Merge pull request #21 from whs-authz-authn-project/feature/access-token-detector

[DOCS] AccessToken findings 생성 시 reporter 추가

packages/backend/src/controller/accessTokenDetector.ts

@@ -19,7 +19,7 @@ export class AccessTokenLeakController {
         title: result.title,
         description: result.description,
         request,
-        reporter: "",
+        reporter: "AccessTokenLeak",
       });
     }
   }
@@ -31,7 +31,7 @@ export class AccessTokenLeakController {
         title: result.title,
         description: result.description,
         request,
-        reporter: "",
+        reporter: "AccessTokenLeak",
       });
     }
   }
@@ -151,7 +151,26 @@ private extractTokenFromText(text: string): string | null {
       'session_token'
     ];
 
-  // 정규표현식 패턴 리스트 생성
+    const tokenTypeKeys = [
+      'token_type',
+      'tokenType'
+    ];
+
+     // 정규표현식 토큰 타입 유무 패턴 리스트 생성
+    const tokenTypeRegexes: RegExp[] = [];
+    for (const key of tokenTypeKeys) {
+      // JSON 형식: "token_type": "Bearer"
+      tokenTypeRegexes.push(new RegExp(`"${key}"\\s*:\\s*"bearer"`, 'i'));
+      // 일반 key=value 형식: token_type=Bearer
+      tokenTypeRegexes.push(new RegExp(`${key}[=:]\\s*bearer`, 'i'));
+      // 공백 있는 형식: token_type : Bearer
+      tokenTypeRegexes.push(new RegExp(`${key}\\s*:\\s*bearer`, 'i'));
+    }
+
+    // token_type=bearer 형태 중 하나라도 포함되는지 확인
+    const hasTokenTypeBearer = tokenTypeRegexes.some(rx => rx.test(text));
+
+    // 정규표현식 토큰 유무 패턴 리스트 생성
     const tokenPatterns: RegExp[] = [];
 
     for (const key of tokenKeys) {
@@ -169,9 +188,11 @@ private extractTokenFromText(text: string): string | null {
     for (const pattern of tokenPatterns) {
       const match = pattern.exec(text);
       if (match && match[1]) {
+        if(hasTokenTypeBearer){
           return match[1];
         }
       }
+    }
 
     return null;
   }

packages/backend/src/index.ts

@@ -22,7 +22,6 @@ export function init(sdk: SDK<API>) {
   sdk.events.onInterceptResponse(async (sdk, req: Request, res: Response) => {
     await csrfCheck.checker(sdk, req, res);
     //await pkceCheckController.test(sdk, req);
-    await tokenCheck.testReq(sdk, req);
     await tokenCheck.testResp(sdk, res, req);
     await ScopeDetectionController.scan(sdk, req.getUrl());
     await redirectBypassController.testAsync(sdk, req, res);
@@ -38,6 +37,7 @@ export function init(sdk: SDK<API>) {
   });
 
   sdk.events.onInterceptRequest(async (sdk, req: Request) => {
+    await tokenCheck.testReq(sdk, req);
     await pkceCheckController.test(sdk, req);
   });
   /*