Skip to content

GH-768: Plugin to detect Telegram bot tokens #808

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 1 commit into from
Apr 30, 2024
Merged

GH-768: Plugin to detect Telegram bot tokens #808

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
1 change: 1 addition & 0 deletions README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -113,6 +113,7 @@ SlackDetector
SoftlayerDetector
SquareOAuthDetector
StripeDetector
TelegramBotTokenDetector
TwilioKeyDetector
```

Expand Down
31 changes: 31 additions & 0 deletions detect_secrets/plugins/telegram_token.py
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,31 @@
"""
This plugin searches for Telegram bot tokens
"""
import re

import requests

from ..constants import VerifiedResult
from detect_secrets.plugins.base import RegexBasedDetector


class TelegramBotTokenDetector(RegexBasedDetector):
"""Scans for Telegram bot tokens."""
secret_type = 'Telegram Bot Token'

denylist = [
# refs https://core.telegram.org/bots/api#authorizing-your-bot
re.compile(r'\d{8,10}:[0-9A-Za-z_-]{35}'),
]

def verify(self, secret: str) -> VerifiedResult: # pragma: no cover
Copy link
Contributor

@lorenzodb1 lorenzodb1 Apr 29, 2024 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Looking at other RegexBasedDetector, it doesn't look like you need a verify method like you would in a BasePlugin (see github_token.py for reference).

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

plugins.md#verified-secrets

provides the ability to decrease false positives by making an API call to a server to check whether a PotentialSecret is indeed real. This can be extremely useful for specific secrets (e.g. RegexBasedDetector subclasses) since we are able to determine which server to contact.

verify method is optional but really good in decreasing False-positives. Others RegexBasedDetector plugins also has this method implemented where there is a way to verify whether the token is still active. (stripe.py, slack.py)

In my test in local:

  • without verify: will report if any string matches the plugin regex ("is_verified": false)
  • with verify: will only report if the token is still active ("is_verified": true)

response = requests.get(
'https://api.telegram.org/bot{}/getMe'.format(
secret,
),
)
return (
VerifiedResult.VERIFIED_TRUE
if response.status_code == 200
else VerifiedResult.VERIFIED_FALSE
)
22 changes: 22 additions & 0 deletions tests/plugins/telegram_token_test.py
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,22 @@
import pytest

from detect_secrets.plugins.telegram_token import TelegramBotTokenDetector


class TestTelegramTokenDetector:

@pytest.mark.parametrize(
'payload, should_flag',
[
('bot110201543:AAHdqTcvCH1vGWJxfSe1ofSAs0K5PALDsaw', True),
('110201543:AAHdqTcvCH1vGWJxfSe1ofSAs0K5PALDsaw', True),
('7213808860:AAH1bjqpKKW3maRSPAxzIU-0v6xNuq2-NjM', True),
('foo:AAH1bjqpKKW3maRSPAxzIU-0v6xNuq2-NjM', False),
('foo', False),
],
)
def test_analyze(self, payload, should_flag):
logic = TelegramBotTokenDetector()
output = logic.analyze_line(filename='mock_filename', line=payload)

assert len(output) == int(should_flag)
Loading