Added detector for JFrog Artifactory Reference Tokens#4684
Added detector for JFrog Artifactory Reference Tokens#4684shahzadhaider1 wants to merge 4 commits intotrufflesecurity:mainfrom
Conversation
pkg/detectors/artifactoryreferencetoken/artifactoryreferencetoken.go
Outdated
Show resolved
Hide resolved
shahzadhaider1
changed the title
![cursor[bot]](https://avatars.githubusercontent.com/in/1210556?s=60&v=4){kind=small}
shahzadhaider1
force-pushed
the
INS-263-add-artifactory-reference-token-detector
branch
from
1ec9128 to
9ecd554
Compare
There was a problem hiding this comment.
Cursor Bugbot has reviewed your changes and found 1 potential issue.
Bugbot Autofix is OFF. To automatically fix reported issues with Cloud Agents, enable Autofix in the Cursor dashboard.
| _ detectors.Detector = (*Scanner)(nil) | ||
| _ detectors.EndpointCustomizer = (*Scanner)(nil) | ||
|
|
||
| defaultClient = common.SaneHttpClient() |
There was a problem hiding this comment.
HTTP client lacks SSRF protection unlike sibling detector
Medium Severity
The defaultClient uses common.SaneHttpClient(), while the sibling artifactory.go detector (same URL pattern, same endpoint structure) uses detectors.DetectorHttpClientWithNoLocalAddresses. The latter provides two critical properties: it blocks connections to local/private IPs (SSRF protection) and disables automatic redirect following (WithNoFollowRedirects()). Since this detector sends Bearer tokens to URLs derived from scanned content and configured endpoints, matching the sibling detector's SSRF-safe client is important. Additionally, because SaneHttpClient() follows redirects, the comment mentioning "302" in the default case is misleading — a 302 response would never reach that code path in production.
Additional Locations (1)
4 participants
Summary
Adds a new detector for JFrog Artifactory Reference Tokens. Unlike JWT tokens (which start with
eyJ), reference tokens are base64-encoded strings with a predictable structure:When base64-encoded, this always produces a token starting with
cmVmdGtu.Detection
Regex pattern:
cmVmdGtu(8 chars): base64 encoding of "reftkn"Keyword:
cmVmdGtuVerification
Tokens are verified against the JFrog Access API:
This endpoint returns token metadata if valid. Available since Artifactory 7.53.1.
Response handling:
References
Checklist:
make test-community)?make lintthis requires golangci-lint)?