Documentation
¶
Overview ¶
Package model holds the types shared by the scanner, the detectors and the report writers.
Index ¶
Constants ¶
const ( RelDeclared = "declared" RelConfirmed = "confirmed" RelLikely = "likely" RelWeak = "weak" RelUnverified = "unverified" )
Relationship statuses.
Variables ¶
This section is empty.
Functions ¶
This section is empty.
Types ¶
type Category ¶
type Category string
Category is the kind of sensitive data a finding is about.
const ( CatEmail Category = "email" CatPhone Category = "phone" CatPersonName Category = "person_name" CatUsername Category = "username" CatAddress Category = "address" CatPostcode Category = "postcode" CatCity Category = "city" CatRegion Category = "region" CatCountry Category = "country" CatDateOfBirth Category = "date_of_birth" CatGender Category = "gender" CatCompany Category = "company" CatNationalID Category = "national_id" CatBankAccount Category = "bank_account" CatCardNumber Category = "card_number" CatCardMeta Category = "card_meta" CatPaymentToken Category = "payment_token" CatPasswordHash Category = "password_hash" CatSecret Category = "secret" CatIPAddress Category = "ip_address" CatUserAgent Category = "user_agent" CatGeo Category = "geo_location" CatWebsite Category = "website" CatSessionData Category = "session_data" CatFreeText Category = "free_text" CatDeviceID Category = "device_id" )
func (Category) Info ¶
func (c Category) Info() CategoryInfo
Info returns the description of a category.
type CategoryInfo ¶
CategoryInfo describes a category: a label for people, the default severity and the masking strategy a starter config suggests.
type Column ¶
type Column struct {
Name string
Position int
DataType string // lower case, e.g. varchar, bigint, longtext
ColumnType string // full type, e.g. "bigint(20) unsigned"
Nullable bool
MaxLength int64
Key string // PRI, UNI, MUL
Extra string // auto_increment, VIRTUAL GENERATED, ...
Comment string
}
Column is one column of a table.
func (*Column) AutoIncrement ¶
AutoIncrement reports whether the column is filled by the server.
type Confidence ¶
type Confidence int
Confidence says how sure the scanner is that a finding is real.
const ( ConfidenceLow Confidence = iota + 1 ConfidenceMedium ConfidenceHigh )
func (Confidence) MarshalText ¶
func (c Confidence) MarshalText() ([]byte, error)
MarshalText encodes the confidence by name in JSON output.
func (Confidence) String ¶
func (c Confidence) String() string
type Finding ¶
type Finding struct {
Table string `json:"table"`
Column string `json:"column"`
// MetaKey is a key of a key/value table, or a pattern such as
// um_cache_userdata_* where * stands for the part that varies between
// keys. The varying part may itself be data, so it is never shown.
MetaKey string `json:"meta_key,omitempty"`
// KeyName marks a finding about the key names themselves: Column is
// the key column, and the part of the names matched by * holds data.
KeyName bool `json:"key_name,omitempty"`
// Keys is how many keys a pattern stands for; KeysPartial says the
// count is a lower bound because the keys were sampled, not listed.
Keys int `json:"keys,omitempty"`
KeysPartial bool `json:"keys_partial,omitempty"`
Path string `json:"path,omitempty"`
// Where, when set, limits the finding to the rows that match it, such
// as the privacy requests among WordPress posts.
Where string `json:"where,omitempty"`
Category Category `json:"category"`
Severity Severity `json:"severity"`
Confidence Confidence `json:"confidence"`
Sampled int `json:"sampled"`
Matched int `json:"matched"`
Reasons []string `json:"reasons"`
Mask string `json:"suggested_mask"`
RowMasks []RowMask `json:"suggested_row_masks,omitempty"`
Source string `json:"source"`
Note string `json:"note,omitempty"`
}
Finding is one column, meta key or JSON path that holds sensitive data.
type ForeignKey ¶
type ForeignKey struct {
Name string
Columns []string
RefSchema string
RefTable string
RefColumns []string
}
ForeignKey is one declared foreign key.
type Index ¶
type Index struct {
Name string
Unique bool
Type string // BTREE, HASH, FULLTEXT or SPATIAL (information_schema INDEX_TYPE)
Columns []string
// SubParts holds, per column, the length of an indexed prefix, or 0
// when the whole column is indexed (information_schema SUB_PART).
SubParts []int
}
Index is one index of a table.
type IndexUse ¶ added in v0.3.0
type IndexUse struct {
Found bool // some index starts with the column
Full bool // one of them indexes the whole column, not a prefix of it
Unique bool // a unique index covers exactly this column, in full
}
IndexUse says how a column can be looked up through the table's indexes.
type Platform ¶
type Platform struct {
Name string `json:"name"`
Label string `json:"label"`
Version string `json:"version,omitempty"`
Prefix string `json:"table_prefix,omitempty"`
Details []string `json:"details,omitempty"`
}
Platform is an application the scanner recognised, such as WordPress.
type Relationship ¶
type Relationship struct {
ChildTable string `json:"child_table"`
ChildColumns []string `json:"child_columns"`
ParentTable string `json:"parent_table"`
ParentColumns []string `json:"parent_columns"`
Source string `json:"source"`
Status string `json:"status"`
Checked int `json:"checked,omitempty"`
Found int `json:"found,omitempty"`
TypeColumn string `json:"type_column,omitempty"`
TypeValue string `json:"type_value,omitempty"`
Note string `json:"note,omitempty"`
}
Relationship links a child column to a parent key. Declared relationships come from foreign keys; the others are inferred and checked against data.
func (Relationship) Key ¶
func (r Relationship) Key() string
Key identifies a relationship regardless of where it came from.
type Result ¶
type Result struct {
Tool string `json:"tool"`
Version string `json:"version"`
GeneratedAt time.Time `json:"generated_at"`
Server ServerInfo `json:"server"`
Database string `json:"database"`
Platforms []Platform `json:"platforms"`
Options ScanOptions `json:"options"`
Summary Summary `json:"summary"`
Tables []TableSummary `json:"tables"`
Findings []Finding `json:"findings"`
SideEffects []SideEffect `json:"side_effects"`
Relationships []Relationship `json:"relationships"`
Warnings []string `json:"warnings"`
}
Result is the full outcome of a scan.
type RowMask ¶ added in v0.2.0
type RowMask struct {
Where string `json:"where"` // e.g. post_type IN ('shop_order', 'shop_order_refund')
Mask string `json:"mask"`
Note string `json:"note,omitempty"`
}
RowMask suggests a different mask for some rows of a column, such as the orders among WordPress posts. For the rows that match Where, it replaces the finding's own suggestion.
type ScanOptions ¶
type ScanOptions struct {
SampleRows int `json:"sample_rows"`
MetaSampleRows int `json:"meta_sample_rows"`
KeySampleRows int `json:"key_sample_rows"`
Samples bool `json:"samples"`
Preset string `json:"preset"`
TimeoutSeconds float64 `json:"statement_timeout_seconds"`
}
ScanOptions records the settings a scan ran with.
type ServerInfo ¶
type ServerInfo struct {
Flavor string `json:"flavor"`
Version string `json:"version"`
Address string `json:"address"`
User string `json:"user"`
}
ServerInfo describes the database server that was scanned.
type Severity ¶
type Severity int
Severity ranks how much harm a finding could do in a non-production copy.
func ParseSeverity ¶
ParseSeverity accepts none, low, medium, high or critical.
func (Severity) MarshalText ¶
MarshalText encodes the severity by name in JSON output.
type SideEffect ¶
type SideEffect struct {
Platform string `json:"platform"`
Kind string `json:"kind"`
Table string `json:"table"`
Item string `json:"item,omitempty"`
Severity Severity `json:"severity"`
Summary string `json:"summary"`
Count int64 `json:"count,omitempty"`
Fix string `json:"fix"`
}
SideEffect is something a plain copy would let staging do to real people: send them email, charge their cards, call their webhooks.
type Summary ¶
type Summary struct {
Tables int `json:"tables"`
TablesSampled int `json:"tables_sampled"`
Views int `json:"views"`
RowsSampled int64 `json:"rows_sampled"`
TablesWithFindings int `json:"tables_with_findings"`
Findings int `json:"findings"`
BySeverity map[string]int `json:"by_severity"`
ByCategory map[string]int `json:"by_category"`
Highest Severity `json:"highest_severity"`
SideEffects int `json:"side_effects"`
Relationships int `json:"relationships"`
InferredConfirmed int `json:"inferred_relationships_confirmed"`
DurationMillis int64 `json:"duration_ms"`
}
Summary holds the headline numbers of a scan.
type Table ¶
type Table struct {
Name string
Type string // BASE TABLE, VIEW, SYSTEM VERSIONED, SEQUENCE
Engine string
RowsEstimate int64
DataBytes int64
Comment string
Columns []*Column
PrimaryKey []string
Indexes []Index
ForeignKeys []ForeignKey
// contains filtered or unexported fields
}
Table is one table or view.
func (*Table) HasIndexOn ¶
HasIndexOn reports whether some index starts with the given column.
type TableSummary ¶
type TableSummary struct {
Name string `json:"name"`
Kind string `json:"kind"`
RowsEstimate int64 `json:"rows_estimate"`
RowsSampled int `json:"rows_sampled"`
Findings int `json:"findings"`
Highest Severity `json:"highest_severity"`
KeyColumn string `json:"key_column,omitempty"`
ValueColumn string `json:"value_column,omitempty"`
Keys int `json:"keys,omitempty"` // distinct keys read in a key/value table
// HiddenKeys counts the keys with confident findings that reports show
// as "(key hidden)": their names may hold data, so no rule names them.
HiddenKeys int `json:"hidden_keys,omitempty"`
Action string `json:"suggested_action,omitempty"`
ActionReason string `json:"action_reason,omitempty"`
// PossibleAction is weaker than Action: a guess, such as emptying a
// table that looks like a cache, which the user should confirm. Tools
// that act on suggested_action never see it.
PossibleAction string `json:"possible_action,omitempty"`
PossibleActionReason string `json:"possible_action_reason,omitempty"`
Error string `json:"error,omitempty"`
}
TableSummary is what the report says about one table.