github.com/google/osv-scalibr@v0.4.1/veles/secrets/gitbasicauth/codecatalyst/detector.go (about)

     1  // Copyright 2025 Google LLC
     2  //
     3  // Licensed under the Apache License, Version 2.0 (the "License");
     4  // you may not use this file except in compliance with the License.
     5  // You may obtain a copy of the License at
     6  //
     7  //      http://www.apache.org/licenses/LICENSE-2.0
     8  //
     9  // Unless required by applicable law or agreed to in writing, software
    10  // distributed under the License is distributed on an "AS IS" BASIS,
    11  // WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
    12  // See the License for the specific language governing permissions and
    13  // limitations under the License.
    14  
    15  package codecatalyst
    16  
    17  import (
    18  	"net/url"
    19  	"regexp"
    20  
    21  	"github.com/google/osv-scalibr/veles"
    22  	"github.com/google/osv-scalibr/veles/secrets/common/simpletoken"
    23  )
    24  
    25  const (
    26  	// maxURLLength is an upper bound value for the length of a URL to be considered.
    27  	// This helps limit the buffer size required for scanning.
    28  	maxURLLength = 1_000
    29  )
    30  
    31  var (
    32  	// urlPattern matches URLs containing basic authentication credentials.
    33  	urlPattern = regexp.MustCompile(`\bhttps://[^:\s]+:[^\s@]+@git\.[^/]*codecatalyst\.aws/[^\s]*`)
    34  )
    35  
    36  // NewDetector creates and returns a new instance of the CodeCatalyst secret detector.
    37  func NewDetector() veles.Detector {
    38  	return simpletoken.Detector{
    39  		MaxLen: maxURLLength,
    40  		Re:     urlPattern,
    41  		FromMatch: func(b []byte) (veles.Secret, bool) {
    42  			u, err := url.Parse(string(b))
    43  			if err != nil {
    44  				return nil, false
    45  			}
    46  			if !hasValidCredentials(u) {
    47  				return nil, false
    48  			}
    49  			return Credentials{FullURL: u.String()}, true
    50  		},
    51  	}
    52  }
    53  
    54  func hasValidCredentials(u *url.URL) bool {
    55  	if u.User == nil || u.User.Username() == "" {
    56  		return false
    57  	}
    58  	_, hasPassword := u.User.Password()
    59  	return hasPassword
    60  }