trufflesecurity/trufflehog

Improve Detectors Verification Logic and Error handling

Open

#4051 opened on Apr 15, 2025

View on GitHub
 (6 comments) (0 reactions) (0 assignees)Go (26,285 stars) (2,397 forks)batch import
contributions welcomedenhancementgood first issuehelp wantedpkg/detectors

Description

Please review the Community Note before submitting

Description

Many TruffleHog detectors currently lack robust error handling in their verification logic. A common pattern observed is:

if err == nil {
    defer res.Body.Close()
    if res.StatusCode >= 200 && res.StatusCode < 300 {
        s1.Verified = true
    }
}

This approach has several shortcomings:

  • It silently ignores errors, making debugging difficult.
  • It doesn't handle non-success status codes like 401 Unauthorized or 403 Forbidden, which are critical for correctly assessing whether a secret is invalid.
  • It fails to return meaningful verification errors or reasons for failure.

Improving this by explicitly handling all error cases and status codes will lead to more reliable and informative verifications.

Preferred Solution

A straightforward solution is to update the verification logic to explicitly handle all possible errors. This includes setting a verification error in the result when any error occurs and properly handling unauthorized status codes such as 401 and 403. Be sure to test the API locally to confirm that the errors you're handling in code match the actual responses returned by the API.

Additional Context

Feel free to choose any detector that requires this refactoring. When submitting a PR, avoid linking the issue directly to prevent the issue from being closed upon merge. Instead, mention the issue in the PR description to help track all related contributions.

References

You can refer to following PR's for guidance:

Use these as a reference to refactor any detector that requires improved error handling.

Contributor guide