Repository navigation
Veles: Cloudflare API Token - #1457
Conversation
erikvarga
left a comment
erikvarga
left a comment
There was a problem hiding this comment.
Apologies for delay and thanks for your patience throughout the PRP freeze. We're now resuming reviews of PRP PRs.
| const maxTokenLength = 40 | ||
|
|
||
| // envVarRe matches environment variable style assignments. | ||
| // Examples: CLOUDFLARE_API_TOKEN=token, CF_API_KEY="token" |
There was a problem hiding this comment.
In the GH Issue you mentioned that there are specific config files in which Cloudfare files are typically stored. Would it make sense to add an extractor that looks for token blobs in these files and return a Cloudfare secret?
You could add an extractor to extractors/filesystem/secrets similar to https://github.com/google/osv-scalibr/blob/main/extractor/filesystem/secrets/gitbasicauth/codecommit/codecommit.go where it wraps around a simpletoken struct but adds a FileRequired function to restrict it to certain files only.
…oken and cloudlfareapitoken
erikvarga
left a comment
erikvarga
left a comment
There was a problem hiding this comment.
Generally looks good now, only have a few minor comments
add TestDetectorAcceptance and use "/veles/secrets/common/pair" package for detection
|
@erikvarga HI |
2 participants
#1000