generic.secrets.security.detected-telegram-bot-api-key.detected-telegram-bot-api-key

Community Favorite
profile photo of returntocorpreturntocorp
Author
37,965
Download Count*
LGPL Commons Clause
License

Telegram Bot API Key detected

Run Locally

Run in CI

Semgrep CI docs

Defintion

Edit RuleView Source
Open in Playground 
rules:
  - id: detected-telegram-bot-api-key
    patterns:
      - pattern-regex: "[0-9]+:AA[0-9A-Za-z\\-_]{33}"
      - pattern-not-regex: go\.mod.*
      - pattern-not-regex: v[\d]+\.[\d]+\.[\d]+.*
    languages:
      - regex
    message: Telegram Bot API Key detected
    severity: ERROR
    metadata:
      cwe:
        - "CWE-798: Use of Hard-coded Credentials"
      source-rule-url: https://github.com/dxa4481/truffleHogRegexes/blob/master/truffleHogRegexes/regexes.json
      category: security
      technology:
        - secrets
        - telegram
      license: Commons Clause License Condition v1.0[LGPL-2.1-only]
      confidence: LOW
      owasp:
        - A07:2021 - Identification and Authentication Failures
      references:
        - https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures
      cwe2022-top25: true
      cwe2021-top25: true
      subcategory:
        - audit
      likelihood: LOW
      impact: MEDIUM

Examples

detected-telegram-bot-api-key.php

<?php

// ruleid: detected-telegram-bot-api-key
define('BOT_TOKEN', '12345678:AA101703Wd8JLT6GCtKzxatRHQREQUk_CpK');
define('API_URL', 'https://api.telegram.org/bot'.BOT_TOKEN.'/');

// ok: detected-telegram-bot-api-key
define('GO.MOD', 'github.com/gorilla/mux v1.7.4/go.mod 11:AAbg23sWSpFRCP0SfiEN6jmj59UnWan46BH5rLB7');
// ok: detected-telegram-bot-api-key
define('DO_NOT_DETECT_ME', 'github.com/valyala/fasthttp v1.24.0 h1:AAiG4oLDUArTb7rYf9oO2bkGooOqCaUF6a2u8asBP3I=')

?>