forked from mirrors/kingfisher
81d2f47c67
- Added rules for sendbird, mattermost, langchain, notion - JWT validation hardened to reject alg:none by default (only allowed if explicitly configured), require iss for OIDC/JWKS verification, ensuring Active Credential means cryptographically verified and time-valid, not just unexpired - Updated the Git cloning logic to include all refs and minimize clone output, allowing Kingfisher to analyze pull request and deleted branch history
66 lines
1.8 KiB
YAML
66 lines
1.8 KiB
YAML
rules:
|
|
- name: Mattermost URL
|
|
id: kingfisher.mattermost.1
|
|
pattern: |
|
|
(?xi)
|
|
\b
|
|
mattermost
|
|
(?:.|[\n\r]){0,32}?
|
|
(
|
|
https?:\/\/[a-z0-9.-]+
|
|
(?::\d{2,5})?
|
|
(?:\/[A-Za-z0-9._~\-\/]*)?
|
|
)
|
|
\b
|
|
confidence: medium
|
|
visible: false
|
|
min_entropy: 2.0
|
|
examples:
|
|
- mattermost_url = "https://community.mattermost.com"
|
|
- mattermost_url='http://localhost:8065'
|
|
- 'mattermost_url: https://intra.example.com/mattermost'
|
|
|
|
- name: Mattermost Access Token
|
|
id: kingfisher.mattermost.2
|
|
pattern: |
|
|
(?xi)
|
|
\b
|
|
mattermost
|
|
(?:.|[\n\r]){0,32}?
|
|
(?:SECRET|PRIVATE|ACCESS|KEY|TOKEN)
|
|
(?:.|[\n\r]){0,32}?
|
|
\b
|
|
(
|
|
[A-Z0-9]{26}
|
|
)
|
|
\b
|
|
confidence: medium
|
|
min_entropy: 4.0
|
|
examples:
|
|
- "mattermost_token: abcde12345fghij67890klmno1"
|
|
validation:
|
|
type: Http
|
|
content:
|
|
request:
|
|
method: GET
|
|
# Normalize any captured base that already includes /api/v4
|
|
url: >
|
|
{%- assign base = MATTERMOST_URL | replace: "/api/v4/", "/" | replace: "/api/v4", "" -%}
|
|
{{ base }}/api/v4/users/me
|
|
headers:
|
|
Authorization: "Bearer {{ TOKEN }}"
|
|
Accept: application/json
|
|
response_matcher:
|
|
- report_response: true
|
|
- type: StatusMatch
|
|
status: [200]
|
|
- type: JsonValid
|
|
- type: WordMatch
|
|
words: ['"id"', '"username"']
|
|
match_all_words: true
|
|
depends_on_rule:
|
|
- rule_id: "kingfisher.mattermost.1"
|
|
variable: MATTERMOST_URL
|
|
references:
|
|
- https://developers.mattermost.com/api-documentation/
|
|
- https://developers.mattermost.com/integrate/faq/
|