Split TrueNAS API Key rule and make it stricter

CHANGELOG.md

@@ -14,7 +14,8 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 
   - Docker Hub Personal Access Token ([#108](https://github.com/praetorian-inc/noseyparker/pull/108) - thank you @gemesa!)
   - Dropbox Access Token ([#106](https://github.com/praetorian-inc/noseyparker/pull/106) - thank you @gemesa!)
-  - TrueNAS API Key
+  - TrueNAS API Key (WebSocket)
+  - TrueNAS API Key (REST API)
   - WireGuard Private Key ([#104](https://github.com/praetorian-inc/noseyparker/pull/104) - thank you @gemesa!)
   - WireGuard Preshared Key ([#104](https://github.com/praetorian-inc/noseyparker/pull/104) - thank you @gemesa!)
 

README.md

@@ -4,7 +4,7 @@ Nosey Parker is a command-line tool that finds secrets and sensitive information
 
 **Key features:**
 - It supports scanning files, directories, and the entire history of Git repositories
-- It uses regular expression matching with a set of 119 patterns chosen for high signal-to-noise based on experience and feedback from offensive security engagements
+- It uses regular expression matching with a set of 120 patterns chosen for high signal-to-noise based on experience and feedback from offensive security engagements
 - It groups matches together that share the same secret, further emphasizing signal over noise
 - It is fast: it can scan at hundreds of megabytes per second on a single core, and is able to scan 100GB of Linux kernel source history in less than 2 minutes on an older MacBook Pro
 

crates/noseyparker-cli/tests/rules/snapshots/test_noseyparker__rules__rules_check_builtins-2.snap

@@ -2,5 +2,5 @@
 source: crates/noseyparker-cli/tests/rules/mod.rs
 expression: stdout
 ---
-119 rules and 3 rulesets: no issues detected
+120 rules and 3 rulesets: no issues detected
 

crates/noseyparker-cli/tests/rules/snapshots/test_noseyparker__rules__rules_list_json-2.snap

@@ -458,7 +458,11 @@ expression: stdout
     },
     {
       "id": "np.truenas.1",
-      "name": "TrueNAS API Key"
+      "name": "TrueNAS API Key (WebSocket)"
+    },
+    {
+      "id": "np.truenas.2",
+      "name": "TrueNAS API Key (REST API)"
     },
     {
       "id": "np.twilio.1",
@@ -485,7 +489,7 @@ expression: stdout
     {
       "id": "default",
       "name": "Nosey Parker default rules",
-      "num_rules": 99
+      "num_rules": 100
     },
     {
       "id": "np.assets",

crates/noseyparker-cli/tests/rules/snapshots/test_noseyparker__rules__rules_list_noargs-2.snap

@@ -118,7 +118,8 @@ expression: stdout
  np.stripe.1         Stripe API Key 
  np.stripe.2         Stripe API Test Key 
  np.telegram.1       Telegram Bot Token 
- np.truenas.1        TrueNAS API Key 
+ np.truenas.1        TrueNAS API Key (WebSocket) 
+ np.truenas.2        TrueNAS API Key (REST API) 
  np.twilio.1         Twilio API Key 
  np.twitter.1        Twitter Client ID 
  np.twitter.2        Twitter Secret Key 
@@ -127,7 +128,7 @@ expression: stdout
 
  Ruleset ID   Ruleset Name                         Rules 
 ─────────────────────────────────────────────────────────
- default      Nosey Parker default rules              99 
+ default      Nosey Parker default rules             100 
  np.assets    Nosey Parker asset detection rules      15 
  np.hashes    Nosey Parker password hash rules         5 
 

crates/noseyparker/data/default/builtin/rules/truenas.yml

@@ -1,21 +1,44 @@
 rules:
 
-- name: TrueNAS API Key
+- name: TrueNAS API Key (WebSocket)
   id: np.truenas.1
 
   pattern: |
     (?x)
-    \b
+    "params"\s*:\s*\[\s*"
     (\d+-[a-zA-Z0-9]{64})
-    \b
+    "\s*\]
 
   examples:
   - '{"id":"3286a508-a6ca-278a-c078-85b2b515d8d2", "msg":"method", "method":"auth.login_with_api_key", "params":["8-Lp22ov7halMBLUpG97Wg4y7fibQi3CW19VJiZcCu746zgCs0mdDdTCoOcpgEucgu"]}'
-  - '{"id":"677d9914-f598-f497-e77e-2a3aadbb822e", "msg":"method", "method":"auth.login_with_api_key", "params":["9-hTSZDBPyg0PjRZvWb8omoxJ7X2gAjRGmiPKql9ENGIUP9OPtEAzz5f6g9YIMVbZT"]}'
-  - '{"id":"2755dad4-cc12-94bb-a894-ba0f85c3fdbf", "msg":"method", "method":"auth.login_with_api_key", "params":["10-6LZBVhNq8zze0rzXJptfSWDBoskWuThnQb3fUVw4sVNgJ7GKT3ITVIovhwPf34oL"]}'
+  - '{"id":"677d9914-f598-f497-e77e-2a3aadbb822e", "msg":"method", "method":"auth.login_with_api_key", "params" : ["9-hTSZDBPyg0PjRZvWb8omoxJ7X2gAjRGmiPKql9ENGIUP9OPtEAzz5f6g9YIMVbZT"]}'
+  - '{"id":"2755dad4-cc12-94bb-a894-ba0f85c3fdbf", "msg":"method", "method":"auth.login_with_api_key", "params" : [ "10-6LZBVhNq8zze0rzXJptfSWDBoskWuThnQb3fUVw4sVNgJ7GKT3ITVIovhwPf34oL" ]}'
+
+  references:
+  - https://www.truenas.com/docs/api/core_websocket_api.html
+  - https://www.truenas.com/docs/api/scale_rest_api.html
+  - https://www.truenas.com/docs/scale/scaletutorials/toptoolbar/managingapikeys/
+  - https://www.truenas.com/docs/scale/scaleclireference/auth/cliapikey/
+  - https://www.truenas.com/docs/scale/api/
+  - https://www.truenas.com/community/threads/api-examples-in-perl-python.108053/
+
+- name: TrueNAS API Key (REST API)
+  id: np.truenas.2
+
+  pattern: |
+    (?x)
+    Bearer\s*
+    (\d+-[a-zA-Z0-9]{64})
+    \b
+
+  examples:
+  # only "Bearer" is accepted by TrueNAS API (no "bearer" etc.)
+  - 'curl -X POST "http://192.168.0.30/api/v2.0/device/get_info" -H "Content-Type: application/json" -H "Authorization: Bearer 8-Lp22ov7halMBLUpG97Wg4y7fibQi3CW19VJiZcCu746zgCs0mdDdTCoOcpgEucgu" -d "\"SERIAL\""'
 
   references:
   - https://www.truenas.com/docs/api/core_websocket_api.html
+  - https://www.truenas.com/docs/api/scale_rest_api.html
   - https://www.truenas.com/docs/scale/scaletutorials/toptoolbar/managingapikeys/
   - https://www.truenas.com/docs/scale/scaleclireference/auth/cliapikey/
   - https://www.truenas.com/docs/scale/api/
+  - https://www.truenas.com/community/threads/api-examples-in-perl-python.108053/

crates/noseyparker/data/default/builtin/rulesets/default.yml

@@ -109,7 +109,8 @@ rulesets:
   - np.stripe.1       # Stripe API Key
   - np.stripe.2       # Stripe API Test Key
   - np.telegram.1     # Telegram Bot Token
-  - np.truenas.1      # TrueNAS API Key
+  - np.truenas.1      # TrueNAS API Key (WebSocket)
+  - np.truenas.2      # TrueNAS API Key (REST API)
   - np.twilio.1       # Twilio API Key
   - np.twitter.2      # Twitter Secret Key
   - np.wireguard.1    # WireGuard Private Key