kingfisher/crates/kingfisher-rules/data/rules/webex.yml
2026-04-24 00:14:56 -07:00

103 lines
2.9 KiB
YAML

rules:
- name: Webex Integration Client ID
id: kingfisher.webex.1
pattern: |
(?xi)
\b
webex
(?:.|[\n\r]){0,32}?
(?:\b|_)(?:client[_-]?id|client)\b
(?:.|[\n\r]){0,16}?
[=:"'\s]
\b
(
[A-Fa-f0-9]{64}
)
\b
pattern_requirements:
min_digits: 4
min_entropy: 3.5
confidence: medium
visible: false
examples:
- "webex_client = c0769801df88a3535b4b018ef570b499002bda401b3b8789259a937f22d66095"
- "WEBEX_CLIENT_ID=1a2b3c4d5e6f7a8b9c0d1e2f3a4b5c6d7e8f9a0b1c2d3e4f5a6b7c8d9e0f1a2b"
references:
- https://developer.webex.com/docs/platform-introduction
- name: Webex Integration Client Secret
id: kingfisher.webex.2
pattern: |
(?xi)
\b
webex
(?:.|[\n\r]){0,64}?
\b(?:client[_-]?secret|secret)\b
(?:.|[\n\r]){0,16}?
[=:"'\s]
\b
(
[A-Fa-f0-9]{64}
)
\b
pattern_requirements:
min_digits: 4
min_entropy: 3.5
confidence: medium
examples:
- "webex.secret = 8ab9b3c77035e1121e2d7d64529749682b3ce5b93dc1f1e6677f0800dcf00d1e"
- "webex\nclient_secret=1a2b3c4d5e6f7a8b9c0d1e2f3a4b5c6d7e8f9a0b1c2d3e4f5a6b7c8d9e0f1a2b"
validation:
type: Http
content:
request:
method: POST
url: https://webexapis.com/v1/access_token
headers:
Accept: application/json
Content-Type: application/x-www-form-urlencoded
body: >
grant_type=authorization_code&client_id={{ CLIENT_ID | url_encode }}&client_secret={{ TOKEN | url_encode }}&code=INVALID_AUTH_CODE&redirect_uri={{ REDIRECT_URI | url_encode }}
response_matcher:
- report_response: true
- type: StatusMatch
status: [400]
- type: WordMatch
match_all_words: false
words:
- invalid_grant
- Invalid authorization code
- type: WordMatch
words:
- invalid_client
negative: true
depends_on_rule:
- rule_id: kingfisher.webex.1
variable: CLIENT_ID
- rule_id: kingfisher.webex.3
variable: REDIRECT_URI
references:
- https://developer.webex.com/create/docs/authentication
- https://developer.webex.com/docs/integrations
- name: Webex Redirect URI
id: kingfisher.webex.3
pattern: |
(?xi)
\b
webex
(?:.|[\n\r]){0,64}?
(?:redirect[_-]?uri|oauth[_-]?redirect)\b
(?:.|[\n\r]){0,16}?
[=:"'\s]
(
https?://[^\s"'<>]{6,200}
)
min_entropy: 1.5
confidence: medium
visible: false
examples:
- WEBEX_REDIRECT_URI=https://example.com/webex/callback
- 'webex.redirect_uri = "https://localhost:3000/oauth/webex"'
references:
- https://developer.webex.com/create/docs/authentication