detect-secrets/detect_secrets/plugins/github_enterprise.py at master · IBM/detect-secrets · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
import re

import requests

from .base import RegexBasedDetector
from detect_secrets.constants import DEFAULT_GHE_INSTANCE
from detect_secrets.core.constants import VerifiedResult


class GheDetector(RegexBasedDetector):
    """ Scans for GitHub Enterprise credentials generated both before (see forty_hex var) and
    after (see new_ghe_token var) this update:
    https://docs.github.com/en/enterprise-server@3.2/authentication/keeping-your-account-and-data-secure/about-authentication-to-github#githubs-token-formats
    """

    secret_type = 'GitHub Enterprise Credentials'
    denylist = None

    def __init__(self, ghe_instance=DEFAULT_GHE_INSTANCE, *args, **kwargs):
        super(GheDetector, self).__init__(*args, **kwargs)
        self.ghe_instance = ghe_instance

        opt_github_prefix = r'(?:github|gh|ghe|git|auth|)(?:_|-|)(?:api|)'
        opt_space = r'(?: *)'
        opt_quote = r'(?:"|\'|)'
        header_keyword = r'(?:token|bearer|Basic)'
        credential_keywords = 'cred|creds|credentials|credential|cred'
        key_or_pass_values = 'key|pwd|password|pass|token|oauth|auth|pat|ghe|gh|secret'
        key_or_pass_misspelt = 'ky|pw|pasword|pas|tkn|ath|secert|secrete'
        key_or_pass = r'(?:{key_or_pass}|{credential_keywords}|{key_or_pass_misspelt})'\
            .format(
                key_or_pass=key_or_pass_values,
                credential_keywords=credential_keywords,
                key_or_pass_misspelt=key_or_pass_misspelt,
            )
        api_endpoint = r'(?:{ghe_instance}|api.{ghe_instance})'\
            .format(ghe_instance=self.ghe_instance)
        forty_hex = r'(?:(?<=\W)|(?<=^))([0-9a-f]{40})(?:(?=\W)|(?=$))'
        # References:
        # https://docs.github.com/en/enterprise-server@3.2/authentication/keeping-your-account-and-data-secure/about-authentication-to-github#githubs-token-formats
        # ref. https://github.blog/2021-04-05-behind-githubs-new-authentication-token-formats/
        new_ghe_token = (r'(ghp|gho|ghu|ghs|ghr)_[A-Za-z0-9_]{36}')
        b64_encoded_token = r'(?:(?<=\W)|(?<=^))([A-Za-z0-9+/]{55}=)(?:(?=\W)|(?=$))'
        opt_username = r'(?:[a-zA-Z0-9-]+:|)'
        self.denylist = [
            RegexBasedDetector.assign_regex_generator(
                prefix_regex=opt_github_prefix,
                password_keyword_regex=key_or_pass,
                password_regex=forty_hex,
            ),
            re.compile(
                r'https://{opt_username}{forty_hex}@{api_endpoint}'.format(
                    forty_hex=forty_hex,
                    api_endpoint=api_endpoint,
                    opt_username=opt_username,
                ), flags=re.IGNORECASE,
            ),
            re.compile(
                r'{opt_quote}Authorization{opt_quote}{opt_space}:{opt_space}{opt_quote}'
                '{header_keyword}{opt_space}{forty_hex}{opt_quote}'.format(
                    opt_quote=opt_quote,
                    opt_space=opt_space,
                    header_keyword=header_keyword,
                    forty_hex=forty_hex,
                ), flags=re.IGNORECASE,
            ),
            re.compile(
                r'{opt_quote}Authorization{opt_quote}{opt_space}:{opt_space}{opt_quote}'
                'Basic{opt_space}{b64_encoded_token}{opt_quote}'.format(
                    opt_quote=opt_quote,
                    opt_space=opt_space,
                    b64_encoded_token=b64_encoded_token,
                ), flags=re.IGNORECASE,
            ),
            re.compile(new_ghe_token),
        ]

    def verify(self, token, *args, **kwargs):
        try:
            if type(token) == bytes:
                token = token.decode('UTF-8')
            headers = {'Authorization': 'token %s' % token}
            response = requests.get(f'https://{self.ghe_instance}/api/v3', headers=headers)
            if response.status_code == 200:
                return VerifiedResult.VERIFIED_TRUE
            elif response.status_code == 401:
                return VerifiedResult.VERIFIED_FALSE
            else:
                return VerifiedResult.UNVERIFIED
        except requests.exceptions.RequestException:
            return VerifiedResult.UNVERIFIED

    @property
    def __dict__(self):
        output = super(GheDetector, self).__dict__
        output.update({
            'ghe_instance': self.ghe_instance,
        })

        return output