Skip to content

[Bug] GitHub Analyzer panics when encountering unrecognized permission scopes #5335

Description

@Gracy769

Describe the bug
The GitHub analyzer will panic during token analysis if it encounters an API response that contains unrecognized permission scopes or if certain type assertions fail. This causes the entire rufflehog process to crash.

Specifically:

  1. In pkg/analyzer/analyzers/github/classic/classictoken.go, Permission.ToString() returns an error for unknown permissions, which is then handled with panic(err). As GitHub frequently adds new OAuth scopes, any encountered new scope will crash rufflehog.
  2. In pkg/analyzer/analyzers/github/finegrained/finegrained.go, there are panic calls for failed type assertions on RepoAccessMap and UserAccessMap.
  3. In pkg/analyzer/analyzers/github/finegrained/finegrained.go, an unexpected 200 OK status when testing for content write permissions triggers a panic("This should never happen...").

To Reproduce

  1. Provide rufflehog with a valid GitHub classic token that has a newly introduced permission scope not yet mapped in PermissionStrings.
  2. The GitHub analyzer runs and attempts to format the scopes.
  3. rufflehog crashes with a panic.

Expected behavior
The analyzer should handle unexpected API responses and unknown scopes gracefully. Unknown scopes should be formatted with a fallback string, and unexpected HTTP responses or types should result in an error or safe fallback rather than crashing the entire scanner.

Activity

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions