[INS-399] Added Bitbucket data center(on prem) PAT detector#4883
[INS-399] Added Bitbucket data center(on prem) PAT detector#4883MuneebUllahKhan222 wants to merge 2 commits intotrufflesecurity:mainfrom
Conversation
MuneebUllahKhan222
changed the title
![cursor[bot]](https://avatars.githubusercontent.com/in/1210556?s=60&v=4){kind=small}
There was a problem hiding this comment.
Cursor Bugbot has reviewed your changes and found 1 potential issue.
Reviewed by Cursor Bugbot for commit 1ab3d98. Configure here.
| // consisting of both alphanumeric and some special character like +, _, @ and etc | ||
| userPat = regexp.MustCompile(`\b(BBDC-[A-Za-z0-9+/@_-]{40,50})(?:[^A-Za-z0-9+/@_-]|$)`) | ||
|
|
||
| urlPat = regexp.MustCompile(detectors.PrefixRegex([]string{"atlassian", "bitbucket"}) + `(https://[a-zA-Z0-9.-]+(?::\d+)?)`) |
There was a problem hiding this comment.
URL regex excludes HTTP for on-prem instances
Medium Severity
The urlPat regex hardcodes https:// for URL auto-discovery, but this detector specifically targets Bitbucket Data Center (on-prem) instances, which commonly run over plain http://. Tokens near http:// Bitbucket URLs won't be paired with an endpoint and will be silently dropped (producing zero results even though a valid token was found).
Reviewed by Cursor Bugbot for commit 1ab3d98. Configure here.
There was a problem hiding this comment.
Yeah this is something that I would like the opinion of the reviewers on. It does make sense to make it detect http url as-well but idk how secure it is and when it will cause the potential risk of SSRF attacks.
There was a problem hiding this comment.
I agree with the bot on this. By not including http URLS, we may miss on potential matches. Regarding the security concern, we have many detectors like Portainer, OpenVPN, HashiCorp Vault, Metabase, LiveAgent etc that support on-prem instances and detect HTTP based URLs too, so I guess it's fine.
| // Bitbucket pat start with BBDC- prefix | ||
| // and are usually between the length of 40-50 character | ||
| // consisting of both alphanumeric and some special character like +, _, @ and etc | ||
| userPat = regexp.MustCompile(`\b(BBDC-[A-Za-z0-9+/@_-]{40,50})(?:[^A-Za-z0-9+/@_-]|$)`) |
There was a problem hiding this comment.
Are we sure that the length is variable? I'm asking because for JIra the length was fixed.
| ArtifactoryReferenceToken = 1042; | ||
| DatadogApikey = 1043; | ||
| ShopifyOAuth = 1044; | ||
| BitbucketDataCenter=1045; |
There was a problem hiding this comment.
nit: can we have consistent formatting here?
| var _ detectors.EndpointCustomizer = (*Scanner)(nil) | ||
|
|
||
| var ( | ||
| defaultClient = detectors.DetectorHttpClientWithNoLocalAddresses |
There was a problem hiding this comment.
We may want to switch this to detectors.SaneHttpClient if we agree on detecting http URLs.
There was a problem hiding this comment.
Update: It seems detectors.DetectorHttpClientWithLocalAddresses is a better option
mustansir14
left a comment
mustansir14
left a comment
There was a problem hiding this comment.
Approving to unblock, but it would be great if you could incorporate those comments.
2 participants
Description
This PR adds the Bitbucket Data Center Personal Access Token (PAT) Detector for TruffleHog.
It scans for Bitbucket Data Center (on-prem) personal access tokens (prefix
BBDC-) and optionally verifies them against theOn-prem Bitbucket REST API.
Regex:
\b(BBDC-[A-Za-z0-9+/@_-]{40,50})\bIn addition to detecting tokens, the detector attempts to extract associated Bitbucket endpoints from nearby context (e.g., URLs containing
atlassianorbitbucket) to enable accurate verification and also allows the user to configure the verification endpoint.Verification
For verification, we use the Bitbucket Data Center REST API:
GET /rest/api/1.0/projects?limit=1A request is sent to the detected Bitbucket base URL with the token in the header:
This endpoint is part of the standard Bitbucket Data Center API and is read-only, making it safe for verification. It does not perform any destructive actions and only attempts to fetch a minimal list of projects.
Corpora Test
The detector does not appear in the list.
Checklist:
make test-community)?make lintthis requires golangci-lint)?Note
Medium Risk
Adds a new detector that extracts host URLs from surrounding text and performs outbound verification requests against Bitbucket Data Center instances, which could affect scan behavior and network access. Changes also extend the shared
DetectorTypeenum, requiring downstream compatibility with the new value.Overview
Adds a new
bitbucketdatacenterdetector that findsBBDC-personal access tokens, associates them with discovered or configured Bitbucket base URLs, and (optionally) verifies candidates viaGET /rest/api/1.0/projects?limit=1using a bearer token.Extends
detector_type.proto/generated code with a newDetectorType_BitbucketDataCenterenum value and includes unit tests covering token/url matching and verification outcomes (200/401/unexpected status/timeout) using mocked HTTP.Reviewed by Cursor Bugbot for commit 1ab3d98. Bugbot is set up for automated code reviews on this repo. Configure here.