Skip to content

Adding telegram bot token validator#587

Merged
eddynaka merged 6 commits into
mainfrom
users/ednakamu/telegram-bot-token-validator
Dec 8, 2021
Merged

Adding telegram bot token validator#587
eddynaka merged 6 commits into
mainfrom
users/ednakamu/telegram-bot-token-validator

Conversation

@eddynaka

@eddynaka eddynaka commented Nov 30, 2021

Copy link
Copy Markdown
Collaborator

Changes

This is a new rule which will look for telegram bot tokens. If any match is found, the dynamic validation will be able to check if this is still live or not, updating the finngerprint.id with the username of the bot if available.

For significant contributions please make sure you have completed the following items:

  • ReleaseHistory.md updated for non-trivial changes
  • Added unit tests

@eddynaka eddynaka marked this pull request as ready for review December 7, 2021 16:03
"MessageArguments": { "secretKind": "Crates API key" }
},
{
"Id": "SEC101/049",

@michaelcfanning michaelcfanning Dec 8, 2021

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

049

Where is rule 048? Did you skip it? #Resolved

Copy link
Copy Markdown
Collaborator Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

it is the other open pr

case HttpStatusCode.Forbidden:
case HttpStatusCode.Unauthorized:
{
return ValidationState.Unauthorized;

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

ValidationState.Unauthorized

Isn't there a helper for returning this condition?

Copy link
Copy Markdown
Collaborator Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

we have, but we require an id, for example. in this case, this does not apply.

string content = response.Content.ReadAsStringAsync().GetAwaiter().GetResult();
ResultRoot resultRoot = JsonConvert.DeserializeObject<ResultRoot>(content);

fingerprint.Id = resultRoot?.Result?.Username;

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

fingerprint.Id

Why are you updating the ID? by changing the fingerprint, you will break matches against the static analysis only phase, won't you?

Copy link
Copy Markdown
Collaborator Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

in the cosmos analysis, it would change only the asset fingerprint.

in the client analysis, yes, it would change both.

@michaelcfanning michaelcfanning left a comment

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

:shipit:

@eddynaka eddynaka merged commit ad1cf35 into main Dec 8, 2021
@eddynaka eddynaka deleted the users/ednakamu/telegram-bot-token-validator branch December 8, 2021 21:53
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants