Skip to content

Commit 116e717

Browse files
MuneebUllahKhan222MuneebUllahKhan222
authored
[INS-243] Fix jdbc detector detecting incomplete connection string and fixed invalid… (#4636)
* Fix jdbc detector detecting incomplete conn string and fixed invalid parsing of sql server string * [INS-165] Jdbc detector integration tests fix (#4637) * [INS-165] Fix Jdbc tests and updated the deprecated code
1 parent b924c0b commit 116e717

File tree

8 files changed

+81
-22
lines changed

8 files changed

+81
-22
lines changed

‎pkg/detectors/jdbc/jdbc.go‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -50,7 +50,8 @@ var _ detectors.Detector = (*Scanner)(nil)
5050
var _ detectors.CustomFalsePositiveChecker = (*Scanner)(nil)
5151

5252
var (
53-
keyPat = regexp.MustCompile(`(?i)jdbc:[\w]{3,10}:[^\s"'<>,(){}[\]&]{10,512}`)
53+
// Matches typical JDBC connection strings amd ingores any special character at the end
54+
keyPat = regexp.MustCompile(`(?i)jdbc:[\w]{3,10}:[^\s"'<>,{}[\]]{10,511}[A-Za-z0-9]`)
5455
)
5556

5657
// Keywords are used for efficiently pre-filtering chunks.

‎pkg/detectors/jdbc/jdbc_integration_test.go‎

Lines changed: 18 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -29,8 +29,8 @@ func TestJdbcVerified(t *testing.T) {
2929
postgresUser := gofakeit.Username()
3030
postgresPass := gofakeit.Password(true, true, true, false, false, 10)
3131
postgresDB := gofakeit.Word()
32-
postgresContainer, err := postgres.RunContainer(ctx,
33-
testcontainers.WithImage("postgres:13-alpine"),
32+
postgresContainer, err := postgres.Run(ctx,
33+
"postgres:13-alpine",
3434
postgres.WithDatabase(postgresDB),
3535
postgres.WithUsername(postgresUser),
3636
postgres.WithPassword(postgresPass),
@@ -56,8 +56,8 @@ func TestJdbcVerified(t *testing.T) {
5656
mysqlUser := gofakeit.Username()
5757
mysqlPass := gofakeit.Password(true, true, true, false, false, 10)
5858
mysqlDatabase := gofakeit.Word()
59-
mysqlC, err := mysql.RunContainer(ctx,
60-
mysql.WithDatabase(mysqlDatabase),
59+
mysqlC, err := mysql.Run(ctx,
60+
"mysql:8.0.36",
6161
mysql.WithUsername(mysqlUser),
6262
mysql.WithPassword(mysqlPass),
6363
)
@@ -79,8 +79,8 @@ func TestJdbcVerified(t *testing.T) {
7979
sqlServerPass := gofakeit.Password(true, true, true, false, false, 10)
8080
sqlServerDatabase := "master"
8181

82-
mssqlContainer, err := mssql.RunContainer(ctx,
83-
testcontainers.WithImage("mcr.microsoft.com/azure-sql-edge"),
82+
mssqlContainer, err := mssql.Run(ctx,
83+
"mcr.microsoft.com/azure-sql-edge",
8484
mssql.WithAcceptEULA(),
8585
mssql.WithPassword(sqlServerPass),
8686
)
@@ -125,6 +125,10 @@ func TestJdbcVerified(t *testing.T) {
125125
Verified: true,
126126
Redacted: fmt.Sprintf("jdbc:postgresql://%s:%s/%s?sslmode=disable&password=%s&user=%s",
127127
postgresHost, postgresPort.Port(), postgresDB, strings.Repeat("*", len(postgresPass)), postgresUser),
128+
AnalysisInfo: map[string]string{
129+
"connection_string": fmt.Sprintf("jdbc:postgresql://%s:%s/%s?sslmode=disable&password=%s&user=%s",
130+
postgresHost, postgresPort.Port(), postgresDB, postgresPass, postgresUser),
131+
},
128132
},
129133
},
130134
wantErr: false,
@@ -143,6 +147,10 @@ func TestJdbcVerified(t *testing.T) {
143147
Verified: true,
144148
Redacted: fmt.Sprintf(`jdbc:mysql://%s:%s@tcp(%s:%s)/%s`,
145149
mysqlUser, strings.Repeat("*", len(mysqlPass)), mysqlHost, mysqlPort.Port(), mysqlDatabase),
150+
AnalysisInfo: map[string]string{
151+
"connection_string": fmt.Sprintf(`jdbc:mysql://%s:%s@tcp(%s:%s)/%s`,
152+
mysqlUser, mysqlPass, mysqlHost, mysqlPort.Port(), mysqlDatabase),
153+
},
146154
},
147155
},
148156
wantErr: false,
@@ -161,6 +169,10 @@ func TestJdbcVerified(t *testing.T) {
161169
Verified: true,
162170
Redacted: fmt.Sprintf("jdbc:sqlserver://odbc:server=%s;port=%s;database=%s;password=%s",
163171
sqlServerHost, sqlServerPort.Port(), sqlServerDatabase, strings.Repeat("*", len(sqlServerPass))),
172+
AnalysisInfo: map[string]string{
173+
"connection_string": fmt.Sprintf("jdbc:sqlserver://odbc:server=%s;port=%s;database=%s;password=%s",
174+
sqlServerHost, sqlServerPort.Port(), sqlServerDatabase, sqlServerPass),
175+
},
164176
},
165177
},
166178
wantErr: false,

‎pkg/detectors/jdbc/jdbc_test.go‎

Lines changed: 10 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -40,6 +40,8 @@ func TestJdbc_Pattern(t *testing.T) {
4040
<jdbc-url>jdbc:mysql:localhost:3306/mydatabase</jdbc-url>
4141
<jdbc-url>jdbc:sqlserver://x.x.x.x:1433;databaseName=MY-DB;user=MY-USER;password=MY-PASSWORD;encrypt=false</jdbc-url>
4242
<jdbc-url>jdbc:sqlserver://localhost:1433;databaseName=AdventureWorks</jdbc-url>
43+
<jdbc-url>(jdbc:mysql://testuser:testpassword@tcp(localhost:1521)/testdb)</jdbc-url>
44+
<jdbc-url>jdbc:postgresql://localhost:1521/testdb?sslmode=disable&password=testpassword&user=testuser&</jdbc-url>
4345
<working-dir>$ProjectFileDir$</working-dir>
4446
</data-source>
4547
</component>
@@ -50,6 +52,8 @@ func TestJdbc_Pattern(t *testing.T) {
5052
"jdbc:mysql:localhost:3306/mydatabase",
5153
"jdbc:sqlserver://x.x.x.x:1433;databaseName=MY-DB;user=MY-USER;password=MY-PASSWORD;encrypt=false",
5254
"jdbc:sqlserver://localhost:1433;databaseName=AdventureWorks",
55+
"jdbc:mysql://testuser:testpassword@tcp(localhost:1521)/testdb",
56+
"jdbc:postgresql://localhost:1521/testdb?sslmode=disable&password=testpassword&user=testuser",
5357
},
5458
},
5559
{
@@ -64,15 +68,19 @@ func TestJdbc_Pattern(t *testing.T) {
6468
"jdbc:oracle:thin:@host:1521:db",
6569
"jdbc:mysql://host:3306/db,other_param",
6670
"jdbc:db2://host:50000/db?param=1"
67-
]
68-
}`,
71+
"jdbc:postgresql://localhost:1521/testdb?sslmode=disable&password=testpassword&user=testuser"
72+
"jdbc:mysql://testuser:testpassword@tcp(localhost:1521)/testdb"
73+
]
74+
}`,
6975
want: []string{
7076
"jdbc:postgresql://localhost:5432/mydb",
7177
"jdbc:mysql://user:pass@host:3306/db?param=1",
7278
"jdbc:sqlite:/data/test.db",
7379
"jdbc:oracle:thin:@host:1521:db",
7480
"jdbc:mysql://host:3306/db",
7581
"jdbc:db2://host:50000/db?param=1",
82+
"jdbc:postgresql://localhost:1521/testdb?sslmode=disable&password=testpassword&user=testuser",
83+
"jdbc:mysql://testuser:testpassword@tcp(localhost:1521)/testdb",
7684
},
7785
},
7886
{

‎pkg/detectors/jdbc/mysql_integration_test.go‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -23,7 +23,8 @@ func TestMySQL(t *testing.T) {
2323

2424
ctx := context.Background()
2525

26-
mysqlC, err := mysql.RunContainer(ctx,
26+
mysqlC, err := mysql.Run(ctx,
27+
"mysql:8.0.36",
2728
mysql.WithDatabase(mysqlDatabase),
2829
mysql.WithUsername(mysqlUser),
2930
mysql.WithPassword(mysqlPass),

‎pkg/detectors/jdbc/postgres_integration_test.go‎

Lines changed: 2 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -6,7 +6,6 @@ package jdbc
66
import (
77
"context"
88
"fmt"
9-
"log"
109
"testing"
1110
"time"
1211

@@ -34,8 +33,8 @@ func TestPostgres(t *testing.T) {
3433
t.Log("dbName: ", dbName)
3534

3635
ctx := context.Background()
37-
postgresContainer, err := postgres.RunContainer(ctx,
38-
testcontainers.WithImage("postgres:13-alpine"),
36+
postgresContainer, err := postgres.Run(ctx,
37+
"postgres:13-alpine",
3938
postgres.WithDatabase(dbName),
4039
postgres.WithUsername(user),
4140
postgres.WithPassword(pass),
@@ -56,10 +55,6 @@ func TestPostgres(t *testing.T) {
5655
if err != nil {
5756
t.Fatal(err)
5857
}
59-
60-
if err != nil {
61-
log.Fatalf("failed to start container: %s", err)
62-
}
6358
defer postgresContainer.Terminate(ctx)
6459

6560
tests := []struct {

‎pkg/detectors/jdbc/sqlserver.go‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -73,6 +73,11 @@ func parseSqlServer(ctx logContext.Context, subname string) (JDBC, error) {
7373
continue
7474
}
7575

76+
// incase there is a bridge between jdbc and some driver like "odbc", and conn string looks like this odbc:server
77+
if split := strings.Split(key, ":"); len(split) > 1 {
78+
key = split[1]
79+
}
80+
7681
switch strings.ToLower(key) {
7782
case "password", "spring.datasource.password", "pwd":
7883
password = value

‎pkg/detectors/jdbc/sqlserver_integration_test.go‎

Lines changed: 6 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -10,8 +10,8 @@ import (
1010

1111
"github.com/brianvoe/gofakeit/v7"
1212
"github.com/stretchr/testify/assert"
13-
"github.com/testcontainers/testcontainers-go"
1413
"github.com/testcontainers/testcontainers-go/modules/mssql"
14+
logContext "github.com/trufflesecurity/trufflehog/v3/pkg/context"
1515
)
1616

1717
func TestSqlServer(t *testing.T) {
@@ -21,8 +21,8 @@ func TestSqlServer(t *testing.T) {
2121
sqlServerPass := gofakeit.Password(true, true, true, false, false, 10)
2222
sqlServerDB := "master"
2323

24-
mssqlContainer, err := mssql.RunContainer(ctx,
25-
testcontainers.WithImage("mcr.microsoft.com/azure-sql-edge"),
24+
mssqlContainer, err := mssql.Run(ctx,
25+
"mcr.microsoft.com/azure-sql-edge",
2626
mssql.WithAcceptEULA(),
2727
mssql.WithPassword(sqlServerPass),
2828
)
@@ -61,7 +61,7 @@ func TestSqlServer(t *testing.T) {
6161
want: result{pingOk: true, pingDeterminate: true},
6262
},
6363
{
64-
input: "//server=badhost;user id=sa;database=master;password=",
64+
input: fmt.Sprintf("//server=badhost;user id=sa;database=master;password=%s", sqlServerPass),
6565
want: result{pingOk: false, pingDeterminate: false},
6666
},
6767
{
@@ -81,7 +81,8 @@ func TestSqlServer(t *testing.T) {
8181
}
8282
for _, tt := range tests {
8383
t.Run(tt.input, func(t *testing.T) {
84-
j, err := parseSqlServer(tt.input)
84+
ctx := logContext.AddLogger(context.Background())
85+
j, err := ParseSqlServer(ctx, tt.input)
8586

8687
if err != nil {
8788
got := result{parseErr: true}

‎pkg/detectors/jdbc/sqlserver_test.go‎

Lines changed: 36 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -118,6 +118,42 @@ func TestParseSqlServerUserIgnoredBug2(t *testing.T) {
118118
}
119119
}
120120

121+
func TestParseSqlServerWithJdbcAndOdbcBridgeString(t *testing.T) {
122+
subname := "//odbc:server=localhost;port=1433;database=testdb;password=testpassword"
123+
124+
wantHost := "localhost"
125+
wantPort := "1433"
126+
wantPassword := "testpassword"
127+
wantDatabase := "testdb"
128+
129+
ctx := logContext.AddLogger(context.Background())
130+
131+
j, err := parseSqlServer(ctx, subname)
132+
if err != nil {
133+
t.Fatalf("parseSqlServer() error = %v", err)
134+
}
135+
136+
if j == nil {
137+
t.Fatalf("parseSqlServer() returned nil, expected valid connection.")
138+
}
139+
140+
sqlServerConn, ok := j.(*SqlServerJDBC)
141+
if !ok {
142+
t.Fatalf("parseSqlServer() returned unexpected type %T, expected *SqlServerJDBC", j)
143+
}
144+
145+
if sqlServerConn.Host != wantHost+":"+wantPort {
146+
t.Errorf("Host mismatch. Got: %s, Want: %s", sqlServerConn.Host, wantHost+":"+wantPort)
147+
}
148+
149+
if sqlServerConn.Password != wantPassword {
150+
t.Errorf("Password mismatch. Got: %s, Want: %s", sqlServerConn.Password, wantPassword)
151+
}
152+
153+
if sqlServerConn.Database != wantDatabase {
154+
t.Errorf("Database mismatch. Got: %s, Want: %s", sqlServerConn.Database, wantDatabase)
155+
}
156+
}
121157
func TestSQLServerHandler_ParseJDBCURL(t *testing.T) {
122158
tests := []struct {
123159
name string

0 commit comments

Comments
 (0)