Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Added azure COSMOSDB detector #3951

Open
wants to merge 15 commits into
base: main
Choose a base branch
from
Open
Changes from 1 commit
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
Prev Previous commit
Next Next commit
removed port 443 from regex
  • Loading branch information
kashifkhan0771 committed Feb 28, 2025
commit 7fd20ddb82b63f43787e5b34781eedadc0f417f6
12 changes: 6 additions & 6 deletions pkg/detectors/azure_cosmosdb/azure_cosmosdb.go
Original file line number Diff line number Diff line change
@@ -29,11 +29,11 @@ var (

dbKeyPattern = regexp.MustCompile(`([A-Za-z0-9+/]{86}==)`)
// account name can contain only lowercase letters, numbers and the `-` character, must be between 3 and 44 characters long.
accountUrlPattern = regexp.MustCompile(`([a-z0-9-]{3,44}.documents\.azure\.com:443)`)
accountUrlPattern = regexp.MustCompile(`([a-z0-9-]{3,44}.documents\.azure\.com)`)

invalidHosts = simple.NewCache[struct{}]()

noSuchHostErr = errors.New("no such host")
noHostErr = errors.New("no such host")
)

func (s Scanner) getClient() *http.Client {
@@ -56,7 +56,7 @@ func (s Scanner) Description() string {
}

func (s Scanner) Keywords() []string {
return []string{"cosmos", ".documents.azure.com"}
return []string{".documents.azure.com"}
}

func (s Scanner) FromData(ctx context.Context, verify bool, data []byte) (results []detectors.Result, err error) {
@@ -89,7 +89,7 @@ func (s Scanner) FromData(ctx context.Context, verify bool, data []byte) (result
verified, verificationErr := verifyCosmosDB(s.getClient(), accountUrl, key)
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Nit**: If the host url is invalid or does not exists, then we should not be spending iteration to verify other keys on that. Richard has already implemented this in AzureContainerRegistry

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This is great approach ❤️ Thanks for sharing @abmussani

s1.Verified = verified
if verificationErr != nil {
if errors.Is(verificationErr, noSuchHostErr) {
if errors.Is(verificationErr, noHostErr) {
invalidHosts.Set(accountUrl, struct{}{})
continue
}
@@ -113,7 +113,7 @@ func verifyCosmosDB(client *http.Client, accountUrl, key string) (bool, error) {
return false, fmt.Errorf("failed to decode key: %v", err)
}

req, err := http.NewRequest(http.MethodGet, fmt.Sprintf("https://%s/dbs", accountUrl), nil)
req, err := http.NewRequest(http.MethodGet, fmt.Sprintf("https://%s:443/dbs", accountUrl), nil)
if err != nil {
return false, fmt.Errorf("failed to create request: %v", err)
}
@@ -131,7 +131,7 @@ func verifyCosmosDB(client *http.Client, accountUrl, key string) (bool, error) {
if err != nil {
// lookup foo.documents.azure.com: no such host
if strings.Contains(err.Error(), "no such host") {
return false, noSuchHostErr
return false, noHostErr
}

return false, err
Loading
Oops, something went wrong.