Update artifactory detector with basic auth support

[zacharyyun]

Description:

Enhance artifactory detector with basic auth detection and verification

Checklist:

• Tests passing (make test-community)?
• Lint passing (make lint this requires golangci-lint)?

[CLAassistant]

All committers have signed the CLA.

[amanfcp]

Thank you for the contribution @zacharyyun

This seems like a suitable case for a V2. See this

[zacharyyun]

V1/V2 added, thanks @amanfcp

[shahzadhaider1]

Great work on this, thanks!
I have a couple of design-related suggestions around how the detector is structured that I’d like to discuss.

[shahzadhaider1]

The code looks good to me. However, when I tested it locally, the newly added Artifactory detector does not appear to detect Artifactory Basic Auth URL combinations. The URI detector successfully detects the test secrets, but when the URI detector is disabled, no results are returned. Please guide me if I am doing anything wrong. Screenshot attached.

[zacharyyun]

The code looks good to me. However, when I tested it locally, the newly added Artifactory detector does not appear to detect Artifactory Basic Auth URL combinations. The URI detector successfully detects the test secrets, but when the URI detector is disabled, no results are returned. Please guide me if I am doing anything wrong. Screenshot attached.

Missed swapping one detector field from ArtifactoryAccessToken to ArtifactoryBasicAuth, should be all set now

[shahzadhaider1]

The code looks good to me. However, when I tested it locally, the newly added Artifactory detector does not appear to detect Artifactory Basic Auth URL combinations. The URI detector successfully detects the test secrets, but when the URI detector is disabled, no results are returned. Please guide me if I am doing anything wrong. Screenshot attached.

Missed swapping one detector field from ArtifactoryAccessToken to ArtifactoryBasicAuth, should be all set now

Hey, I don’t think this addresses the issue I was referring to. What I was trying to highlight is that the reported detector type for these findings is URI, not ArtifactoryBasicAuth. That suggests the newly added detector isn’t actually detecting these secrets--they’re being picked up by the existing URI detector instead.

Could you double-check whether the basic auth credentials detected in the screenshot match the format this new detector expects?

[zacharyyun]

Could you double-check whether the basic auth credentials detected in the screenshot match the format this new detector expects?

Hi @shahzadhaider1, I double checked and confirm the credentials in your SS match the format the detector expects. I looked further into the issue and found that it looks like the new detector picks up the patterns correctly, but is placing them in the filtered_unverified bucket. If you add --results=filtered_unverified to your command it should output the expected results.

I haven't been able to figure out why my results are being put into the filtered_verification bucket after testing, if you can shed some light on how the actual filtering takes place, thanks!