Skip to content

set redacted value to last 4 characters of secret, to match how the secret type admin interface displays it #5027

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
jordanTunstill merged 1 commit into from
Jun 10, 2026
+34 −0
Merged

set redacted value to last 4 characters of secret, to match how the secret type admin interface displays it #5027

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
1 change: 1 addition & 0 deletions pkg/detectors/contentfulpersonalaccesstoken/contentfulpersonalaccesstoken.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -41,6 +41,7 @@ func (s Scanner) FromData(ctx context.Context, verify bool, data []byte) (result
s1 := detectors.Result{
DetectorType: detector_typepb.DetectorType_ContentfulPersonalAccessToken,
Raw: []byte(keyRes),
Redacted: "..." + keyRes[len(keyRes)-4:],
SecretParts: map[string]string{"key": keyRes},
}

Expand Down
33 changes: 33 additions & 0 deletions pkg/detectors/contentfulpersonalaccesstoken/contentfulpersonalaccesstoken_test.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,6 +2,7 @@ package contentfulpersonalaccesstoken

import (
"context"
"fmt"
"testing"

"github.com/google/go-cmp/cmp"
Expand All @@ -10,6 +11,8 @@ import (
"github.com/trufflesecurity/trufflehog/v3/pkg/engine/ahocorasick"
)

const validToken = "CFPAT-fakeabcdefghijklmnopqrstuvwxyz0123456789xyz"

var (
validPattern = `
# Configuration File: config.yaml
Expand All @@ -29,6 +32,12 @@ var (
# - Remember to rotate the secret every 90 days.
# - The above credentials should only be used in a secure environment.
`

validPatternWithToken = fmt.Sprintf(`
api:
auth_type: "Bearer"
contentful_access_token: "%s"
`, validToken)
)

func TestContentfulPersonalAccessToken_Pattern(t *testing.T) {
Expand All @@ -45,6 +54,11 @@ func TestContentfulPersonalAccessToken_Pattern(t *testing.T) {
input: validPattern,
want: nil,
},
{
name: "valid pattern with token - found",
input: validPatternWithToken,
want: []string{validToken},
},
}

for _, test := range tests {
Expand Down Expand Up @@ -89,3 +103,22 @@ func TestContentfulPersonalAccessToken_Pattern(t *testing.T) {
})
}
}

func TestContentfulPersonalAccessToken_SecretRedacted(t *testing.T) {
d := Scanner{}

results, err := d.FromData(context.Background(), false, []byte(validPatternWithToken))
if err != nil {
t.Errorf("error = %v", err)
return
}

if len(results) == 0 {
t.Fatal("did not receive result")
}

want := "..." + validToken[len(validToken)-4:]
if results[0].Redacted != want {
t.Errorf("expected redacted secret to be '%s', got '%s'", want, results[0].Redacted)
}
}
Loading