[INS-332] Add New Relic Insights Insert key detector - #4778
Conversation
mustansir14
changed the title
![cursor[bot]](https://avatars.githubusercontent.com/in/1210556?s=60&v=4){kind=small}
| func (s Scanner) verify(ctx context.Context, key string) (bool, map[string]string, error) { | ||
| regionUrls := map[string]string{ | ||
| "us": "https://insights-collector.newrelic.com/v1/accounts/`nowaythiscanexist/events", | ||
| "eu": "https://insights-collector.eu01.nr-data.net/v1/accounts/`nowaythiscanexist/events", |
There was a problem hiding this comment.
Stray backtick character in verification API URLs
High Severity
Both verification URLs contain a stray backtick character before nowaythiscanexist in the account ID path segment. The URLs read .../accounts/ `nowaythiscanexist/events` instead of .../accounts/nowaythiscanexist/events. This backtick (likely copied from the PR description's markdown formatting) becomes a literal character in the Go double-quoted string, making the verification requests go to an incorrect path. This will likely cause verification to always fail or return unexpected status codes.
There was a problem hiding this comment.
It is intentional. It is done to ensure the account ID never exists. I've tested this and the API returns with a 200 for a valid key and 403 for an invalid/rotated key.
There was a problem hiding this comment.
Cursor Bugbot has reviewed your changes and found 1 potential issue.
Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.
4 participants
Description:
This PR adds the New Relic Insights Insert Key Detector.
Regex:
\b(NRII-[a-zA-Z0-9-_]{25})Note: We haven't added a trailing
\bbecause having that causes secrets ending with-to not be matched.Verification:
For verification, we use the Events API:
https://insights-collector.newrelic.com/v1/accounts/{account_id}/events.We use a dummy placeholder (
nowaythiscanexist) in place of account ID.We send a POST request with an empty body to this endpoint. A response code of
200means the key is valid.403means it is an invalid/rotated key.Note: For EU region keys, the host should be
insights-collector.eu01.nr-data.netCorpora Test:
The detector does not appear in the list.
Checklist:
make test-community)?make lintthis requires golangci-lint)?Note
Medium Risk
Enables live outbound verification against New Relic with discovered keys and expands default scan surface via a new gated detector; behavior matches existing detector rollout patterns.
Overview
Adds New Relic Insights Insert Key (
NRII-…) detection and optional verification against the Insights Event API in US and EU, recordingregionin extra data when a key validates.The new
newrelicinsightsinsertkeyscanner matches\b(NRII-[a-zA-Z0-9-_]{25})(no trailing word boundary so keys ending in-still match), pre-filters onnrii-, and verifies with an empty-bodyPOSTandX-Insert-Keyto collector URLs using a placeholder account id (nowaythiscanexist); 200 vs 403 drives verified vs invalid.Wiring follows other gated detectors: proto type 1058, registration in
buildDetectorList(),NewRelicInsightsInsertKeyDetectorEnabled(on by default inmain.go), and listing under feature-flag exclusions indefaults_test.go. Unit and integration tests cover pattern matching and live verification (US/EU/inactive).Reviewed by Cursor Bugbot for commit 715e505. Bugbot is set up for automated code reviews on this repo. Configure here.