[INS-402] Add Jira Data Center PAT Detector

[mustansir14]

Summary

Adds a new detector for Jira Data Center Personal Access Tokens (PATs).

Regex

Jira Data Center PATs are base64-encoded strings, always 44 characters length.

(?i:jira|atlassian)(?:.|[\n\r]){0,40}?\b([A-Za-z0-9+/]{44})\b

Server URLs are captured using the same keyword prefix:

(?i:jira|atlassian)(?:.|[\n\r]){0,40}?(https?://[A-Za-z0-9][A-Za-z0-9.\-]*(?::\d{1,5})?)

Both patterns require a jira or atlassian keyword within 40 characters to reduce false positives. Extracted URLs are tried alongside any user-configured endpoints.

Verification

Verifies against GET /rest/api/2/myself using Authorization: Bearer <token>. Returns display_name and email_address as extra data on 200. Treats 401 as invalid and anything else as a verification error. Docs: https://developer.atlassian.com/server/jira/platform/rest/v10002/api-group-myself/#api-api-2-myself-get

Tests

Pattern tests cover valid tokens, URL detection near jira/atlassian keywords, and negative cases. Verification tests use gock to mock the /rest/api/2/myself endpoint, covering verified, unverified (401), unexpected status, timeout, and no-verify cases.

Integration tests against a live Jira Data Center instance were not possible because Jira Data Center requires a paid license — there is no free tier or open-source image that runs fully without one. Unlike detectors such as Redis or MongoDB where a fully functional Docker container can be spun up freely, the atlassian/jira-software Docker image requires a valid license key to operate. Atlassian's evaluation licenses are time-limited and account-bound, making them unsuitable for automated CI.

Checklist:

• Tests passing (make test-community)?
• Lint passing (make lint this requires golangci-lint)?

---

Note

Medium Risk
Adds a new secret detector with live HTTP verification and extends the DetectorType proto enum, which can affect downstream consumers and increases scan-time network calls when verification is enabled.

Overview
Adds a new JiraDataCenterPAT detector that finds 44-char Jira Data Center personal access tokens near jira/atlassian keywords, optionally extracting nearby Jira base URLs to try as verification endpoints.

Implements verification via GET /rest/api/2/myself using Authorization: Bearer <token>, returning display_name/email_address as ExtraData on success, and includes unit tests covering pattern matching, endpoint selection, and verification outcomes/timeouts.

Registers the detector in the default detector list and introduces DetectorType_JiraDataCenterPAT (value 1045) in proto/detectors.proto and the generated detectors.pb.go.

^{Reviewed by Cursor Bugbot for commit 195f1a9. Bugbot is set up for automated code reviews on this repo. Configure here.}

[cursor]

Cursor Bugbot has reviewed your changes and found 2 potential issues.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, have a team admin enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 195f1a9. Configure here.}

[cursor]

Word boundary incompatible with base64 +/ characters

Low Severity

The patPat regex uses \b word boundaries around a character class that includes + and / ([A-Za-z0-9+/]{44}). Since \b only considers [A-Za-z0-9_] as word characters, a token that starts or ends with + or / will fail to match when adjacent to typical delimiters like whitespace, end-of-line, or end-of-string. Because Jira Data Center PATs are base64-encoded, the last character has roughly a 1-in-32 chance of being + or /, causing those valid tokens to be silently missed.

 

^{Reviewed by Cursor Bugbot for commit 195f1a9. Configure here.}

[cursor]

Successful auth silently marked unverified on decode failure

Medium Severity

When the server responds with HTTP 200 (meaning the Bearer token was accepted and authentication succeeded), but json.NewDecoder fails to decode the body, verifyPAT returns (false, nil, nil). This is indistinguishable from a 401 Unauthorized response, silently converting a verified credential into an unverified one. A 200 status confirms the token is valid; the JSON decode failure only means extra metadata couldn't be extracted. The function could return (true, nil, nil) to reflect the successful auth, or return a non-nil error to signal inconclusive verification.

 

^{Reviewed by Cursor Bugbot for commit 195f1a9. Configure here.}