Add draft detector for the Smartling API Secrets [INS-38] #4459
Conversation
|
|
mustansir14
changed the title
pkg/detectors/smartling/smartling.go
Outdated
| return | ||
| } | ||
|
|
||
| func verifyMatch(ctx context.Context, client *http.Client, userId string, secret string) (bool, map[string]string, error) { |
There was a problem hiding this comment.
The verification function doesn't really need to return a map[string]string since it's always nil
There was a problem hiding this comment.
Good catch. I'll remove it.
pkg/detectors/smartling/smartling.go
Outdated
| case http.StatusBadRequest: | ||
| // The request was malformed. We can't verify this secret, but it might be valid. | ||
| return false, nil, fmt.Errorf("received HTTP 400 Bad Request from Smartling API") | ||
| case http.StatusTooManyRequests: | ||
| // We have been rate limited. We can't verify this secret, but it might be valid. | ||
| return false, nil, fmt.Errorf("received HTTP 429 Too Many Requests from Smartling API") |
There was a problem hiding this comment.
I'm not quite sure why we need to describe these cases, since they are covered in default?
There was a problem hiding this comment.
This is done to provide specific errors for each case, and also as a measure to include all response status codes specified in the documentation.
There was a problem hiding this comment.
Hmm.. I don't see any specific info in either of the error messages not covered in the default case since the status code is being logged in it as well. This is definitely a nit though, so feel free to ignore.
There was a problem hiding this comment.
Hmm, makes sense. I'll remove them.
Description:
This PR adds an initial detector for Smartling API credentials.
Notes
userIdentifieranduserSecretare best guesses based on public documentation and example screenshots.gock) with dummy values to exercise verification flow. These should be updated once we have access to real credentials.Marking as draft since the detector is not production-ready until regexes and verification can be confirmed.
References (used to infer credential formats)
Checklist:
make test-community)?make lintthis requires golangci-lint)?