Conversation
|
|
![cursor[bot]](https://avatars.githubusercontent.com/in/1210556?s=60&v=4){kind=small}
|
Nice work on this detector, the regex scoping of (?i:PREFIX) and the \b boundary fix are exactly right. |
|
Thanks for the careful review, @gugacyber! 🙏 Both of your points are handled:
The Cursor Bugbot items (scoped |
|
@MuneebUllahKhan222 — apologies for the direct ping, and please redirect me if this isn't yours. This PR (adds the Rancher/Cattle token detector requested in #4622) has been open since May 12 without a reviewer assigned, and I believe it's ready. Status
On the conflict The only thing marking this conflicting is the Rather than keep rebasing into a value that's contested by construction, I'd rather do it once, when it actually counts: whenever you're ready to look at this — or just start a review — I'll renumber to the next free value and push straight away so it lands clean. Happy to make any other changes you'd like. |
43a667b to
fd7ca91
Compare
Detects Rancher API tokens by matching common Rancher/Cattle variable
names (CATTLE_TOKEN, RANCHER_TOKEN, CATTLE_BOOTSTRAP_PASSWORD,
RANCHER_API_TOKEN, RANCHER_SECRET_KEY) followed by a 54-64 char
lowercase alphanumeric token.
Anchoring detection to known variable names avoids false positives on
generic [a-z0-9]{54,64} strings. Verification requires a live Rancher
server URL (CATTLE_SERVER) which is not available at scan time, so
matched tokens are flagged as unverified.
Closes trufflesecurity#4622
verifyRancherToken was returning a non-nil error, causing SetVerificationError to mark every result as unknown instead of unverified. Tokens were silently dropped unless --results=unknown was set. Returning (false, nil) correctly classifies them as unverified.
…re case-sensitive
The global (?i) flag was widening the [a-z0-9]{54,64} capture group to
also match uppercase letters, causing false positives on uppercase strings.
Rancher tokens are lowercase alphanumeric only.
Replace (?i)(?:PREFIX) with (?i:PREFIX) so case-insensitivity applies
only to the variable name prefix, matching the pattern used by
azure_storage and other detectors in the codebase.
Added an uppercase token test case to assert the capture group
remains case-sensitive.
…oundary, and ordering - Add missing context import (was causing build failure) - Add \b after token capture group to prevent matching first 64 chars of tokens longer than 64 chars (false positive on truncated values) - Drop unused verify scaffolding (net/http, verifyRancherToken, defaultClient) so results are correctly classified as unverified, not unknown - Fix alphabetical ordering of rancher import and registration in defaults.go (ramp < rancher) - Add test case for over-length token rejection
Allow an optional quote between the variable name and the separator so quoted keys like `"CATTLE_TOKEN": "<token>" match. Adds JSON test cases.
1139598 to
03eae92
Compare
There was a problem hiding this comment.
Cursor Bugbot has reviewed your changes using default effort and found 1 potential issue.
Reviewed by Cursor Bugbot for commit 40de802. Configure here.
|
Fixed — that was a leftover fragment of the Restored the line with |
3 participants
Summary
Closes #4622. Adds a detector for Rancher API tokens (used by the Rancher Kubernetes management platform, deployed at 37,000+ organizations).
Detection Strategy
Tokens are anchored to known Rancher/Cattle variable names to avoid false positives on generic
[a-z0-9]{54,64}strings (as flagged in the issue):Regex pattern:
Verification
Verification requires a live Rancher server URL (
CATTLE_SERVER) which is not available at scan time. Matched tokens are returned as unverified. A future enhancement could extractCATTLE_SERVERfrom the same context chunk and attemptGET {server}/v3withAuthorization: Bearer {token}.Changes
pkg/detectors/rancher/rancher.go— detector implementationpkg/detectors/rancher/rancher_test.go— pattern tests (env file, quoted values, no-context rejection, length rejection)proto/detector_type.proto—Rancher = 1050pkg/pb/detector_typepb/detector_type.pb.go— generated enum updatepkg/engine/defaults/defaults.go— registered&rancher.Scanner{}Test Results
Note
Low Risk
Additive detector-only change with tests and enum registration; no changes to scanning engine behavior beyond enabling a new detector type.
Overview
Adds a Rancher secret detector so TruffleHog can flag Rancher/Cattle API tokens in repos and configs.
Detection is context-aware: tokens must appear next to known names (
CATTLE_TOKEN,RANCHER_TOKEN,CATTLE_BOOTSTRAP_PASSWORD,RANCHER_API_TOKEN,RANCHER_SECRET_KEY) with=/:separators and optional quotes, and the value must match 54–64 lowercase alphanumeric characters. Duplicates are deduped; hits are unverified because validation would need a liveCATTLE_SERVERURL at scan time.The scanner is wired into the default engine and exposed as
DetectorType_Rancher(1072) via proto/generated enum updates. Tests cover env files, quoted/JSON values, and negative cases (wrong key, length, uppercase token).Reviewed by Cursor Bugbot for commit c1dc235. Bugbot is set up for automated code reviews on this repo. Configure here.