Documentation
¶
Overview ¶
Package teams provides a verifier for Microsoft Teams webhook URLs.
Security note: a Teams incoming webhook is a write-only endpoint — the only way to interact with it is to POST a message, which would deliver a visible card to a (possibly customer-owned) channel. Delivering a message during a scan is a destructive side effect and violates the project's secret-safety rules. Therefore this verifier performs a NON-DESTRUCTIVE probe: it POSTs a deliberately empty JSON object ("{}"), which Teams rejects as a bad payload (HTTP 400) WITHOUT rendering a card. That 400 distinguishes a real, active webhook from a deleted/disabled one (HTTP 404) or an invalid host (connection error). Ambiguous responses (for example a 2xx, which a genuine Teams webhook never returns for an empty payload) fall back to Unverified rather than risk a false positive.
Index ¶
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
This section is empty.
Types ¶
type Verifier ¶
type Verifier struct {
// contains filtered or unexported fields
}
Verifier checks whether a Microsoft Teams webhook URL is active by sending a non-destructive probe. It NEVER logs or persists raw webhook URLs and it NEVER delivers a visible message to the target channel.
func (*Verifier) Verify ¶
func (v *Verifier) Verify(ctx context.Context, raw detector.RawFinding) finding.VerificationResult
Verify probes the detected Teams webhook URL without delivering a message.
It POSTs an empty JSON object so that a real webhook rejects it as a bad payload (no card is rendered). The status code is then mapped:
- 400 Bad Request -> active (the endpoint exists and validated our payload)
- 404 Not Found -> inactive (webhook deleted or disabled)
- anything else -> unverified (cannot decide non-destructively)
Source Files