fix(detectors/harness): allow underscore in PAT account segment - #5153
fix(detectors/harness): allow underscore in PAT account segment#5153mattbrady-1 wants to merge 1 commit into
Conversation
Harness PAT tokens can include underscores in the 22-character account segment; widen the detector regex so live keys are found during scans. Co-authored-by: Cursor <cursoragent@cursor.com>
![cursor[bot]](https://avatars.githubusercontent.com/in/1210556?s=60&v=4){kind=small}
There was a problem hiding this comment.
Cursor Bugbot has reviewed your changes and found 1 potential issue.
❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, have a team admin enable autofix in the Cursor dashboard.
Reviewed by Cursor Bugbot for commit 3d82dc3. Configure here.
| defaultClient = common.SaneHttpClient() | ||
|
|
||
| keyPat = regexp.MustCompile(detectors.PrefixRegex([]string{"harness"}) + `\b(pat\.[A-Za-z0-9]{22}\.[0-9a-f]{24}\.[A-Za-z0-9]{20})\b`) | ||
| keyPat = regexp.MustCompile(detectors.PrefixRegex([]string{"harness"}) + `\b(pat\.[A-Za-z0-9_]{22}\.[0-9a-f]{24}\.[A-Za-z0-9]{20})\b`) |
There was a problem hiding this comment.
Regex missing hyphen for base64url account segment
Low Severity
The 22-character account segment appears to be base64url-encoded (22 chars = 128 bits, typical UUID), and base64url uses both _ (replacing /) and - (replacing +). The character class [A-Za-z0-9_]{22} adds _ but omits -, so PATs with a hyphen in the account segment remain undetected. Other detectors in the codebase (e.g., bitfinex, cloudflareapitoken, discordbottoken) use [A-Za-z0-9_-] for equivalent base64url segments.
Reviewed by Cursor Bugbot for commit 3d82dc3. Configure here.
MuneebUllahKhan222
left a comment
MuneebUllahKhan222
left a comment
There was a problem hiding this comment.
LGTM, Is there any relevant issue or article that points out this specific _ requirement?
|
@MuneebUllahKhan222 yes, I'm stumbling across the out-of-date detectors because I am creating new secrets with better analyzer permissions and resources for our demo environment. Customers will have the '_' in their secrets. |
Corpora Test ResultsScans a corpus of real-world public code against only the detectors changed in this PR, then compares unique match counts between the PR build and the main baseline to catch regex regressions. Verification is disabled — each detector's regex is measured independently. 0 new · 1 clean | Scoped to:
|
2 participants
Summary
_in the 22-character account segment of Harnesspat.*API keys so tokens likepat.YDfcEm2LT_OUZrFZv1WVlg...are detected during scans.Test plan
go test ./pkg/detectors/harness/ -run TestHarness_Pattern -vMade with Cursor