Skip to content

Improve YouTube API key verifier errors#5016

Open
srkyn wants to merge 1 commit into
trufflesecurity:mainfrom
srkyn:fix-youtubeapikey-verifier-errors
Open

Improve YouTube API key verifier errors#5016
srkyn wants to merge 1 commit into
trufflesecurity:mainfrom
srkyn:fix-youtubeapikey-verifier-errors

Conversation

@srkyn
Copy link
Copy Markdown

@srkyn srkyn commented Jun 4, 2026

Description

Improves the YouTube API key detector verifier by returning explicit verification errors for transport failures and unexpected API responses.

This is a narrow slice related to the detector verifier error-handling work discussed in #4051. The PR avoids closing keywords so the umbrella issue can stay open for the remaining detectors.

Changes

  • Adds injectable HTTP client support to the YouTube API key scanner
  • Extracts verification into a helper that returns verified state plus verification error
  • Treats expected invalid-key responses as unverified without a verification error
  • Adds local verifier tests using constant HTTP responses

Tests

  • go test ./pkg/detectors/youtubeapikey

@srkyn srkyn requested a review from a team June 4, 2026 13:53
@srkyn srkyn requested a review from a team as a code owner June 4, 2026 13:53
@CLAassistant
Copy link
Copy Markdown

CLAassistant commented Jun 4, 2026

CLA assistant check
All committers have signed the CLA.

case http.StatusOK:
return true, nil
case http.StatusBadRequest, http.StatusUnauthorized, http.StatusForbidden:
return false, nil
Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

AFAIK, Google does return 403 for valid credentials that lack proper authorization. Could you double check this?

Error type	Error detail	Description
forbidden (403)	forbidden	Access forbidden. The request may not be properly authorized.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants