Bug in `PubNubSubscriptionKey` verification logic

[rgmz]

Please review the Community Note before submitting

TruffleHog Version

3.60.4

Description

The PubNubSubscriptionKey, detector incorrectly flags valid keys as invalid when a non-2xx response is received.

Given the following code:

https://github.com/trufflesecurity/trufflehog/blob/eb0c0fa99fcca6dd37892a33e0f8fc7b39c65ae2/pkg/detectors/pubnubsubscriptionkey/pubnubsubscriptionkey.go#L57-L58

A valid subscription key that does not have objects enabled will return a 403 response:

GET https://ps.pndsn.com/v2/objects/sub-c-$valid/uuids
{"status":403,"error":{"message":"Objects not enabled for this subscriber key.","source":"objects"}}

Conversely, an invalid key will return a 400 response:

GET https://ps.pndsn.com/v2/objects/sub-c-$invalid/uuids
{"message": "Invalid Subscribe Key", "error": true, "service": "Access Manager", "status": 400}

[rosecodym]

@0x1 do you think we just need to do what we're doing for the pubnubpublishkeys here?

[0x1]

@0x1 do you think we just need to do what we're doing for the pubnubpublishkeys here?

i think we need to add logic for the case the rgmz mentioned and check for json blob on a 403. or find a different endpoint that doesn't depend on objects being enabled. i can create a ticket for this