GH-768: Plugin to detect Telegram bot tokens #808
Conversation
| re.compile(r'\d{8,10}:[0-9A-Za-z_-]{35}'), | ||
| ] | ||
|
|
||
| def verify(self, secret: str) -> VerifiedResult: # pragma: no cover |
There was a problem hiding this comment.
Looking at other RegexBasedDetector, it doesn't look like you need a verify method like you would in a BasePlugin (see github_token.py for reference).
There was a problem hiding this comment.
provides the ability to decrease false positives by making an API call to a server to check whether a PotentialSecret is indeed real. This can be extremely useful for specific secrets (e.g. RegexBasedDetector subclasses) since we are able to determine which server to contact.
verify method is optional but really good in decreasing False-positives. Others RegexBasedDetector plugins also has this method implemented where there is a way to verify whether the token is still active. (stripe.py, slack.py)
In my test in local:
- without verify: will report if any string matches the plugin regex ("is_verified": false)
- with verify: will only report if the token is still active ("is_verified": true)
Yes, looks same as 769. Didn't see it earlier. |
|
@Chandra158 I don't see any update on that PR, so I'd go with this one. |
Please check if the PR fulfills these requirements
What kind of change does this PR introduce?
Tests
{ "type": "Telegram Bot Token", "filename": "test_data/test-bot.yaml", "hashed_secret": "c429079ee6a839ece2e7b0a6770198d8fe5ed438", "is_verified": true, "line_number": 11 },