Describe the bug
The GitHub analyzer will panic during token analysis if it encounters an API response that contains unrecognized permission scopes or if certain type assertions fail. This causes the entire rufflehog process to crash.
Specifically:
- In pkg/analyzer/analyzers/github/classic/classictoken.go, Permission.ToString() returns an error for unknown permissions, which is then handled with panic(err). As GitHub frequently adds new OAuth scopes, any encountered new scope will crash rufflehog.
- In pkg/analyzer/analyzers/github/finegrained/finegrained.go, there are panic calls for failed type assertions on RepoAccessMap and UserAccessMap.
- In pkg/analyzer/analyzers/github/finegrained/finegrained.go, an unexpected 200 OK status when testing for content write permissions triggers a panic("This should never happen...").
To Reproduce
- Provide rufflehog with a valid GitHub classic token that has a newly introduced permission scope not yet mapped in PermissionStrings.
- The GitHub analyzer runs and attempts to format the scopes.
- rufflehog crashes with a panic.
Expected behavior
The analyzer should handle unexpected API responses and unknown scopes gracefully. Unknown scopes should be formatted with a fallback string, and unexpected HTTP responses or types should result in an error or safe fallback rather than crashing the entire scanner.
Describe the bug
The GitHub analyzer will panic during token analysis if it encounters an API response that contains unrecognized permission scopes or if certain type assertions fail. This causes the entire rufflehog process to crash.
Specifically:
To Reproduce
Expected behavior
The analyzer should handle unexpected API responses and unknown scopes gracefully. Unknown scopes should be formatted with a fallback string, and unexpected HTTP responses or types should result in an error or safe fallback rather than crashing the entire scanner.