Atlassian Token Detector

[ankushgoel27]

Description:

This PR adds the Atlassian Admin api token detector.

I don't have a working V1 token to test but before 2023, there was an older format.

References:
https://support.atlassian.com/organization-administration/docs/manage-an-organization-with-the-admin-apis/
https://developer.atlassian.com/cloud/admin/organization/rest/api-group-orgs/#api-v1-orgs-get

Checklist:

• Tests passing (make test-community)?
• Lint passing (make lint this requires golangci-lint)?

[ankushgoel27]

Fixed version

[ahrav]

suggestion: I don’t believe the regex is quite correct. The + after the first character set ([A-Za-z0-9+/=_-]+) allows for additional characters. While this is unlikely, we could avoid it by using exact character counts.

For example, here’s a revoked token:

ATCTT3xFfGN0lrL3T46HpEVWoOPlVEdOOIjhHfJizEXhYButp76pIT6y0YmHBfCq4-HVJ_PP0GMOkywZj42ns74TvCjtsXZE0SgqpvM-mc2gzwrATbVLgupnFHS5DpUgBA7CM5F0T-hJRd3QSch5aM33ih68tc92D00SnFCNbdR9Nw5Z2UtOwII=8A96C53E

But if I include a few more characters, it still matches:

ATCTT3xFfGN0lrL3T46HpEVWoOPlVEoooodOOIjhHfJizEXhYButp76pIT6y0YmHBfCq4-HVJ_PP0GMOkywZj42ns74TvCjtsXZE0SgqpvM-mc2gzwrATbVLgupnFHS5DpUgBA7CM5F0T-hJRd3QSch5aM33ih68tc92D00SnFCNbdR9Nw5Z2UtOwII=8A96C53E

I’ve also noticed that tokens created through the admin section often start with ATCTT, while others start with ATATT. They also share a "common identifier" after the prefix, 3xFfG.

What do you think about tightening the regex to something like: \b((?:ATCTT|ATATT)3xFfG[A-Za-z0-9-_=]{173}=[A-Za-z0-9]{8})\b? This way, we can adjust the keywords to ATATT and ATCTT and remove the detectors.PrefixRegex.

If this detector is only for tokens prefixed with ATCTT, and we’ll have a separate detector for ATATT, we can use the single prefix.

[ankushgoel27]

Hello @ahrav

On 18 Jan 2023, we extended the length of API tokens for Atlassian accounts. Using a varied length, rather than a fixed length, ensures tokens are more secure and reliable. Tokens created before 18 Jan 2023 were not affected.

according to atlassian documentation, the api keys generated are varied length . that's why i have the + sign. It is the same exact regex used in the jira detector.

I also tried to create multiple keys and this first part was the same for admin keys - ATCTT3xFfGN0 and all keys were exact 192 char length so atlassian is still not using varied key length even though their documentation says otherwise.

i am happy to use your regex if it get rid of the prefix regex. Let's not use ATATT since it could clash with the jira detector.

let me know how to proceed.

[ahrav]

Thanks for the additional context. I as unaware of the variable length aspect. I think in that case, let's just update the prefix and keyword but use the original regex which included the +. By using the more specific keyword we'll be able to filter out a lot more potential matches earlier in the detection pipeline.

Thanks for the explanation.

[ankushgoel27]

Hi @ahrav , i have fixed the regex in my new commit. please validate

[ahrav]

I've added the test token and the tests look good. Thanks again Ankush, appreciate your patience on getting this in.