detect

package
v0.2.0 Latest Latest
Warning

This package is not in the latest version of its module.

Go to latest
Published: Oct 17, 2026 License: Apache-2.0 Imports: 10 Imported by: 0

Documentation

Overview

Package detect decides which columns, meta keys and JSON paths hold personal data or secrets, from their names and from sampled values. It never keeps or returns the values themselves, only counts.

Index

Constants

This section is empty.

Variables

This section is empty.

Functions

func Analyze

func Analyze(sub Subject, p *Profile) []model.Finding

Analyze judges one subject from its name and the profile of its sampled values. p is nil when no values were read.

func Flatten

func Flatten(s string) map[string]string

Flatten returns the leaves of a JSON or PHP-serialized value by path, keeping the first value of each path. It is for reading settings, such as whether a payment gateway runs in live mode; callers must never print the values.

func IsEmail

func IsEmail(s string) bool

IsEmail reports whether s is one email address.

func JoinPath

func JoinPath(path []string) string

JoinPath renders a path: billing.email, items[].name, cart.*.line_total.

func SortFindings

func SortFindings(fs []model.Finding)

SortFindings orders findings by severity (worst first), then location.

func Tokens

func Tokens(name string) []string

Tokens splits an identifier into lower-case words. It understands snake_case, kebab-case, camelCase and digits, and splits a few common compounds: "firstname" becomes first, name.

Types

type Hint

type Hint struct {
	Category model.Category
	Severity model.Severity // zero means the category default
	Mask     string
	Rows     []model.RowMask // other masks for some rows of the column
	Note     string
	Source   string // e.g. "preset:woocommerce"
	Ignore   bool   // known not to hold personal data
}

Hint is what a platform preset knows about a column or meta key.

type NameMatch

type NameMatch struct {
	Category model.Category
	Words    string         // the words that matched, e.g. "first name"
	Severity model.Severity // zero means the category default
	Note     string
}

NameMatch is what a column name, meta key or JSON key says about its data.

func MatchName

func MatchName(tokens, ctx []string, tc typeClass) *NameMatch

MatchName applies the naming rules to the words of a column name or key. ctx holds the words of the table name (or parent JSON keys); tc is the column's type class. It returns nil when the name says nothing.

type Profile

type Profile struct {
	Values   int // all values seen, including empty ones
	NonEmpty int

	Email, EmailReserved int
	Phone, PhoneStrict   int
	IP                   int
	IBAN                 int
	Card, CardTest       int
	Hash, HexDigest      int
	HashFormats          map[string]int
	UserAgent            int
	PaymentID            int
	Date                 int
	Secrets              map[string]*SecretCount

	// Prose: values with spaces that are longer than a few words.
	Text, TextEmail, TextPhone, TextIP, TextCard int

	// Values that cannot be names or addresses: plain numbers, and code
	// identifiers such as App\Jobs\SendInvoice.
	Numeric, CodeLike int

	Structured int
	Paths      map[string]*Profile
	// contains filtered or unexported fields
}

Profile counts what the sampled values of one column, meta key or JSON path look like. It keeps counts only, never the values.

func NewProfile

func NewProfile() *Profile

NewProfile returns an empty profile. Values that are JSON or PHP-serialized are opened up and counted per path.

func (*Profile) Add

func (p *Profile) Add(v string)

Add counts one sampled value.

func (*Profile) PathNames

func (p *Profile) PathNames() []string

PathNames returns the tracked paths in a stable order.

func (*Profile) SecretKinds

func (p *Profile) SecretKinds() []string

SecretKinds lists the kinds of secrets seen, sorted.

func (*Profile) SecretTotals

func (p *Profile) SecretTotals() (live, test, unknown int)

SecretTotals sums the secret counts over all kinds.

type SecretCount

type SecretCount struct {
	Live, Test, Unknown int
}

SecretCount counts values holding one kind of secret.

type SecretHit

type SecretHit struct {
	Kind string
	Mode string
}

SecretHit is one secret-looking string. Mode is "live", "test" or "" when the format does not say.

func FindSecrets

func FindSecrets(s string) []SecretHit

FindSecrets returns the kinds of secrets that appear in s, once per kind.

type Subject

type Subject struct {
	Table    string
	Column   string
	MetaKey  string
	Name     string   // the name to judge: the column name or the meta key
	DataType string   // information_schema DATA_TYPE; empty for meta keys
	Context  []string // words of the table name
	Hint     *Hint
	Sampled  bool // false when values were not read (--no-samples)
}

Subject is one column, or one key of a key/value table, to judge.

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL