Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Add Coinbase Wallet-as-a-Service detector #1895

Merged
merged 3 commits into from
Oct 27, 2023

Conversation

rgmz
Copy link
Contributor

@rgmz rgmz commented Oct 17, 2023

Description:

This adds a detector for Coinbase's Wallet as a Service (WaaS) API.

The detector logic is implemented using Coinbase's SDK, which adds just over 1MiB to the binary. My rationale for doing so is that reverse-engineering the SDK might result in brittle/unreliable logic, as the endpoints are not publicly documented (to my knowledge).

Checklist:

  • Tests passing (make test-community)?
  • Lint passing (make lint this requires golangci-lint)?

@rgmz rgmz requested a review from a team as a code owner October 17, 2023 21:10
@zricethezav zricethezav added the Hacktoberfest-Detector-Competition-New Apply this label if you are adding a new detector for the detector competition label Oct 17, 2023
@rgmz rgmz marked this pull request as draft October 18, 2023 01:36
@rgmz rgmz force-pushed the feat/coinbase-waas-detector branch 3 times, most recently from 8540bea to a67fc6e Compare October 18, 2023 01:39
@rgmz rgmz marked this pull request as ready for review October 18, 2023 13:49
@zricethezav
Copy link
Collaborator

@rgmz do you by chance have a screenshot of the tests passing?

@rgmz rgmz force-pushed the feat/coinbase-waas-detector branch from a67fc6e to c3bc514 Compare October 18, 2023 16:13
@rgmz
Copy link
Contributor Author

rgmz commented Oct 18, 2023

Sure, here you go:
image

I had to disable two test cases because this does not use the provided http.Client, as mentioned above.

@rgmz rgmz force-pushed the feat/coinbase-waas-detector branch 3 times, most recently from 32b89f6 to a09f996 Compare October 19, 2023 12:49
@rosecodym
Copy link
Collaborator

I had to disable two test cases because this does not use the provided http.Client, as mentioned above.

I believe you can inject a configured httpClient and use it in those tests. If not, you might be able to implement the timeout test by using a context with a timeout (I can find an example elsewhere in the codebase if that'd be helpful), and you can just delete the other test. You might as well delete the httpClient from the Scanner struct in that case.

@rgmz rgmz force-pushed the feat/coinbase-waas-detector branch from a09f996 to caf0472 Compare October 19, 2023 16:06
@rgmz
Copy link
Contributor Author

rgmz commented Oct 19, 2023

I believe you can inject a configured httpClient and use it in those tests

You're absolutely right. Works like a charm!

@rgmz rgmz force-pushed the feat/coinbase-waas-detector branch 2 times, most recently from fe39730 to de68a9a Compare October 19, 2023 20:06
@rgmz rgmz force-pushed the feat/coinbase-waas-detector branch from de68a9a to 1fe4260 Compare October 23, 2023 13:05
…'feat/coinbase-waas-detector' of github.com:rgmz/trufflehog into pr/rgmz/1895
Copy link
Contributor

@dustin-decker dustin-decker left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Looks great, thank you!

@dustin-decker dustin-decker merged commit 96b2515 into trufflesecurity:main Oct 27, 2023
@rgmz rgmz deleted the feat/coinbase-waas-detector branch October 27, 2023 17:33
Phoenix591 pushed a commit to Phoenix591/trufflehog that referenced this pull request Oct 27, 2023
* feat(coinbase): basic Wallet-as-a-Service detector

* update test

---------

Co-authored-by: Dustin Decker <dustin@trufflesec.com>
haraldh referenced this pull request in matter-labs/vault-auth-tee Nov 3, 2023
[![Mend
Renovate](https://app.renovatebot.com/images/banner.svg)](https://renovatebot.com)

This PR contains the following updates:

| Package | Type | Update | Change |
|---|---|---|---|
|
[trufflesecurity/trufflehog](https://togithub.com/trufflesecurity/trufflehog)
| action | minor | `v3.60.4` -> `v3.62.1` |

---

### Release Notes

<details>
<summary>trufflesecurity/trufflehog
(trufflesecurity/trufflehog)</summary>

###
[`v3.62.1`](https://togithub.com/trufflesecurity/trufflehog/releases/tag/v3.62.1)

[Compare
Source](https://togithub.com/trufflesecurity/trufflehog/compare/v3.62.0...v3.62.1)

#### What's Changed

- update kingpin import by
[@&#8203;dustin-decker](https://togithub.com/dustin-decker) in
[https://github.com/trufflesecurity/trufflehog/pull/2053](https://togithub.com/trufflesecurity/trufflehog/pull/2053)
- Re-add detector version by
[@&#8203;rosecodym](https://togithub.com/rosecodym) in
[https://github.com/trufflesecurity/trufflehog/pull/2060](https://togithub.com/trufflesecurity/trufflehog/pull/2060)
- Detector-Competition-Fix: Fix currencycloud.com API key by
[@&#8203;lc](https://togithub.com/lc) in
[https://github.com/trufflesecurity/trufflehog/pull/1917](https://togithub.com/trufflesecurity/trufflehog/pull/1917)
- Detector-Competition-Fix: Fix Bitcoin Average detector by
[@&#8203;lc](https://togithub.com/lc) in
[https://github.com/trufflesecurity/trufflehog/pull/1929](https://togithub.com/trufflesecurity/trufflehog/pull/1929)
- Detector-Competition-Fix: Update formio regex to match Jwt token by
[@&#8203;fumblehool](https://togithub.com/fumblehool) in
[https://github.com/trufflesecurity/trufflehog/pull/1935](https://togithub.com/trufflesecurity/trufflehog/pull/1935)
- Detector-Competition-Fix: Fix SalesBlink Detection & Verification by
[@&#8203;lc](https://togithub.com/lc) in
[https://github.com/trufflesecurity/trufflehog/pull/1950](https://togithub.com/trufflesecurity/trufflehog/pull/1950)
- Support multiple custom detectors by
[@&#8203;rosecodym](https://togithub.com/rosecodym) in
[https://github.com/trufflesecurity/trufflehog/pull/2064](https://togithub.com/trufflesecurity/trufflehog/pull/2064)
- \[chore] Fix SourceManager flaky test by
[@&#8203;mcastorina](https://togithub.com/mcastorina) in
[https://github.com/trufflesecurity/trufflehog/pull/2059](https://togithub.com/trufflesecurity/trufflehog/pull/2059)
- Centralize logic for checking archive extraction tools by
[@&#8203;ahrav](https://togithub.com/ahrav) in
[https://github.com/trufflesecurity/trufflehog/pull/2063](https://togithub.com/trufflesecurity/trufflehog/pull/2063)

**Full Changelog**:
trufflesecurity/trufflehog@v3.62.0...v3.62.1

###
[`v3.62.0`](https://togithub.com/trufflesecurity/trufflehog/releases/tag/v3.62.0)

[Compare
Source](https://togithub.com/trufflesecurity/trufflehog/compare/v3.61.0...v3.62.0)

#### What's Changed

- Update module github.com/aws/aws-sdk-go to v1.46.6 by
[@&#8203;renovate](https://togithub.com/renovate) in
[https://github.com/trufflesecurity/trufflehog/pull/2013](https://togithub.com/trufflesecurity/trufflehog/pull/2013)
- Update module github.com/bradleyfalzon/ghinstallation/v2 to v2.8.0 by
[@&#8203;renovate](https://togithub.com/renovate) in
[https://github.com/trufflesecurity/trufflehog/pull/2014](https://togithub.com/trufflesecurity/trufflehog/pull/2014)
- Update module github.com/charmbracelet/lipgloss to v0.9.1 by
[@&#8203;renovate](https://togithub.com/renovate) in
[https://github.com/trufflesecurity/trufflehog/pull/2015](https://togithub.com/trufflesecurity/trufflehog/pull/2015)
- Update module github.com/go-logr/logr to v1.3.0 by
[@&#8203;renovate](https://togithub.com/renovate) in
[https://github.com/trufflesecurity/trufflehog/pull/2025](https://togithub.com/trufflesecurity/trufflehog/pull/2025)
- Update module github.com/getsentry/sentry-go to v0.25.0 by
[@&#8203;renovate](https://togithub.com/renovate) in
[https://github.com/trufflesecurity/trufflehog/pull/2022](https://togithub.com/trufflesecurity/trufflehog/pull/2022)
- Update module github.com/google/go-containerregistry to v0.16.1 by
[@&#8203;renovate](https://togithub.com/renovate) in
[https://github.com/trufflesecurity/trufflehog/pull/2026](https://togithub.com/trufflesecurity/trufflehog/pull/2026)
- Update module github.com/google/uuid to v1.4.0 by
[@&#8203;renovate](https://togithub.com/renovate) in
[https://github.com/trufflesecurity/trufflehog/pull/2027](https://togithub.com/trufflesecurity/trufflehog/pull/2027)
- Update module github.com/hashicorp/golang-lru to v0.6.0 by
[@&#8203;renovate](https://togithub.com/renovate) in
[https://github.com/trufflesecurity/trufflehog/pull/2028](https://togithub.com/trufflesecurity/trufflehog/pull/2028)
- Update module github.com/rabbitmq/amqp091-go to v1.9.0 by
[@&#8203;renovate](https://togithub.com/renovate) in
[https://github.com/trufflesecurity/trufflehog/pull/2030](https://togithub.com/trufflesecurity/trufflehog/pull/2030)
- Detector-Competition-Feat: Added LemonSqueezy API token detector by
[@&#8203;fumblehool](https://togithub.com/fumblehool) in
[https://github.com/trufflesecurity/trufflehog/pull/2017](https://togithub.com/trufflesecurity/trufflehog/pull/2017)
- Update module github.com/prometheus/client_golang to v1.17.0 by
[@&#8203;renovate](https://togithub.com/renovate) in
[https://github.com/trufflesecurity/trufflehog/pull/2029](https://togithub.com/trufflesecurity/trufflehog/pull/2029)
- Detector-Competition-Feat: Added Budibase API token detector by
[@&#8203;fumblehool](https://togithub.com/fumblehool) in
[https://github.com/trufflesecurity/trufflehog/pull/2016](https://togithub.com/trufflesecurity/trufflehog/pull/2016)
- Update github.com/bodgit/sevenzip to v1.4.3 by
[@&#8203;rgmz](https://togithub.com/rgmz) in
[https://github.com/trufflesecurity/trufflehog/pull/2039](https://togithub.com/trufflesecurity/trufflehog/pull/2039)
- Update module go.uber.org/mock to v0.3.0 by
[@&#8203;renovate](https://togithub.com/renovate) in
[https://github.com/trufflesecurity/trufflehog/pull/2038](https://togithub.com/trufflesecurity/trufflehog/pull/2038)
- Update module github.com/xanzy/go-gitlab to v0.93.2 by
[@&#8203;renovate](https://togithub.com/renovate) in
[https://github.com/trufflesecurity/trufflehog/pull/2031](https://togithub.com/trufflesecurity/trufflehog/pull/2031)
- Update module github.com/snowflakedb/gosnowflake to v1.6.25 by
[@&#8203;renovate](https://togithub.com/renovate) in
[https://github.com/trufflesecurity/trufflehog/pull/2042](https://togithub.com/trufflesecurity/trufflehog/pull/2042)
- Update module github.com/launchdarkly/go-server-sdk/v6 to v6.1.1 by
[@&#8203;renovate](https://togithub.com/renovate) in
[https://github.com/trufflesecurity/trufflehog/pull/2043](https://togithub.com/trufflesecurity/trufflehog/pull/2043)
- Update module go.uber.org/zap to v1.26.0 by
[@&#8203;renovate](https://togithub.com/renovate) in
[https://github.com/trufflesecurity/trufflehog/pull/2044](https://togithub.com/trufflesecurity/trufflehog/pull/2044)
- Update module google.golang.org/api to v0.148.0 by
[@&#8203;renovate](https://togithub.com/renovate) in
[https://github.com/trufflesecurity/trufflehog/pull/2045](https://togithub.com/trufflesecurity/trufflehog/pull/2045)
- Developed Deno Deploy Detector by
[@&#8203;rgmz](https://togithub.com/rgmz) in
[https://github.com/trufflesecurity/trufflehog/pull/2040](https://togithub.com/trufflesecurity/trufflehog/pull/2040)
- Detector-Competition-Feat: Added Stripo API token detector by
[@&#8203;fumblehool](https://togithub.com/fumblehool) in
[https://github.com/trufflesecurity/trufflehog/pull/2018](https://togithub.com/trufflesecurity/trufflehog/pull/2018)
- fix(deps): update module sigs.k8s.io/yaml to v1.4.0 by
[@&#8203;renovate](https://togithub.com/renovate) in
[https://github.com/trufflesecurity/trufflehog/pull/2047](https://togithub.com/trufflesecurity/trufflehog/pull/2047)
- Detector-Competition-Feat: Added Reply.io API token detector by
[@&#8203;fumblehool](https://togithub.com/fumblehool) in
[https://github.com/trufflesecurity/trufflehog/pull/2019](https://togithub.com/trufflesecurity/trufflehog/pull/2019)
- fix(deps): update module github.com/go-git/go-git/v5 to v5.10.0 by
[@&#8203;renovate](https://togithub.com/renovate) in
[https://github.com/trufflesecurity/trufflehog/pull/2023](https://togithub.com/trufflesecurity/trufflehog/pull/2023)
- adding 'token' keyword to regex for github_old by
[@&#8203;ankushgoel27](https://togithub.com/ankushgoel27) in
[https://github.com/trufflesecurity/trufflehog/pull/2037](https://togithub.com/trufflesecurity/trufflehog/pull/2037)
- Remove verify flag from Aho-Corasick core by
[@&#8203;rosecodym](https://togithub.com/rosecodym) in
[https://github.com/trufflesecurity/trufflehog/pull/2010](https://togithub.com/trufflesecurity/trufflehog/pull/2010)
- Add TravisCI source by
[@&#8203;dustin-decker](https://togithub.com/dustin-decker) in
[https://github.com/trufflesecurity/trufflehog/pull/1877](https://togithub.com/trufflesecurity/trufflehog/pull/1877)

**Full Changelog**:
trufflesecurity/trufflehog@v3.61.0...v3.62.0

###
[`v3.61.0`](https://togithub.com/trufflesecurity/trufflehog/releases/tag/v3.61.0)

[Compare
Source](https://togithub.com/trufflesecurity/trufflehog/compare/v3.60.4...v3.61.0)

#### What's Changed

- Detector-Competition-Fix: Fix/Remove Happi Detection & Verification by
[@&#8203;lc](https://togithub.com/lc) in
[https://github.com/trufflesecurity/trufflehog/pull/2003](https://togithub.com/trufflesecurity/trufflehog/pull/2003)
- Detector-Competition-Fix: Fix/Remove Flowdock detector by
[@&#8203;lc](https://togithub.com/lc) in
[https://github.com/trufflesecurity/trufflehog/pull/2004](https://togithub.com/trufflesecurity/trufflehog/pull/2004)
- Add temp directory management by
[@&#8203;codevbus](https://togithub.com/codevbus) in
[https://github.com/trufflesecurity/trufflehog/pull/1878](https://togithub.com/trufflesecurity/trufflehog/pull/1878)
- Fix binary handling by
[@&#8203;bill-rich](https://togithub.com/bill-rich) in
[https://github.com/trufflesecurity/trufflehog/pull/1999](https://togithub.com/trufflesecurity/trufflehog/pull/1999)
- Detector-Competition-Fix: Fix SurveyBot Verification by
[@&#8203;lc](https://togithub.com/lc) in
[https://github.com/trufflesecurity/trufflehog/pull/1948](https://togithub.com/trufflesecurity/trufflehog/pull/1948)
- Detector-Competition-Feat: Added BetterStack API token detector by
[@&#8203;fumblehool](https://togithub.com/fumblehool) in
[https://github.com/trufflesecurity/trufflehog/pull/1987](https://togithub.com/trufflesecurity/trufflehog/pull/1987)
- Detector-Competition-Feat: Added ZeroTier API token detector by
[@&#8203;fumblehool](https://togithub.com/fumblehool) in
[https://github.com/trufflesecurity/trufflehog/pull/1988](https://togithub.com/trufflesecurity/trufflehog/pull/1988)
- Detector-Competition-Feat: Added AppOptics API token detector by
[@&#8203;fumblehool](https://togithub.com/fumblehool) in
[https://github.com/trufflesecurity/trufflehog/pull/1989](https://togithub.com/trufflesecurity/trufflehog/pull/1989)
- Detector-Competition-Feat: Add Metabase Session Secret Detector by
[@&#8203;fumblehool](https://togithub.com/fumblehool) in
[https://github.com/trufflesecurity/trufflehog/pull/1902](https://togithub.com/trufflesecurity/trufflehog/pull/1902)
- Add Coinbase Wallet-as-a-Service detector by
[@&#8203;rgmz](https://togithub.com/rgmz) in
[https://github.com/trufflesecurity/trufflehog/pull/1895](https://togithub.com/trufflesecurity/trufflehog/pull/1895)
- Chore(deps): Bump google.golang.org/grpc from 1.56.2 to 1.56.3 by
[@&#8203;dependabot](https://togithub.com/dependabot) in
[https://github.com/trufflesecurity/trufflehog/pull/2009](https://togithub.com/trufflesecurity/trufflehog/pull/2009)
- Update module github.com/TheZeroSlave/zapsentry to v1.19.0 by
[@&#8203;renovate](https://togithub.com/renovate) in
[https://github.com/trufflesecurity/trufflehog/pull/2012](https://togithub.com/trufflesecurity/trufflehog/pull/2012)
- Update module cloud.google.com/go/secretmanager to v1.11.3 by
[@&#8203;renovate](https://togithub.com/renovate) in
[https://github.com/trufflesecurity/trufflehog/pull/2011](https://togithub.com/trufflesecurity/trufflehog/pull/2011)

**Full Changelog**:
trufflesecurity/trufflehog@v3.60.4...v3.61.0

</details>

---

### Configuration

📅 **Schedule**: Branch creation - At any time (no schedule defined),
Automerge - At any time (no schedule defined).

🚦 **Automerge**: Disabled by config. Please merge this manually once you
are satisfied.

♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the
rebase/retry checkbox.

🔕 **Ignore**: Close this PR and you won't be reminded about this update
again.

---

- [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check
this box

---

This PR has been generated by [Mend
Renovate](https://www.mend.io/free-developer-tools/renovate/). View
repository job log
[here](https://developer.mend.io/github/matter-labs/vault-auth-tee).

<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiIzNy4zMS41IiwidXBkYXRlZEluVmVyIjoiMzcuMzEuNSIsInRhcmdldEJyYW5jaCI6Im1haW4ifQ==-->

Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
Hacktoberfest-Detector-Competition-New Apply this label if you are adding a new detector for the detector competition
Development

Successfully merging this pull request may close these issues.

4 participants