fix: stop treating HubSpot WAF 403 block pages as verified tokens - #5170
Open
pasmud wants to merge 1 commit into
Open
fix: stop treating HubSpot WAF 403 block pages as verified tokens#5170pasmud wants to merge 1 commit into
pasmud wants to merge 1 commit into
Conversation
The v2 HubSpot detector marked any 403 response as a verified token. HubSpot's WAF returns 403 with an HTML block page for requests it does not like, including requests with bogus tokens. Only API error responses (JSON) are now treated as verified.
|
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
The v2 HubSpot API key detector reports any 403 response as a verified token. HubSpot's WAF returns 403 with an HTML block page for requests it decides to block, and that can happen for bogus tokens too. So random
pat-na1-*strings end up reported as verified secrets.Changes
pkg/detectors/hubspot_apikey/v2/apikey.go: inverifyToken, a 403 is only treated as verified when the response is a HubSpot API JSON error (containscorrelationId). HTML block pages now return unverified.pkg/detectors/hubspot_apikey/v2/apikey_test.go: addedTestVerifyTokencovering 200, 401, API JSON 403, and WAF HTML 403 cases.Test plan
go test ./pkg/detectors/hubspot_apikey/...passes.go vet ./pkg/detectors/hubspot_apikey/...andgo build ./...pass.pat-na1-token gets a 401INVALID_AUTHENTICATIONfrom the API and is reported unverified, same as before.Notes
The v1 detector uses a different endpoint (
contacts/v1/lists?hapikey=) which already returns 401 for invalid keys, so it needed no change.Fixes #5164
Note
Low Risk
Scoped to HubSpot v2 verification logic and tests; reduces false positives without changing auth or data paths.
Overview
Fixes false positives where the v2 HubSpot API key detector marked any 403 as a verified token. HubSpot’s WAF can return 403 with an HTML block page for invalid or blocked requests, not only when a real token lacks permission.
verifyTokennow reads the 403 body and only counts the token as verified when the response looks like HubSpot API JSON (presence ofcorrelationId). WAF HTML pages are treated as unverified.Adds
TestVerifyTokenwith a stub HTTP transport for 200, 401, permission-denied JSON 403, and WAF HTML 403.Reviewed by Cursor Bugbot for commit e1dca70. Bugbot is set up for automated code reviews on this repo. Configure here.