SecretData_DigitalOceanAPIToken) vele
834849
}
835850
}
836851

852+
func npmJSAccessTokenToStruct(kPB *spb.SecretData_NpmJSAccessToken) npmjsaccesstoken.NpmJSAccessToken {
853+
return npmjsaccesstoken.NpmJSAccessToken{
854+
Token: kPB.GetToken(),
855+
}
856+
}
857+
837858
func slackAppLevelTokenToStruct(kPB *spb.SecretData_SlackAppLevelToken) velesslacktoken.SlackAppLevelToken {
838859
return velesslacktoken.SlackAppLevelToken{
839860
Token: kPB.GetToken(),

‎common/windows/registry/live.go‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -72,7 +72,7 @@ func (o *LiveRegistry) Close() error {
7272
return nil
7373
}
7474

75-
// LiveKey wraps a winregistry.Key to provide an implementation of the registry.Key interface.
75+
// LiveKey wraps a winregistry.Token to provide an implementation of the registry.Key interface.
7676
type LiveKey struct {
7777
key *winregistry.Key
7878
name string

‎detector/cve/untested/cve202011978/cve202011978.go‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -295,7 +295,7 @@ func CheckForBashTask(ctx context.Context, airflowIP string, airflowServerPort i
295295
}
296296

297297
if _, exists := data["env"]; !exists {
298-
log.Infof("Key 'env' does not exist in the JSON data")
298+
log.Infof("Token 'env' does not exist in the JSON data")
299299
return false
300300
}
301301

@@ -369,14 +369,14 @@ func triggerAndWaitForDAG(ctx context.Context, airflowIP string, airflowServerPo
369369

370370
// Check for the existence of "message" and "execution_date"
371371
if _, messagePresent := resBody["message"]; !messagePresent {
372-
log.Errorf("Key 'message' not found in response body")
372+
log.Errorf("Token 'message' not found in response body")
373373
return false
374374
}
375375

376376
log.Infof("\"%s\"\n", resBody["message"])
377377

378378
if _, execDatePresent := resBody["execution_date"]; !execDatePresent {
379-
log.Errorf("Key 'execution_date' not found in response body")
379+
log.Errorf("Token 'execution_date' not found in response body")
380380
return false
381381
}
382382

‎docs/supported_inventory_types.md‎

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -109,8 +109,8 @@ See the docs on [how to add a new Extractor](/docs/new_extractor.md).
109109

110110
### Secrets
111111

112-
| Type | Extractor Plugin |
113-
|-----------------------------------|--------------------------------------|
112+
| Type | Extractor Plugin |
113+
|---------------------------------------------|--------------------------------------|
114114
| Anthropic API key | `secrets/anthropicapikey` |
115115
| Azure Token | `secrets/azuretoken` |
116116
| DigitalOcean API key | `secrets/digitaloceanapikey` |
@@ -131,6 +131,7 @@ See the docs on [how to add a new Extractor](/docs/new_extractor.md).
131131
| 1Password Secret Key | `secrets/onepasswordsecretkey` |
132132
| 1Password Service Token | `secrets/onepasswordservicetoken` |
133133
| 1Password Recovery Code | `secrets/onepasswordrecoverycode` |
134+
| npmjs Registry Access Tokens | `secrets/npmjsaccesstoken` |
134135
| OpenAI API key | `secrets/openai` |
135136
| Perplexity API key | `secrets/perplexityapikey` |
136137
| Postgres pgpass file | `secrets/pgpass` |

‎enricher/enricherlist/list.go‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -42,6 +42,7 @@ import (
4242
"github.com/google/osv-scalibr/veles/secrets/hashicorpvault"
4343
"github.com/google/osv-scalibr/veles/secrets/hcp"
4444
"github.com/google/osv-scalibr/veles/secrets/huggingfaceapikey"
45+
"github.com/google/osv-scalibr/veles/secrets/npmjsaccesstoken"
4546
"github.com/google/osv-scalibr/veles/secrets/openai"
4647
"github.com/google/osv-scalibr/veles/secrets/perplexityapikey"
4748
"github.com/google/osv-scalibr/veles/secrets/postmanapikey"
@@ -83,6 +84,7 @@ var (
8384
fromVeles(anthropicapikey.NewWorkspaceValidator(), "secrets/anthropicapikeyworkspacevalidate", 0),
8485
fromVeles(anthropicapikey.NewModelValidator(), "secrets/anthropicapikeymodelvalidate", 0),
8586
fromVeles(digitaloceanapikey.NewValidator(), "secrets/digitaloceanapikeyvalidate", 0),
87+
fromVeles(npmjsaccesstoken.NewValidator(), "secrets/npmjsaccesstoken", 0),
8688
fromVeles(slacktoken.NewAppLevelTokenValidator(), "secrets/slackappleveltokenvalidate", 0),
8789
fromVeles(slacktoken.NewAppConfigRefreshTokenValidator(), "secrets/slackconfigrefreshtokenvalidate", 0),
8890
fromVeles(slacktoken.NewAppConfigAccessTokenValidator(), "secrets/slackconfigaccesstokenvalidate", 0),

‎extractor/filesystem/list/list.go‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -110,6 +110,7 @@ import (
110110
"github.com/google/osv-scalibr/veles/secrets/hashicorpvault"
111111
"github.com/google/osv-scalibr/veles/secrets/hcp"
112112
"github.com/google/osv-scalibr/veles/secrets/huggingfaceapikey"
113+
"github.com/google/osv-scalibr/veles/secrets/npmjsaccesstoken"
113114
"github.com/google/osv-scalibr/veles/secrets/onepasswordkeys"
114115
"github.com/google/osv-scalibr/veles/secrets/openai"
115116
"github.com/google/osv-scalibr/veles/secrets/perplexityapikey"
@@ -274,6 +275,7 @@ var (
274275
{azuretoken.NewDetector(), "secrets/azuretoken", 0},
275276
{azurestorageaccountaccesskey.NewDetector(), "secrets/azurestorageaccountaccesskey", 0},
276277
{digitaloceanapikey.NewDetector(), "secrets/digitaloceanapikey", 0},
278+
{npmjsaccesstoken.NewDetector(), "secrets/npmjsaccesstoken", 0},
277279
{slacktoken.NewAppConfigAccessTokenDetector(), "secrets/slackappconfigaccesstoken", 0},
278280
{slacktoken.NewAppConfigRefreshTokenDetector(), "secrets/slackappconfigrefreshtoken", 0},
279281
{slacktoken.NewAppLevelTokenDetector(), "secrets/slackappleveltoken", 0},

‎veles/secrets/anthropicapikey/helpers.go‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -88,10 +88,10 @@ func validateAPIKey(ctx context.Context, config *ValidationConfig, key string, e
8888
// Check response status
8989
switch res.StatusCode {
9090
case http.StatusOK:
91-
// Key is valid
91+
// Token is valid
9292
return veles.ValidationValid, nil
9393
case http.StatusUnauthorized:
94-
// Key is invalid
94+
// Token is invalid
9595
return veles.ValidationInvalid, nil
9696
case http.StatusTooManyRequests:
9797
// Rate limited - key is likely valid but we're being throttled.

‎veles/secrets/anthropicapikey/model_validator_test.go‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -41,7 +41,7 @@ func mockAnthropicModelServer(t *testing.T, expectedKey string, statusCode int,
4141

4242
// Check headers
4343
if r.Header.Get("X-Api-Key") != expectedKey {
44-
t.Errorf("expected X-Api-Key: %s, got: %s", expectedKey, r.Header.Get("X-Api-Key"))
44+
t.Errorf("expected X-Api-Token: %s, got: %s", expectedKey, r.Header.Get("X-Api-Key"))
4545
}
4646
if r.Header.Get("Anthropic-Version") != "2023-06-01" {
4747
t.Errorf("expected Anthropic-Version: 2023-06-01, got: %s", r.Header.Get("Anthropic-Version"))

0 commit comments

Comments
 (0)