Documentation
¶
Index ¶
- Constants
- func MaskSecret(secret string, percent uint) string
- type ArtifactLocation
- type ContextRegion
- type CsvReporter
- type Driver
- type Failure
- type Finding
- func (f Finding) Attr(key string) string
- func (f Finding) Attribute(key string) string
- func (f *Finding) BuildRequiredSets(requiredFindings []*RequiredFinding, maxRequiredSets int)
- func (f Finding) Print(noColor bool, redact uint)
- func (f Finding) PrintLegacy(noColor bool, redact uint)
- func (f *Finding) PrintRequiredFindings(noColor bool, redact uint)
- func (f *Finding) Redact(percent uint)
- func (f *Finding) SetAttr(key, value string)
- func (f *Finding) SetAttributes(attrs map[string]string)
- func (f *Finding) SetExprContext(context string)
- func (f *Finding) SetFingerprint()
- func (f *Finding) SyncDeprecatedSourceFields()
- func (f *Finding) ToExprMap() map[string]string
- type FullDescription
- type JsonReporter
- type JunitReporter
- type Locations
- type Message
- type PartialFingerPrints
- type PhysicalLocation
- type Properties
- type Region
- type Reporter
- type RequiredFinding
- type RequiredSet
- type Results
- type Rules
- type Runs
- type Sarif
- type SarifReporter
- type ShortDescription
- type Snippet
- type TemplateReporter
- type TestCase
- type TestSuite
- type TestSuites
- type Tool
- type ValidationStatus
Constants ¶
const ( // https://cwe.mitre.org/data/definitions/798.html CWE = "CWE-798" CWE_DESCRIPTION = "Use of Hard-coded Credentials" StdoutReportPath = "-" )
Variables ¶
This section is empty.
Functions ¶
func MaskSecret ¶ added in v1.1.2
MaskSecret applies partial masking to a secret string based on the given percentage. At 100% the caller should use "REDACTED" instead.
Types ¶
type ArtifactLocation ¶
type ArtifactLocation struct {
URI string `json:"uri"`
}
type ContextRegion ¶ added in v1.1.1
type ContextRegion struct {
Snippet Snippet `json:"snippet"`
}
type CsvReporter ¶
type CsvReporter struct {
}
func (*CsvReporter) Write ¶
func (r *CsvReporter) Write(w io.WriteCloser, findings []Finding) error
type Finding ¶
type Finding struct {
// Rule is the name of the rule that was matched
RuleID string
Description string
StartLine int
EndLine int
StartColumn int
EndColumn int
// Regex match that triggered the finding
Match string
// Captured secret
Secret string
// MatchContext contains surrounding lines around the match
MatchContext string `json:",omitempty"`
Line string `json:"-"`
// CaptureGroups holds named regex capture groups from the match.
CaptureGroups map[string]string `json:",omitempty"`
// Fragment used for multi-part rule checking and CEL filtering
Fragment *sources.Fragment `json:",omitempty"`
// Attributes holds additional metadata about the finding.
// Keys are defined in sources.Attr* constants (subject to change), but this is extensible for custom use cases.
// Attributes are initially populated from the source's Fragment attributes and can be added to in the Detector or ValidationPool.
// Deprecated "attribute" fields (File, Commit, etc.) are synced from Attributes for compatibility.
Attributes map[string]string `json:",omitempty"`
Tags []string
RuleSpecificity int `json:"-"`
// RequiredSets holds the Cartesian-product combinations of required findings.
// Each set is one complete group of components that can be validated independently.
RequiredSets []RequiredSet `json:",omitempty"`
ValidationStatus ValidationStatus `json:",omitempty"`
ValidationReason string `json:",omitempty"`
// TODO maybe just use the Attribute map
ValidationMeta map[string]any `json:",omitempty"`
// unique identifier
Fingerprint string
// Deprecated
// File is the name of the file containing the finding
// Deprecated
File string
// Deprecated
SymlinkFile string
// Deprecated
Commit string
// Deprecated
Link string `json:",omitempty"`
// Entropy is the shannon entropy of Value
// Deprecated
Entropy float32
// Deprecated
Author string
// Deprecated
Email string
// Deprecated
Date string
// Deprecated
Message string
// contains filtered or unexported fields
}
Finding contains a whole bunch of information about a secret finding. Plenty of real estate in this bad boy so fillerup as needed.
func (Finding) Attribute ¶ added in v1.2.0
Attribute is retained as a compatibility wrapper around Attr.
func (*Finding) BuildRequiredSets ¶ added in v1.1.2
func (f *Finding) BuildRequiredSets(requiredFindings []*RequiredFinding, maxRequiredSets int)
BuildRequiredSets generates the Cartesian product of the given required findings grouped by RuleID and populates f.RequiredSets. maxRequiredSets caps the total number of combos to prevent excessive memory use.
func (Finding) PrintLegacy ¶ added in v1.4.0
PrintLegacy prints a finding using the legacy key/value verbose format.
func (*Finding) PrintRequiredFindings ¶
func (*Finding) SetAttributes ¶ added in v1.2.0
SetAttributes stores a copy of attrs and syncs deprecated source fields for compatibility.
func (*Finding) SetExprContext ¶ added in v1.6.0
func (*Finding) SetFingerprint ¶ added in v1.2.0
func (f *Finding) SetFingerprint()
func (*Finding) SyncDeprecatedSourceFields ¶ added in v1.2.0
func (f *Finding) SyncDeprecatedSourceFields()
SyncDeprecatedSourceFields backfills deprecated fields from Attributes so legacy reporters, baselines, and templates continue to work.
type FullDescription ¶
type FullDescription struct {
Text string `json:"text"`
}
type JsonReporter ¶
type JsonReporter struct {
}
func (*JsonReporter) Write ¶
func (t *JsonReporter) Write(w io.WriteCloser, findings []Finding) error
type JunitReporter ¶
type JunitReporter struct {
}
func (*JunitReporter) Write ¶
func (r *JunitReporter) Write(w io.WriteCloser, findings []Finding) error
type Locations ¶
type Locations struct {
PhysicalLocation PhysicalLocation `json:"physicalLocation"`
}
type PartialFingerPrints ¶
type PhysicalLocation ¶
type PhysicalLocation struct {
ArtifactLocation ArtifactLocation `json:"artifactLocation"`
Region Region `json:"region"`
ContextRegion *ContextRegion `json:"contextRegion,omitempty"`
}
type Properties ¶
type Properties struct {
Tags []string `json:"tags"`
}
type RequiredFinding ¶
type RequiredFinding struct {
// contains a subset of the Finding fields
// only used for reporting
RuleID string
StartLine int
EndLine int
StartColumn int
EndColumn int
Line string `json:"-"`
Match string
Secret string
CaptureGroups map[string]string `json:",omitempty"`
RuleSpecificity int `json:"-"`
}
type RequiredSet ¶ added in v1.1.2
type RequiredSet struct {
Components []*RequiredFinding `json:"components"`
ValidationStatus ValidationStatus `json:"validationStatus,omitempty"`
ValidationReason string `json:"validationReason,omitempty"`
}
RequiredSet represents one combination of required findings (one element per required rule) from the Cartesian product. Each set can be validated independently and carries its own validation result.
type Results ¶
type Results struct {
Message Message `json:"message"`
RuleId string `json:"ruleId"`
Locations []Locations `json:"locations"`
PartialFingerPrints `json:"partialFingerprints"`
Properties Properties `json:"properties"`
}
type Rules ¶
type Rules struct {
ID string `json:"id"`
Description ShortDescription `json:"shortDescription"`
}
type SarifReporter ¶
func (*SarifReporter) Write ¶
func (r *SarifReporter) Write(w io.WriteCloser, findings []Finding) error
type ShortDescription ¶
type ShortDescription struct {
Text string `json:"text"`
}
type TemplateReporter ¶
type TemplateReporter struct {
// contains filtered or unexported fields
}
func NewTemplateReporter ¶
func NewTemplateReporter(templatePath string) (*TemplateReporter, error)
func (*TemplateReporter) Write ¶
func (t *TemplateReporter) Write(w io.WriteCloser, findings []Finding) error
writeTemplate renders the findings using the user-provided template. https://www.digitalocean.com/community/tutorials/how-to-use-templates-in-go
type TestSuites ¶
type ValidationStatus ¶ added in v1.5.0
type ValidationStatus string
ValidationStatus describes the liveness state of a finding's secret as determined by the validation engine. It is a string-backed type so that it serializes identically to the previous plain-string field, while giving callers a single, type-safe set of values to compare against.
const ( // ValidationStatusNone is the zero value: no validation was performed. ValidationStatusNone ValidationStatus = "" // ValidationStatusValid means the secret was confirmed active. ValidationStatusValid ValidationStatus = "valid" // ValidationStatusNeedsValidation means the secret could not be validated // automatically and needs a manual check. ValidationStatusNeedsValidation ValidationStatus = "needs_validation" // ValidationStatusInvalid means the secret was rejected by the provider. ValidationStatusInvalid ValidationStatus = "invalid" // ValidationStatusRevoked means the secret is known to be revoked. ValidationStatusRevoked ValidationStatus = "revoked" // ValidationStatusUnknown means validation produced an indeterminate result. ValidationStatusUnknown ValidationStatus = "unknown" // ValidationStatusError means validation could not be completed due to an error. ValidationStatusError ValidationStatus = "error" )
func (ValidationStatus) String ¶ added in v1.5.0
func (s ValidationStatus) String() string
String returns the underlying string value, satisfying fmt.Stringer.