GitHub/trufflehog
1
0
Fork 0
mirror of https://github.com/trufflesecurity/trufflehog.git synced 2026-06-15 13:24:37 +00:00
Code Issues Packages Projects Releases Wiki Activity
4,379 Commits 228 Branches 350 Tags
hackathon/ocr-handler
Commit Graph
40 Commits
Author SHA1 Message Date
Shahzad Haider e08744c0bc added prefix to the github old detector regex pattern (#4494) 2025-10-15 08:23:34 -07:00
trufflesteeeve 466da5b0bb Pre-filter GitHub v1 findings to prevent large numbers of validation requests (#4468) 2025-09-18 09:53:55 -04:00
Kashif KhanandAmaan Ullah 6dd65a5156 Ignore known common prefix matches for Github V1 detector (#4379) 
Co-authored-by: Amaan Ullah <aman.ullah.jalal@trufflesec.com>
 2025-08-27 11:25:48 +05:00
Kashif Khan d7e295aa49 updated github v1 detector to ignore matches with known common prefixes (#4329) 2025-07-29 07:06:57 -07:00
Richard Gomez 8723f857a2 chore(detectors): remove match len check (#2746) 2025-01-15 10:33:53 -06:00
Abdul Basit c24b4d5b30 [Fix] detector's integration tests starting with alphabet 'g' (#3765) 
* fix geocodio detector test

* fix github detector test

* fix githubapp detector test

* fix gitlab v2 detector

* fix godaddy v1 detector test
 2024-12-11 09:23:02 -08:00
Kashif Khan 3339e29834 added pattern test cases for F, G and H alphabet detectors (#3590) 
* added pattern test cases for f alphabet detectors

* added pattern test cases for g alphabet detectors

* fixed test cases

* added pattern test cases for h alphabet detectors

* updated with main
 2024-11-13 07:51:34 -08:00
Richard Gomez 6c823e1d60 Add UUIDs to false positive checker (#2976) 
* feat(detectors): add uuid false positives

* feat(detectors): use map for false positives
 2024-11-07 08:27:46 -08:00
dylanTruffleDylan AyreyDustin Decker
 		0f427b3c6a Adding Descriptions (#3258) 
* adding AI generated descriptions of the key types and their capabilities

* removing empty file

* Update abbysale.go

* update to interface

* fixes

* fix

* small cleanup

---------

Co-authored-by: Dylan Ayrey <dxa4481@rit.edu>
Co-authored-by: Dustin Decker <dustin@trufflesec.com>
 2024-09-24 16:10:16 -07:00
Kashif KhanandMiccah Castorina 4b6957df66 Endpoint customizer refresh (#3308) 
* Refresh EndpointCustomizer for more explicit configuration

Also add CloudProvider interface.

* WIP: Update EndpointSetter

* Updated detectors with new endpoint customizer

* Fixed linter

* Added check for appending cloud endpoints

---------

Co-authored-by: Miccah Castorina <m.castorina93@gmail.com>
 2024-09-24 11:41:05 -05:00
Miccah 9d089c2188 [analyze] Implement Analyzer interface for github (#3110) 
* [analyze] Implement Analyzer interface for github

* Make github repo and user enumeration configurable

* Add AnalysisInfo to github detector

* Use AnalyzeAndPrintPermissions from the CLI
 2024-07-26 14:47:03 -07:00
Richard Gomez 2964b3b2d2 feat(detectors): log falsepositive reason (#2969) 2024-06-14 08:26:05 -07:00
Abdul Basit 7025b0aa35 added email and location in metadata. (#2850) 2024-05-15 12:36:22 -05:00
Cody Rose 2f7029bc4d Expose detector-specific false positive logic (#2743) 
This PR:

Creates an optional interface that detectors can use to customize their false positive detection
Implements this interface on detectors that have custom logic
In most cases this "custom logic" is simply a no-op because the detector does not participate in false positive detection
Eliminates inline (old-style) false positive exclusion in a few detectors that #2643 missed
 2024-04-30 16:10:26 -04:00
Dustin Decker 14e44db2be Move detectors.IsKnownFalsePositive from the detectors and into the engine (#2643) 
* Remove detectors.IsKnownFalsePositive from detectors

* Centralize false positive removal in engine

* Don't apply fp filtering on custom regex to preserve previous behavior.

* fix empty branch

* update excludes

* update filtering

* Add result flag option and exclude some detectors
 2024-04-22 15:18:04 -07:00
Richard Gomez fd7e7e6e29 fix(github): response can be nil (#2583) 2024-03-16 01:12:44 -07:00
āh̳̕mͭͭͨͩ̐e̘ͬ́͋ͬ̊̓͂d 2ef7a4a49f pull out verification logic from github detectors (#2554) 
* pull out verification logic from github detectors

* deduplicate verify github logic

* pull out nil check

* return nil instead of empty struct

* skip gh old test bc we can't make new tokens
 2024-03-15 15:00:45 -04:00
āh̳̕mͭͭͨͩ̐e̘ͬ́͋ͬ̊̓͂d d7a33055ad add version to extra data + moving existing versioned detectors into subdirectory format (#2471) 
* moving existing versioned detectors into subdirectory format

* update docs for adding version number to extra data

* nits
 2024-03-07 15:48:27 -05:00
ahrav e44802a31d [feat] - Replace regexp pkg w/ go-re2 in detectors (#2324) 
* update detectors to use go-re regex library replacement

* update go mod and sum

* add tests with invalid utf-8

* revert
 2024-01-23 13:16:22 -08:00
Richard Gomez 97afd570ae feat(github): update extradata (#2219) 2023-12-19 16:01:07 -08:00
āh̳̕mͭͭͨͩ̐e̘ͬ́͋ͬ̊̓͂d 11394ea318 [thog-1548] add auto redaction for verification errors (#2106) 
* Updating VerificationError to have auto redaction logic
* find/replace error
 2023-12-05 08:57:52 -05:00
Dustin Decker 9e88cdf625 add extra data to github detector (#1909) 
* add extra data to github detector

* Add verification error
 2023-11-20 13:55:16 -08:00
Dylan AyreycounterDustin Decker
 		b3555f5419 Adding Howtorotate Guides to TruffleHog (#1839) 
* adding how to rotate guides

* Adding project ID to metadata

* update key name, remove comments, and ensure always present

---------

Co-authored-by: counter <counter@counters-MacBook-Air.local>
Co-authored-by: Dustin Decker <dustin@trufflesec.com>
 2023-10-02 13:45:17 -07:00
ahrav a5fbc54312 [chore] - update benchmarks. (#1641) 
* update benchmarks.

* remove dupe timer reset.
 2023-08-23 14:34:10 -07:00
Miccah b1675194ca Implement EndpointCustomizer (#1291) 
* Implement EndpointCustomizer

Add the EndpointCustomizer interface and EndpointSetter convenience struct,
implement EndpointCustomizer for github and gitlab detectors, and add
parsing, verification, and applying user-supplied configuration.

* Check error from SetEndpoints

* Rename variable for clarity
 2023-04-27 12:23:50 -05:00
ahrav f107e1b497 Use defautl endpoints when no custom verifier provided. (#1242) 2023-04-06 08:35:01 -07:00
ahravahmedah̳̕mͭͭͨͩ̐e̘ͬ́͋ͬ̊̓͂d
 		0052f60090 Allow for custom verifier (#1070) 
* allow for custom verifier.

* Update engine.

* use custom detectors.

* set cap.

* Update verifiers.

* Remove nil check.

* resolved nit

* handle uppercase values

* updating missing url logs

* adding more descriptive variable names

* updating logs to use correct variables

* Removing toLower for urls

* if else nits

* Adding versioning for github and gitlab

---------

Co-authored-by: ahmed <ahmed.zahran@trufflesec.com>
Co-authored-by: ah̳̕mͭͭͨͩ̐e̘ͬ́͋ͬ̊̓͂d <13666360+0x1@users.noreply.github.com>
 2023-03-29 12:26:39 -07:00
Miccahandsteeeve e6846ede54 Support filtering detectors by version (#1150) 
* Adjust types to use DetectorID struct

* Parse versions with detector include and exclude input

* Update detectors filter to use version

Co-authored-by: steeeve <steve@trufflesec.com>

* Implement Versioner for github, gitlab, and npm detectors

Co-authored-by: steeeve <steve@trufflesec.com>

---------

Co-authored-by: steeeve <steve@trufflesec.com>
 2023-03-02 16:33:56 -06:00
trufflesteeeveandahmed 114f4b6989 Add Type() to detector interface (#1088) 
* Add Type() to detector interface

The goal here is to allow the detector type information to be used
without the need for reflection. This could possibly allow us to more
easily inject information into detectors or filter them out if
necessary.

Co-authored-by: ahmed <ahmed.zahran@trufflesec.com>

* remove test detector

---------

Co-authored-by: ahmed <ahmed.zahran@trufflesec.com>
 2023-02-09 14:46:03 -08:00
Dustin Decker dac40519e4 support github fine grained tokens and add extra data (#868) 
* support github fine grained tokens and add extra data

* fix shadowed var
 2022-10-26 08:13:02 -07:00
Miccah c4ca7d7c8b Mark detector tests with a build flag (#613) 2022-07-07 10:27:21 -07:00
ahrav 198cb1a786 Clean up comments. (#562) 2022-05-16 09:03:10 -07:00
Dustin Decker 1735892c49 fix github detector (#472) 2022-04-22 08:51:38 -07:00
trufflesteeeve b5743277a3 Detectors that fail verification should still report the unverified secret (#440) 
* Detectors that fail verification should still report the unverified secret

* fixup - change microsoft webhook keywords, filter false positives for old github detector

* fixup - fix typo
 2022-04-21 15:32:26 -07:00
Dustin Decker 99372694ca check request errors 2022-03-23 16:42:34 -07:00
Dustin Decker c80bd5e905 Fix linting and dogfood in CI 2022-03-04 08:39:23 -08:00
Dustin Decker 86c2eb507b Adding detectors (#46) 
* rename secret

* Add supporting docs and tooling for adding new detectors
 2022-03-04 08:39:22 -08:00
Dustin Decker 77418fb3f8 module v3 2022-02-15 18:54:47 -08:00
Dustin Decker ee90ab344f Use sane http client instead of retryable 2022-02-15 18:54:47 -08:00
Dustin Decker 5596025b0b more detectors 2022-02-15 18:46:28 -08:00