hashicorpvaultbatchtoken.go

package hashicorpbatchtoken

import (
	"context"
	"encoding/json"
	"fmt"
	"io"
	"net/http"
	"net/url"
	"strings"

	regexp "github.com/wasilibs/go-re2"

	"github.com/trufflesecurity/trufflehog/v3/pkg/detectors"
	"github.com/trufflesecurity/trufflehog/v3/pkg/pb/detectorspb"
)

type Scanner struct {
	client *http.Client
	detectors.DefaultMultiPartCredentialProvider
	detectors.EndpointSetter
}

var _ detectors.Detector = (*Scanner)(nil)
var _ detectors.EndpointCustomizer = (*Scanner)(nil)

var (
	defaultClient = detectors.DetectorHttpClientWithNoLocalAddresses

	// Batch tokens: hvb.<50-300 chars>
	batchTokenPat = regexp.MustCompile(
		`\b(hvb\.[A-Za-z0-9_.-]{50,300})\b`,
	)

	vaultUrlPat = regexp.MustCompile(`(https?:\/\/[^\s\/]*\.hashicorp\.cloud(?::\d+)?)(?:\/[^\s]*)?`)
)

func (s Scanner) Keywords() []string {
	return []string{"hvb."}
}

func (Scanner) CloudEndpoint() string { return "" }

func (s Scanner) Description() string {
	return "This detector detects and verifies HashiCorp Vault batch tokens"
}

func (s Scanner) getClient() *http.Client {
	if s.client != nil {
		return s.client
	}
	return defaultClient
}

func (s Scanner) FromData(
	ctx context.Context,
	verify bool,
	data []byte,
) (results []detectors.Result, err error) {

	dataStr := string(data)

	uniqueTokens := make(map[string]struct{})
	for _, match := range batchTokenPat.FindAllStringSubmatch(dataStr, -1) {
		uniqueTokens[match[1]] = struct{}{}
	}

	var uniqueVaultUrls = make(map[string]struct{})
	for _, match := range vaultUrlPat.FindAllStringSubmatch(dataStr, -1) {
		url := strings.TrimSpace(match[1])
		uniqueVaultUrls[url] = struct{}{}
	}

	endpoints := make([]string, 0, len(uniqueVaultUrls))
	for endpoint := range uniqueVaultUrls {
		endpoints = append(endpoints, endpoint)
	}

	for _, endpoint := range s.Endpoints(endpoints...) {
		for token := range uniqueTokens {
			result := detectors.Result{
				DetectorType: detectorspb.DetectorType_HashiCorpVaultBatchToken,
				Raw:          []byte(token),
				RawV2:        []byte(token + endpoint),
				Redacted:     token[:8] + "...",
			}

			if verify {
				verified, verificationResp, verificationErr := verifyVaultToken(
					ctx,
					s.getClient(),
					endpoint,
					token,
				)
				result.SetVerificationError(verificationErr, token)
				result.Verified = verified

				if verificationResp != nil {
					result.ExtraData = map[string]string{
						"policies":  strings.Join(verificationResp.Data.Policies, ", "),
						"orphan":    fmt.Sprintf("%v", verificationResp.Data.Orphan),
						"renewable": fmt.Sprintf("%v", verificationResp.Data.Renewable),
						"type":      verificationResp.Data.Type,
						"entity_id": verificationResp.Data.EntityId,
					}
				}
			}

			results = append(results, result)
		}
	}

	return
}

type lookupResponse struct {
	Data struct {
		DisplayName string   `json:"display_name"`
		EntityId    string   `json:"entity_id"`
		ExpireTime  string   `json:"expire_time"`
		Orphan      bool     `json:"orphan"`
		Policies    []string `json:"policies"`
		Renewable   bool     `json:"renewable"`
		Type        string   `json:"type"`
	}
}

func verifyVaultToken(
	ctx context.Context,
	client *http.Client,
	baseUrl string,
	token string,
) (bool, *lookupResponse, error) {
	url, err := url.JoinPath(baseUrl, "/v1/auth/token/lookup-self")
	if err != nil {
		return false, nil, err
	}
	req, err := http.NewRequestWithContext(
		ctx,
		http.MethodGet,
		url,
		http.NoBody,
	)
	if err != nil {
		return false, nil, err
	}

	req.Header.Set("X-Vault-Token", token)

	res, err := client.Do(req)
	if err != nil {
		return false, nil, err
	}
	defer func() {
		_, _ = io.Copy(io.Discard, res.Body)
		_ = res.Body.Close()
	}()

	switch res.StatusCode {
	case http.StatusOK:
		var resp lookupResponse
		if err := json.NewDecoder(res.Body).Decode(&resp); err != nil {
			return false, nil, err
		}

		return true, &resp, nil

	case http.StatusForbidden, http.StatusUnauthorized:
		return false, nil, nil

	default:
		return false, nil, fmt.Errorf(
			"unexpected HTTP response status %d",
			res.StatusCode,
		)
	}
}

func (s Scanner) Type() detectorspb.DetectorType {
	return detectorspb.DetectorType_HashiCorpVaultBatchToken
}