Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Improving GoogleApiKeyValidator #229

Closed
wants to merge 4 commits into from

Conversation

eddynaka
Copy link
Collaborator

Fixes #227

Copy link
Member

@michaelcfanning michaelcfanning left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🕐

@@ -61,8 +61,10 @@ public static string IsValidDynamic(ref string fingerprint, ref string message)
const string Deleted = "RequestDenied: This API project was not found. This API project may have been deleted or may not be authorized to use this API. You may need to enable the API under APIs in the console).";
const string KeyNotAuthorized = "RequestDenied: This API key is not authorized to use this service or API.";
const string ProjectNotAuthorized = "RequestDenied: This API project is not authorized to use this API.";
const string IpNotAuthorized = "RequestDenied: This IP, site or mobile application is not authorized to use this API key.";
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

IpNotAuthorized [](start = 25, length = 15)

This is not the right change. 'NoMatch' indicates a false positive. Both these conditions indicate that we did in fact find a match and that the key was actually secured in some way. We can't take this change, we can discuss more offline.

Copy link
Collaborator Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I could add Pass to the ValidationState and in the SearchSkimmer, if we get a pass, we change the kind to pass as well. Should we leave error as warning or should we change as well?


In reply to: 578522731 [](ancestors = 578522731)

@eddynaka eddynaka marked this pull request as draft February 20, 2021 01:10
@eddynaka eddynaka marked this pull request as ready for review February 20, 2021 13:37
@eddynaka eddynaka deleted the users/ednakamu/improving-google-api branch March 16, 2021 16:36
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

Analyzing Google API keys with referer/APK SHA1 cert restrictions should return pass results
2 participants