Skip to content

[INS-403] Support Custom endpoint config in hashicorpvaultauth Detector#4825

Open
MuneebUllahKhan222 wants to merge 3 commits intotrufflesecurity:mainfrom
MuneebUllahKhan222:vaultauth-custom-ep
Open

[INS-403] Support Custom endpoint config in hashicorpvaultauth Detector#4825
MuneebUllahKhan222 wants to merge 3 commits intotrufflesecurity:mainfrom
MuneebUllahKhan222:vaultauth-custom-ep

Conversation

@MuneebUllahKhan222
Copy link
Contributor

@MuneebUllahKhan222 MuneebUllahKhan222 commented Mar 19, 2026

Description:

This PR enabled custom endpoint configuration for the existing hashicorpvaultauth detector.

It enables custom endpoint configuration by making the detector comply to detectors.EndpointCustomizer interface and updating to default client to detectors.DetectorHttpClientWithNoLocalAddresses to avoid potential security risks like ssrf attacks.

This PR also updates the existing test to make sure that the test work fine with the new changes and also introduces a new integration test to emulate custom endpoint configuration.

Checklist:

  • Tests passing (make test-community)?
  • Lint passing (make lint this requires golangci-lint)?

Note

Medium Risk
Adds configurable verification endpoints and changes the default HTTP client to block local addresses, which can affect verification behavior and networking edge cases (e.g., endpoint selection and SSRF protections).

Overview
Enables custom endpoint configuration for the hashicorpvaultauth detector by embedding detectors.EndpointSetter (implementing detectors.EndpointCustomizer) and routing verification through s.Endpoints(...) instead of only URLs found in scanned data.

Switches the detector’s default HTTP client to detectors.DetectorHttpClientWithNoLocalAddresses and adjusts detection logic to require only role_id + secret_id (vault URL can now come from configured/cloud endpoints). Tests are updated to enable endpoint selection, add an integration test for SetConfiguredEndpoints, and update the engine test allowlist for detectors without cloud endpoints.

Written by Cursor Bugbot for commit fc7a9df. This will update automatically on new commits. Configure here.

@MuneebUllahKhan222 MuneebUllahKhan222 requested a review from a team March 19, 2026 11:53
@MuneebUllahKhan222 MuneebUllahKhan222 requested review from a team as code owners March 19, 2026 11:53
if endpoint != vaultUrl {
t.Fatalf("expected endpoint %s, got %s", vaultUrl, endpoint)
}
}
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This loop will always run only one time. Also, do you think this loop provides value? because the cmp.Diff at the end is sufficient as it does the same job.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants