Filter Firebase bucket false positives

[oj-sec]

This pull request adds a check to fix false positive Firebase bucket identification where the bucket name contains an '_' (underscore) character.

A Firebase datastore cannot validly have an underscore character in its name and the Firebase API returns a 403 HTTP status code if it does. The current logic expects that only a 404 status code means that the bucket does not exist. This results in buckets that cannot exist on Firebase being identified as existing where the candidate bucket names contain an underscore.

Example Firebase response where an underscore is present (and the bucket does not exist):

Example Firebase response where no underscore is present and the bucket does not exist:

[TheTechromancer]

@oj-sec thanks for noticing this! When it comes to cloud providers in BBOT, we track all the provider-specific data in a separate repo, cloudcheck.

Specifically, the regex for the firebase bucket is in this file. Would you mind making a PR there instead?

[codecov]

Codecov Report

Attention: 1 lines in your changes are missing coverage. Please review.

Comparison is base (65907a3) 92% compared to head (7647b28) 92%.

Files	Patch %	Lines
bbot/modules/bucket_firebase.py	67%	1 Missing ⚠️

Additional details and impacted files

@@          Coverage Diff          @@
##             dev   #1105   +/-   ##
=====================================
- Coverage     92%     92%   -0%     
=====================================
  Files        308     308           
  Lines      19516   19518    +2     
=====================================
  Hits       17913   17913           
- Misses      1603    1605    +2     

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

[oj-sec]

@TheTechromancer you're welcome! Thanks for such an excellent project. I'll resubmit over there

[oj-sec]

closing with blacklanternsecurity/cloudcheck#24