Fix SSRF in imsBaseURL and clear ExtraData in integration test

Author: anemonaaa13

pkg/detectors/adobeims/adobeims.go

@@ -36,6 +36,10 @@ var (
 
 	// Matches any JWT; Adobe IMS tokens are identified by decoding the payload and checking the "as" field.
 	jwtPat = regexp.MustCompile(`(eyJ[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,})`)
+
+	// imsRegionPat validates the "as" field from the JWT payload before interpolating it into a URL.
+	// Prevents SSRF via crafted values like "ims-x@evil.com/".
+	imsRegionPat = regexp.MustCompile(`^ims-[a-z0-9]+$`)
 )
 
 
@@ -96,6 +100,9 @@ func decodeJWTPayload(token string) (*jwtPayload, error) {
 
 
 func imsBaseURL(as string) string {
+	if !imsRegionPat.MatchString(as) {
+		return "https://ims-na1.adobelogin.com"
+	}
 	return fmt.Sprintf("https://%s.adobelogin.com", as)
 }
 

pkg/detectors/adobeims/adobeims_integration_test.go

@@ -96,6 +96,7 @@ func TestAdobeIMS_FromData(t *testing.T) {
 					t.Fatalf("no raw secret present: \n %+v", got[i])
 				}
 				got[i].Raw = nil
+				got[i].ExtraData = nil
 			}
 			if diff := pretty.Compare(got, tt.want); diff != "" {
 				t.Errorf("AdobeIMS.FromData() %s diff: (-got +want)\n%s", tt.name, diff)