[INS-402] Add Jira Data Center PAT Detector

[mustansir14]

Summary

Adds a new detector for Jira Data Center Personal Access Tokens (PATs).

Regex

PATs are base64-encoded strings of the form <12-digit-id>:<20-random-bytes> (33 bytes, 44 chars, no padding). Since the first byte is always an ASCII digit, the first base64 character is always M, N, or O. The trailing boundary (?:[^A-Za-z0-9+/=]|\z) is used instead of \b to correctly handle tokens ending in + or /, while still rejecting matches that are a prefix of a longer or padded base64 string.

(?i:jira|atlassian)(?:.|[\n\r]){0,40}?\b([MNO][A-Za-z0-9+/]{43})(?:[^A-Za-z0-9+/=]|\z)

Server URLs are captured using the same keyword prefix:

(?i:jira|atlassian)(?:.|[\n\r]){0,40}?(https?://[A-Za-z0-9][A-Za-z0-9.\-]*(?::\d{1,5})?)

Both patterns require a jira or atlassian keyword within 40 characters to reduce false positives. Extracted URLs are tried alongside any user-configured endpoints.

Verification

Verifies against GET /rest/api/2/myself using Authorization: Bearer <token>. Returns display_name and email_address as extra data on 200. Treats 401 as invalid and anything else as a verification error. Docs: https://developer.atlassian.com/server/jira/platform/rest/v10002/api-group-myself/#api-api-2-myself-get

Tests

Pattern tests cover valid tokens, URL detection near jira/atlassian keywords, and negative cases. Verification tests use gock to mock the /rest/api/2/myself endpoint, covering verified, unverified (401), unexpected status, timeout, and no-verify cases.

Integration tests against a live Jira Data Center instance were not possible because Jira Data Center requires a paid license — there is no free tier or open-source image that runs fully without one. Unlike detectors such as Redis or MongoDB where a fully functional Docker container can be spun up freely, the atlassian/jira-software Docker image requires a valid license key to operate. Atlassian's evaluation licenses are time-limited and account-bound, making them unsuitable for automated CI.

Corpora Test

The detector does not appear in the Corpora Test Results.

Checklist:

• Tests passing (make test-community)?
• Lint passing (make lint this requires golangci-lint)?

---

Note

Medium Risk
Adds a new secret detector that can issue outbound verification requests to Jira instances and introduces a new protobuf enum value; risk is primarily around false positives/negatives and verification behavior against user-supplied endpoints.

Overview
Adds a new JiraDataCenterPAT detector that identifies Jira Data Center personal access tokens using a base64-shaped regex gated by nearby jira/atlassian keywords, and optionally verifies tokens via GET /rest/api/2/myself with Authorization: Bearer <token> (capturing display_name/email_address on success).

Registers the detector in engine defaults, updates the detector type enum (proto/detector_type.proto + generated detector_type.pb.go), and extends engine tests to account for the new detector having no cloud endpoint. Includes unit tests for matching edge cases (e.g., +// endings, padding/substring rejection), URL co-detection, and verification outcomes (200/401/unexpected status/timeout).

^{Reviewed by Cursor Bugbot for commit 6b682e5. Bugbot is set up for automated code reviews on this repo. Configure here.}

[cursor]

Tokens not deduplicated unlike comparable detectors

Low Severity

Matched tokens are collected into a plain []string slice without deduplication. Every comparable endpoint-based detector in the codebase (artifactory, artifactoryreferencetoken, jiratoken/v2) deduplicates tokens using a map[string]struct{}. When the same PAT appears near multiple jira/atlassian keywords in the input, this produces duplicate results and redundant verification HTTP requests for each repeated token–endpoint pair.

 

^{Reviewed by Cursor Bugbot for commit 6d540d2. Configure here.}

[amanfcp]

Had a look at Jira Analyzer and it seems it does support custom domains. Can you verify if the analyzer works for this detector too? If yes, we should add AnalysisInfo

[mustansir14]

I checked the analyzer, and while it supports custom domains, it is only restricted to Jira Cloud. The authentication method and API it uses is not compatible with Jira On-Prem.

[shahzadhaider1]

Worth switching from common.SaneHttpClient() to detectors.DetectorHttpClientWithNoLocalAddresses so RFC1918 addresses are blocked by default.
The other Jira detectors use it as well. What do you think?

[mustansir14]

Hmm, with this my only concern is that an on-prem instance could be hosted at an internal private server. Using detectors.DetectorHttpClientWithNoLocalAddresses would cause secrets for those to not be verified.

[shahzadhaider1]

Do you think this detector might be a candidate for detectors.DefaultMultiPartCredentialProvider?

[mustansir14]

Yes, good catch. Will add

[cursor]

Cursor Bugbot has reviewed your changes and found 1 potential issue.

There are 2 total unresolved issues (including 1 from previous review).

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, have a team admin enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 6b682e5. Configure here.}

[cursor]

Default HTTP client bypasses detector framework safeguards

Medium Severity

common.SaneHttpClient() is used instead of the detector HTTP client framework (detectors.DetectorHttpClientWithLocalAddresses). Unlike every other endpoint-based detector in the codebase (artifactory, hashicorpvaultauth, jiratoken v1/v2), this client follows redirects (no WithNoFollowRedirects), doesn't respect engine-level OverrideDetectorTimeout(), and uses a shorter default timeout. Since this detector sends Authorization: Bearer headers to URLs extracted from scanned data, following redirects could leak credentials to unintended destinations. Even if local-address blocking is intentionally omitted for on-prem use, detectors.DetectorHttpClientWithLocalAddresses preserves that allowance while adding redirect protection and timeout override support.

 

^{Reviewed by Cursor Bugbot for commit 6b682e5. Configure here.}