diff --git a/pkg/detectors/ftp/ftp.go b/pkg/detectors/ftp/ftp.go index a7c34840bb86..ead7be4ba2f8 100644 --- a/pkg/detectors/ftp/ftp.go +++ b/pkg/detectors/ftp/ftp.go @@ -50,12 +50,17 @@ func (s Scanner) FromData(ctx context.Context, verify bool, data []byte) (result if _, ok := parsedURL.User.Password(); !ok { continue } + if parsedURL.User.Username() == "anonymous" { + continue + } - redact := strings.TrimSpace(strings.Replace(urlMatch, password, strings.Repeat("*", len(password)), -1)) + rawURL, _ := url.Parse(urlMatch) + rawURL.Path = "" + redact := strings.TrimSpace(strings.Replace(rawURL.String(), password, "********", -1)) s := detectors.Result{ DetectorType: detectorspb.DetectorType_FTP, - Raw: []byte(urlMatch), + Raw: []byte(rawURL.String()), Redacted: redact, } @@ -70,7 +75,7 @@ func (s Scanner) FromData(ctx context.Context, verify bool, data []byte) (result } } - if !s.Verified && detectors.IsKnownFalsePositive(string(s.Raw), detectors.DefaultFalsePositives, false) { + if detectors.IsKnownFalsePositive(string(s.Raw), []detectors.FalsePositive{"@ftp.freebsd.org"}, false) { continue } diff --git a/pkg/detectors/ftp/ftp_test.go b/pkg/detectors/ftp/ftp_test.go index 16a6d61bf496..c56d87c305a3 100644 --- a/pkg/detectors/ftp/ftp_test.go +++ b/pkg/detectors/ftp/ftp_test.go @@ -12,7 +12,7 @@ import ( "github.com/trufflesecurity/trufflehog/v3/pkg/pb/detectorspb" ) -func TestURI_FromChunk(t *testing.T) { +func TestFTP_FromChunk(t *testing.T) { type args struct { ctx context.Context data []byte @@ -71,6 +71,16 @@ func TestURI_FromChunk(t *testing.T) { }, wantErr: false, }, + { + name: "blocked FP", + s: Scanner{}, + args: args{ + ctx: context.Background(), + data: []byte("ftp://abc:123@ftp.freebsd.org/pub/FreeBSD/doc/tr/articles/explaining-bsd/explaining-bsd_tr.pdf"), + verify: true, + }, + wantErr: false, + }, } for _, tt := range tests { t.Run(tt.name, func(t *testing.T) { diff --git a/pkg/detectors/redis/redis.go b/pkg/detectors/redis/redis.go index f68ab3b0f442..3487e564ea6f 100644 --- a/pkg/detectors/redis/redis.go +++ b/pkg/detectors/redis/redis.go @@ -50,7 +50,7 @@ func (s Scanner) FromData(ctx context.Context, verify bool, data []byte) (result continue } - redact := strings.TrimSpace(strings.Replace(urlMatch, password, strings.Repeat("*", len(password)), -1)) + redact := strings.TrimSpace(strings.Replace(urlMatch, password, "********", -1)) s := detectors.Result{ DetectorType: detectorspb.DetectorType_Redis, diff --git a/pkg/detectors/uri/uri.go b/pkg/detectors/uri/uri.go index 430fa0110509..6b3526a7cbae 100644 --- a/pkg/detectors/uri/uri.go +++ b/pkg/detectors/uri/uri.go @@ -71,8 +71,7 @@ func (s Scanner) FromData(ctx context.Context, verify bool, data []byte) (result rawURL, _ := url.Parse(urlMatch) rawURL.Path = "" - - redact := strings.TrimSpace(strings.Replace(rawURL.String(), password, strings.Repeat("*", len(password)), -1)) + redact := strings.TrimSpace(strings.Replace(rawURL.String(), password, "********", -1)) s := detectors.Result{ DetectorType: detectorspb.DetectorType_URI,