Documentation
¶
Overview ¶
Package remediate turns findings into actionable guidance: how urgent it is, how to rotate the credential, how to stop needing it at all (keyless / workload identity), and how to load it efficiently in the file's language.
Index ¶
- Variables
- func EnvExpr(lang, env string) string
- func EnvName(ruleID, line, secret string, fam Family) string
- func LanguageFor(path string) string
- func Languages() []string
- func Snippet(lang, store, env string) (string, bool)
- func Validate(lang, content string) (checked bool, err error)
- type Family
- type Guidance
- type Input
- type PatchItem
- type PatchResult
Constants ¶
This section is empty.
Variables ¶
var Caveats = map[string]string{
"go": `os.Getenv returns "" when the variable is unset; validate required values at startup`,
"javascript": "the lookup throws \"X is not set\" when the variable is unset (fail-fast)",
"typescript": "the lookup throws \"X is not set\" when the variable is unset (fail-fast)",
"python": `os.environ["X"] raises KeyError when unset (fail-fast); module-level lookups fail at import`,
"java": "Objects.requireNonNull throws \"X is not set\" when unset (fail-fast); static fields fail at class load",
"csharp": "the lookup throws InvalidOperationException when unset (fail-fast)",
"ruby": "ENV.fetch raises KeyError when unset (fail-fast)",
"php": "getenv returns false when unset; validate required values at startup",
"shell": `"${X:?}" aborts the script when X is unset (fail-fast)`,
}
Caveats are semantic notes about the env-lookup replacement per language.
var Stores = []string{"env", "vault", "aws", "azure", "gcp"}
Stores supported by snippets.
Functions ¶
func EnvName ¶
EnvName picks a variable name: the conventional one for the rule, else the identifier the literal was assigned to, else one derived from the rule.
func LanguageFor ¶
LanguageFor maps a file name to a snippet language.
Types ¶
type Family ¶
type Family struct {
Name string
Rotate string
Eliminate string
EnvVar string
// SDKChain: the official SDK resolves credentials itself (AWS/Azure/GCP),
// so the right fix is deleting the literal, not reading an env var.
SDKChain bool
}
Family describes one credential issuer.
type Guidance ¶
type Guidance struct {
Urgency string `json:"Urgency"` // revoke-now | rotate | review
Family string `json:"Family"` // provider family, e.g. "AWS"
Rotate string `json:"Rotate"` // how to revoke/rotate
Eliminate string `json:"Eliminate,omitempty"` // how to stop needing a static secret
EnvVar string `json:"EnvVar"` // suggested variable / secret name
Language string `json:"Language,omitempty"` // detected from the file
Replace string `json:"Replace,omitempty"` // drop-in expression replacing the literal
Store string `json:"Store,omitempty"` // secret store the snippet targets
Steps []string `json:"Steps,omitempty"` // ordered checklist
Runbook string `json:"Runbook,omitempty"` // org runbook link from config
}
Guidance is attached to every finding.
type Input ¶
type Input struct {
RuleID, File, Line, Secret, Verification string
Store, Runbook string // org defaults from config/flags
}
Input is what guidance needs about a finding.
type PatchItem ¶
type PatchItem struct {
File string // relative to Root
Line int // 1-based
Secret string
EnvVar string
}
PatchItem is one literal to replace.
type PatchResult ¶
type PatchResult struct {
Diff string
Patched []PatchItem
Skipped []string // human-readable reasons
EnvVars []string // variables the patched code now expects
Files map[string]string // new content per file (for in-place --fix)
// Unchecked lists files whose language has no syntax validator here.
Unchecked []string
Langs []string // languages touched (for caveats)
}
PatchResult is a unified diff plus what could not be patched.
func BuildPatch ¶
func BuildPatch(root string, items []PatchItem) PatchResult
BuildPatch replaces each quoted secret literal with an environment lookup in the file's language and returns a unified diff for `git apply`. Unquoted values (YAML, .env, properties) are reported as skipped: they need moving to a secret store rather than a code change.
Source Files