Documentation
¶
Overview ¶
Package detect decides which columns, meta keys and JSON paths hold personal data or secrets, from their names and from sampled values. It never keeps or returns the values themselves, only counts.
Index ¶
- func Analyze(sub Subject, p *Profile) []model.Finding
- func Flatten(s string) map[string]string
- func IsEmail(s string) bool
- func JoinPath(path []string) string
- func SortFindings(fs []model.Finding)
- func Tokens(name string) []string
- type Hint
- type NameMatch
- type Profile
- type SecretCount
- type SecretHit
- type Subject
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
func Analyze ¶
Analyze judges one subject from its name and the profile of its sampled values. p is nil when no values were read.
func Flatten ¶
Flatten returns the leaves of a JSON or PHP-serialized value by path, keeping the first value of each path. It is for reading settings, such as whether a payment gateway runs in live mode; callers must never print the values.
func SortFindings ¶
SortFindings orders findings by severity (worst first), then location.
Types ¶
type Hint ¶
type Hint struct {
Category model.Category
Severity model.Severity // zero means the category default
Mask string
Rows []model.RowMask // other masks for some rows of the column
Note string
Source string // e.g. "preset:woocommerce"
Ignore bool // known not to hold personal data
}
Hint is what a platform preset knows about a column or meta key.
type NameMatch ¶
type NameMatch struct {
Category model.Category
Words string // the words that matched, e.g. "first name"
Severity model.Severity // zero means the category default
Note string
}
NameMatch is what a column name, meta key or JSON key says about its data.
type Profile ¶
type Profile struct {
Values int // all values seen, including empty ones
NonEmpty int
Email, EmailReserved int
Phone, PhoneStrict int
IP int
IBAN int
Card, CardTest int
Hash, HexDigest int
HashFormats map[string]int
UserAgent int
PaymentID int
Date int
Secrets map[string]*SecretCount
// Prose: values with spaces that are longer than a few words.
Text, TextEmail, TextPhone, TextIP, TextCard int
// Values that cannot be names or addresses: plain numbers, and code
// identifiers such as App\Jobs\SendInvoice.
Numeric, CodeLike int
Structured int
Paths map[string]*Profile
// contains filtered or unexported fields
}
Profile counts what the sampled values of one column, meta key or JSON path look like. It keeps counts only, never the values.
func NewProfile ¶
func NewProfile() *Profile
NewProfile returns an empty profile. Values that are JSON or PHP-serialized are opened up and counted per path.
func (*Profile) SecretKinds ¶
SecretKinds lists the kinds of secrets seen, sorted.
func (*Profile) SecretTotals ¶
SecretTotals sums the secret counts over all kinds.
type SecretCount ¶
type SecretCount struct {
Live, Test, Unknown int
}
SecretCount counts values holding one kind of secret.
type SecretHit ¶
SecretHit is one secret-looking string. Mode is "live", "test" or "" when the format does not say.
func FindSecrets ¶
FindSecrets returns the kinds of secrets that appear in s, once per kind.
type Subject ¶
type Subject struct {
Table string
Column string
MetaKey string
Name string // the name to judge: the column name or the meta key
DataType string // information_schema DATA_TYPE; empty for meta keys
Context []string // words of the table name
Hint *Hint
Sampled bool // false when values were not read (--no-samples)
}
Subject is one column, or one key of a key/value table, to judge.