ggshield pre-commit hook fails to detect Telegram API credentials as secrets

[Advaitgaur004]

Environment

• ggshield version: 1.39.0
• Operating system (Linux, macOS, Windows): Windows, Linux
• Operating system version:

Windows
OS Name: Microsoft Windows 11 Home Single Language
OS Version: 10.0.26100 N/A Build 26100

Linux
Linux Advait 5.15.167.4 1 SMP Tue Nov 5 00:21:55 UTC 2024 x86_64 x86_64 x86_64 GNU/Linux

• Python version: 3.11.5

Describe the bug

When using ggshield with the pre-commit hook installed via ggshield install -m local, the tool fails to detect Telegram credentials in a committed file. However, it detects other known secrets like GitHub tokens or Slack API keys correctly.

Steps to reproduce:

1. Create a file main.txt with the following sample content (note: actual credentials were used during testing; this is just representative for the purpose of this issue):

[Telegram] 
api_id = 00000000 
api_hash = ccccccccccccccccccccccccccccccc
username = @Advaitgaur004

2. Stage and commit the file:

git commit -am "Secret added"

Actual result:

ggshield does not detect or block the Telegram API credentials during the pre-commit scan.

Expected result:

Telegram api_id and api_hash should be flagged as secrets and block the commit.

[agateau-gg]

Hi Advait, we currently do not detect this kind of Telegram credentials, we only detect tokens from the Telegram bot API. Can you provide a link to the doc for the Telegram API used in your example?

[Advaitgaur004]

Telegram API credentials:

Visit https://my.telegram.org/auth
Go to 'API Development Tools'
Create a new application
Get your api_id, api_hash, and username

This is the flow.

For extended Documentation it should there in their API Development section, most probably.

[Advaitgaur004]

Hi Advait, we currently do not detect this kind of Telegram credentials, we only detect tokens from the Telegram bot API. Can you provide a link to the doc for the Telegram API used in your example?

I'm a big fan of the ggshield; it would be wonderful if this feature were available.

[agateau-gg]

Thank you for your feedback, I just created an issue on our internal tracker to add this detector to our secret engine.

I can't tell when it will be implemented, though.