Skip to content

Refine Dockerhub Detector for Improved Accuracy & Coverage #4219

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Draft
wants to merge 3 commits into
base: main
Choose a base branch
from

Conversation

shahzadhaider1
Copy link
Contributor

@shahzadhaider1 shahzadhaider1 commented Jun 11, 2025

Description:

This PR streamlines the Dockerhub detector to improve both its precision and recall for identifying Dockerhub Personal Access Tokens (PATs) and usernames.

Key updates include:

  • Smarter Username Detection: usernamePat now correctly accounts for usernames starting with alphanumeric characters and allows for underscores and hyphens within the username, matching actual Dockerhub ID formats. It also refines whitespace handling for cleaner matches.
  • Robust Access Token (PAT) Detection: accessTokenPat is significantly enhanced. It now explicitly matches a broader set of common keywords (e.g., docker pat, access token) and gracefully handles various key-value pair delimiters (colons, equals signs, quotes), ensuring tokens are found across diverse configurations.
  • Fewer False Positives: excludeHeaderPat specifically filters out UUIDs found in benign Docker HTTP headers (e.g., X-Docker-Upload-UUID), preventing them from being flagged as secrets.
  • Improved Metadata: The detector now includes the version number in the scan results for both Dockerhub detectors (v1 and v2), enhancing result traceability.
  • API Modernization: The Dockerhub v1 detector has been updated to use the current API endpoint, replacing a deprecated one to ensure continued and reliable verification functionality.

These changes make the detector more effective by closely aligning it with real-world Docker credential patterns, leading to more accurate and relevant findings.

Checklist:

  • Tests passing (make test-community)?
  • Lint passing (make lint this requires golangci-lint)?

@shahzadhaider1 shahzadhaider1 requested a review from a team as a code owner June 11, 2025 16:17
@shahzadhaider1 shahzadhaider1 force-pushed the feat/OSS-179-dockerhub-improve branch from cc38662 to 91b5e3d Compare June 11, 2025 16:18
@shahzadhaider1 shahzadhaider1 self-assigned this Jun 13, 2025
@shahzadhaider1 shahzadhaider1 marked this pull request as draft June 13, 2025 15:58
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

DockerHub detector: ignore matches from Docker-Upload-Uuid header
1 participant