report

package
v1.6.1 Latest Latest
Warning

This package is not in the latest version of its module.

Go to latest
Published: Jun 29, 2026 License: MIT Imports: 18 Imported by: 2

Documentation

Index

Constants

View Source
const (
	// https://cwe.mitre.org/data/definitions/798.html
	CWE              = "CWE-798"
	CWE_DESCRIPTION  = "Use of Hard-coded Credentials"
	StdoutReportPath = "-"
)

Variables

This section is empty.

Functions

func MaskSecret added in v1.1.2

func MaskSecret(secret string, percent uint) string

MaskSecret applies partial masking to a secret string based on the given percentage. At 100% the caller should use "REDACTED" instead.

Types

type ArtifactLocation

type ArtifactLocation struct {
	URI string `json:"uri"`
}

type ContextRegion added in v1.1.1

type ContextRegion struct {
	Snippet Snippet `json:"snippet"`
}

type CsvReporter

type CsvReporter struct {
}

func (*CsvReporter) Write

func (r *CsvReporter) Write(w io.WriteCloser, findings []Finding) error

type Driver

type Driver struct {
	Name            string  `json:"name"`
	SemanticVersion string  `json:"semanticVersion"`
	InformationUri  string  `json:"informationUri"`
	Rules           []Rules `json:"rules"`
}

type Failure

type Failure struct {
	XMLName xml.Name `xml:"failure"`
	Data    string   `xml:",chardata"`
	Message string   `xml:"message,attr"`
	Type    string   `xml:"type,attr"`
}

type Finding

type Finding struct {
	// Rule is the name of the rule that was matched
	RuleID      string
	Description string

	StartLine   int
	EndLine     int
	StartColumn int
	EndColumn   int

	// Regex match that triggered the finding
	Match string

	// Captured secret
	Secret string

	// MatchContext contains surrounding lines around the match
	MatchContext string `json:",omitempty"`

	Line string `json:"-"`

	// CaptureGroups holds named regex capture groups from the match.
	CaptureGroups map[string]string `json:",omitempty"`

	// Fragment used for multi-part rule checking and CEL filtering
	Fragment *sources.Fragment `json:",omitempty"`

	// Attributes holds additional metadata about the finding.
	// Keys are defined in sources.Attr* constants (subject to change), but this is extensible for custom use cases.
	// Attributes are initially populated from the source's Fragment attributes and can be added to in the Detector or ValidationPool.
	// Deprecated "attribute" fields (File, Commit, etc.) are synced from Attributes for compatibility.
	Attributes map[string]string `json:",omitempty"`

	Tags []string

	RuleSpecificity int `json:"-"`

	// RequiredSets holds the Cartesian-product combinations of required findings.
	// Each set is one complete group of components that can be validated independently.
	RequiredSets []RequiredSet `json:",omitempty"`

	ValidationStatus ValidationStatus `json:",omitempty"`
	ValidationReason string           `json:",omitempty"`
	// TODO maybe just use the Attribute map
	ValidationMeta map[string]any `json:",omitempty"`

	// unique identifier
	Fingerprint string

	// Deprecated
	// File is the name of the file containing the finding
	// Deprecated
	File string
	// Deprecated
	SymlinkFile string
	// Deprecated
	Commit string
	// Deprecated
	Link string `json:",omitempty"`

	// Entropy is the shannon entropy of Value
	// Deprecated
	Entropy float32

	// Deprecated
	Author string
	// Deprecated
	Email string
	// Deprecated
	Date string
	// Deprecated
	Message string
	// contains filtered or unexported fields
}

Finding contains a whole bunch of information about a secret finding. Plenty of real estate in this bad boy so fillerup as needed.

func (Finding) Attr added in v1.2.0

func (f Finding) Attr(key string) string

func (Finding) Attribute added in v1.2.0

func (f Finding) Attribute(key string) string

Attribute is retained as a compatibility wrapper around Attr.

func (*Finding) BuildRequiredSets added in v1.1.2

func (f *Finding) BuildRequiredSets(requiredFindings []*RequiredFinding, maxRequiredSets int)

BuildRequiredSets generates the Cartesian product of the given required findings grouped by RuleID and populates f.RequiredSets. maxRequiredSets caps the total number of combos to prevent excessive memory use.

func (Finding) Print added in v1.2.0

func (f Finding) Print(noColor bool, redact uint)

Print writes a verbose finding using the pretty box format.

func (Finding) PrintLegacy added in v1.4.0

func (f Finding) PrintLegacy(noColor bool, redact uint)

PrintLegacy prints a finding using the legacy key/value verbose format.

func (*Finding) PrintRequiredFindings

func (f *Finding) PrintRequiredFindings(noColor bool, redact uint)

func (*Finding) Redact

func (f *Finding) Redact(percent uint)

Redact removes sensitive information from a finding.

func (*Finding) SetAttr added in v1.2.0

func (f *Finding) SetAttr(key, value string)

func (*Finding) SetAttributes added in v1.2.0

func (f *Finding) SetAttributes(attrs map[string]string)

SetAttributes stores a copy of attrs and syncs deprecated source fields for compatibility.

func (*Finding) SetExprContext added in v1.6.0

func (f *Finding) SetExprContext(context string)

func (*Finding) SetFingerprint added in v1.2.0

func (f *Finding) SetFingerprint()

func (*Finding) SyncDeprecatedSourceFields added in v1.2.0

func (f *Finding) SyncDeprecatedSourceFields()

SyncDeprecatedSourceFields backfills deprecated fields from Attributes so legacy reporters, baselines, and templates continue to work.

func (*Finding) ToExprMap added in v1.6.0

func (f *Finding) ToExprMap() map[string]string

ToExprMap returns the fixed-shape map[string]string used as the `finding` variable in filter and validation expressions.

type FullDescription

type FullDescription struct {
	Text string `json:"text"`
}

type JsonReporter

type JsonReporter struct {
}

func (*JsonReporter) Write

func (t *JsonReporter) Write(w io.WriteCloser, findings []Finding) error

type JunitReporter

type JunitReporter struct {
}

func (*JunitReporter) Write

func (r *JunitReporter) Write(w io.WriteCloser, findings []Finding) error

type Locations

type Locations struct {
	PhysicalLocation PhysicalLocation `json:"physicalLocation"`
}

type Message

type Message struct {
	Text string `json:"text"`
}

type PartialFingerPrints

type PartialFingerPrints struct {
	CommitSha     string `json:"commitSha"`
	Email         string `json:"email"`
	Author        string `json:"author"`
	Date          string `json:"date"`
	CommitMessage string `json:"commitMessage"`
}

type PhysicalLocation

type PhysicalLocation struct {
	ArtifactLocation ArtifactLocation `json:"artifactLocation"`
	Region           Region           `json:"region"`
	ContextRegion    *ContextRegion   `json:"contextRegion,omitempty"`
}

type Properties

type Properties struct {
	Tags []string `json:"tags"`
}

type Region

type Region struct {
	StartLine   int     `json:"startLine"`
	StartColumn int     `json:"startColumn"`
	EndLine     int     `json:"endLine"`
	EndColumn   int     `json:"endColumn"`
	Snippet     Snippet `json:"snippet"`
}

type Reporter

type Reporter interface {
	Write(w io.WriteCloser, findings []Finding) error
}

type RequiredFinding

type RequiredFinding struct {
	// contains a subset of the Finding fields
	// only used for reporting
	RuleID          string
	StartLine       int
	EndLine         int
	StartColumn     int
	EndColumn       int
	Line            string `json:"-"`
	Match           string
	Secret          string
	CaptureGroups   map[string]string `json:",omitempty"`
	RuleSpecificity int               `json:"-"`
}

type RequiredSet added in v1.1.2

type RequiredSet struct {
	Components       []*RequiredFinding `json:"components"`
	ValidationStatus ValidationStatus   `json:"validationStatus,omitempty"`
	ValidationReason string             `json:"validationReason,omitempty"`
}

RequiredSet represents one combination of required findings (one element per required rule) from the Cartesian product. Each set can be validated independently and carries its own validation result.

type Results

type Results struct {
	Message             Message     `json:"message"`
	RuleId              string      `json:"ruleId"`
	Locations           []Locations `json:"locations"`
	PartialFingerPrints `json:"partialFingerprints"`
	Properties          Properties `json:"properties"`
}

type Rules

type Rules struct {
	ID          string           `json:"id"`
	Description ShortDescription `json:"shortDescription"`
}

type Runs

type Runs struct {
	Tool    Tool      `json:"tool"`
	Results []Results `json:"results"`
}

type Sarif

type Sarif struct {
	Schema  string `json:"$schema"`
	Version string `json:"version"`
	Runs    []Runs `json:"runs"`
}

type SarifReporter

type SarifReporter struct {
	OrderedRules []config.Rule
}

func (*SarifReporter) Write

func (r *SarifReporter) Write(w io.WriteCloser, findings []Finding) error

type ShortDescription

type ShortDescription struct {
	Text string `json:"text"`
}

type Snippet

type Snippet struct {
	Text string `json:"text"`
}

type TemplateReporter

type TemplateReporter struct {
	// contains filtered or unexported fields
}

func NewTemplateReporter

func NewTemplateReporter(templatePath string) (*TemplateReporter, error)

func (*TemplateReporter) Write

func (t *TemplateReporter) Write(w io.WriteCloser, findings []Finding) error

writeTemplate renders the findings using the user-provided template. https://www.digitalocean.com/community/tutorials/how-to-use-templates-in-go

type TestCase

type TestCase struct {
	XMLName   xml.Name `xml:"testcase"`
	Classname string   `xml:"classname,attr"`
	Failure   Failure  `xml:"failure"`
	File      string   `xml:"file,attr"`
	Name      string   `xml:"name,attr"`
	Time      string   `xml:"time,attr"`
}

type TestSuite

type TestSuite struct {
	XMLName   xml.Name   `xml:"testsuite"`
	Failures  string     `xml:"failures,attr"`
	Name      string     `xml:"name,attr"`
	Tests     string     `xml:"tests,attr"`
	TestCases []TestCase `xml:"testcase"`
	Time      string     `xml:"time,attr"`
}

type TestSuites

type TestSuites struct {
	XMLName    xml.Name `xml:"testsuites"`
	TestSuites []TestSuite
}

type Tool

type Tool struct {
	Driver Driver `json:"driver"`
}

type ValidationStatus added in v1.5.0

type ValidationStatus string

ValidationStatus describes the liveness state of a finding's secret as determined by the validation engine. It is a string-backed type so that it serializes identically to the previous plain-string field, while giving callers a single, type-safe set of values to compare against.

const (
	// ValidationStatusNone is the zero value: no validation was performed.
	ValidationStatusNone ValidationStatus = ""
	// ValidationStatusValid means the secret was confirmed active.
	ValidationStatusValid ValidationStatus = "valid"
	// ValidationStatusNeedsValidation means the secret could not be validated
	// automatically and needs a manual check.
	ValidationStatusNeedsValidation ValidationStatus = "needs_validation"
	// ValidationStatusInvalid means the secret was rejected by the provider.
	ValidationStatusInvalid ValidationStatus = "invalid"
	// ValidationStatusRevoked means the secret is known to be revoked.
	ValidationStatusRevoked ValidationStatus = "revoked"
	// ValidationStatusUnknown means validation produced an indeterminate result.
	ValidationStatusUnknown ValidationStatus = "unknown"
	// ValidationStatusError means validation could not be completed due to an error.
	ValidationStatusError ValidationStatus = "error"
)

func (ValidationStatus) String added in v1.5.0

func (s ValidationStatus) String() string

String returns the underlying string value, satisfying fmt.Stringer.

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL