Documentation
¶
Index ¶
- Constants
- func CalculateEntropy(s string) float64
- type AllowlistConfig
- type ContentScanConfig
- type Detector
- type EntropyAnalysis
- type EntropyAnalyzer
- type Finding
- type Location
- type PatternConfig
- type PatternMatcher
- func (pm *PatternMatcher) AddPattern(pattern string, level RiskLevel)
- func (pm *PatternMatcher) GetAllPatterns() map[RiskLevel][]string
- func (pm *PatternMatcher) GetPatterns(level RiskLevel) []string
- func (pm *PatternMatcher) RemovePattern(pattern string, level RiskLevel)
- func (pm *PatternMatcher) ShouldExclude(path string) (bool, RiskLevel, string)
- type RiskLevel
- type ScanReport
- type ScanResult
- type Scanner
- type SecretType
- type SecurityConfig
- type SecurityContext
- type SensitivityLevel
- type ValidationError
Constants ¶
const ( // Entropy thresholds for different sensitivity levels LowEntropyThreshold = 3.5 MediumEntropyThreshold = 4.5 HighEntropyThreshold = 5.5 // Minimum length for entropy-based detection MinEntropyLength = 20 // Maximum length to consider (avoid very long strings like base64 images) MaxEntropyLength = 200 )
Variables ¶
This section is empty.
Functions ¶
func CalculateEntropy ¶
CalculateEntropy calculates Shannon entropy for a string
Types ¶
type AllowlistConfig ¶
type ContentScanConfig ¶
type Detector ¶
type Detector struct {
// contains filtered or unexported fields
}
func NewDetector ¶
func NewDetector(config *SecurityConfig) *Detector
func (*Detector) DetectSecrets ¶
func (*Detector) SetSensitivity ¶
func (d *Detector) SetSensitivity(level SensitivityLevel)
type EntropyAnalysis ¶
type EntropyAnalyzer ¶
type EntropyAnalyzer struct {
// contains filtered or unexported fields
}
func NewEntropyAnalyzer ¶
func NewEntropyAnalyzer(threshold float64) *EntropyAnalyzer
func (*EntropyAnalyzer) AnalyzeString ¶
func (ea *EntropyAnalyzer) AnalyzeString(s string) EntropyAnalysis
AnalyzeString provides detailed entropy analysis
func (*EntropyAnalyzer) ExtractHighEntropyStrings ¶
func (ea *EntropyAnalyzer) ExtractHighEntropyStrings(text string) []string
ExtractHighEntropyStrings finds all high-entropy strings in text
func (*EntropyAnalyzer) IsHighEntropy ¶
func (ea *EntropyAnalyzer) IsHighEntropy(s string) bool
IsHighEntropy checks if a string has high entropy indicating randomness
type Finding ¶
type PatternConfig ¶
type PatternMatcher ¶
type PatternMatcher struct {
// contains filtered or unexported fields
}
func NewPatternMatcher ¶
func NewPatternMatcher(config *SecurityConfig) *PatternMatcher
func (*PatternMatcher) AddPattern ¶
func (pm *PatternMatcher) AddPattern(pattern string, level RiskLevel)
func (*PatternMatcher) GetAllPatterns ¶
func (pm *PatternMatcher) GetAllPatterns() map[RiskLevel][]string
func (*PatternMatcher) GetPatterns ¶
func (pm *PatternMatcher) GetPatterns(level RiskLevel) []string
func (*PatternMatcher) RemovePattern ¶
func (pm *PatternMatcher) RemovePattern(pattern string, level RiskLevel)
func (*PatternMatcher) ShouldExclude ¶
func (pm *PatternMatcher) ShouldExclude(path string) (bool, RiskLevel, string)
type ScanReport ¶
type ScanReport struct {
Results []ScanResult
TotalFiles int
ScannedFiles int
SkippedFiles int
TotalFindings int
HighestRisk RiskLevel
}
func (*ScanReport) Summary ¶
func (r *ScanReport) Summary() string
type ScanResult ¶
type Scanner ¶
type Scanner struct {
// contains filtered or unexported fields
}
func NewScanner ¶
func NewScanner(config *SecurityConfig) *Scanner
func (*Scanner) ScanDirectory ¶
func (s *Scanner) ScanDirectory(path string, ignores []string) (*ScanReport, error)
func (*Scanner) ScanFile ¶
func (s *Scanner) ScanFile(path string, content []byte) (*ScanResult, error)
func (*Scanner) SetSensitivity ¶
func (s *Scanner) SetSensitivity(level SensitivityLevel)
type SecretType ¶
type SecretType string
const ( SecretTypeAPIKey SecretType = "api_key" SecretTypeAnthropicKey SecretType = "anthropic_key" SecretTypeGenericAPIKey SecretType = "generic_api_key" SecretTypePassword SecretType = "password" SecretTypePrivateKey SecretType = "private_key" SecretTypeToken SecretType = "token" SecretTypeAWSKey SecretType = "aws_key" SecretTypeGitHubToken SecretType = "github_token" SecretTypeJWT SecretType = "jwt" SecretTypeDatabaseURL SecretType = "database_url" SecretTypeGeneric SecretType = "generic_secret" SecretTypePII SecretType = "pii" SecretTypeCreditCard SecretType = "credit_card" SecretTypeSSN SecretType = "ssn" SecretTypeEmail SecretType = "email" SecretTypeIPAddress SecretType = "ip_address" )
type SecurityConfig ¶
type SecurityConfig struct {
// Global security settings
Enabled bool `toml:"enabled"`
ScanContent bool `toml:"scan_content"`
ExcludePatterns bool `toml:"exclude_patterns"`
Sensitivity SensitivityLevel `toml:"sensitivity"`
FailOnSecrets bool `toml:"fail_on_secrets"`
Interactive bool `toml:"interactive"`
// Pattern exclusion configuration
PatternConfig PatternConfig `toml:"pattern_config,omitempty"`
// Content scanning configuration
ContentScan ContentScanConfig `toml:"content_scan,omitempty"`
// Allowlist configuration
Allowlist AllowlistConfig `toml:"allowlist,omitempty"`
}
func DefaultSecurityConfig ¶
func DefaultSecurityConfig() *SecurityConfig
DefaultSecurityConfig returns a security configuration with sensible defaults
func (*SecurityConfig) IsFileAllowed ¶
func (sc *SecurityConfig) IsFileAllowed(filePath string) bool
IsFileAllowed checks if a file is in the allowlist
func (*SecurityConfig) IsPatternAllowed ¶
func (sc *SecurityConfig) IsPatternAllowed(value string) bool
IsPatternAllowed checks if a value matches any allowlist pattern
func (*SecurityConfig) Merge ¶
func (sc *SecurityConfig) Merge(other *SecurityConfig)
Merge combines two security configurations, with the second taking precedence
func (*SecurityConfig) Validate ¶
func (sc *SecurityConfig) Validate() error
Validate checks if the security configuration is valid
type SecurityContext ¶
type SecurityContext struct {
// contains filtered or unexported fields
}
func NewSecurityContext ¶
func NewSecurityContext(config *SecurityConfig) *SecurityContext
func (*SecurityContext) InteractivePrompt ¶
func (sc *SecurityContext) InteractivePrompt(report *ScanReport) (bool, bool, error)
InteractivePrompt presents security findings to the user and gets their decision Returns: proceed (continue with this dotfile), skipAll (skip security for remaining dotfiles), error
func (*SecurityContext) ScanPath ¶
func (sc *SecurityContext) ScanPath(path string, ignores []string) (*ScanReport, error)
ScanPath scans a file or directory for security issues before sync
func (*SecurityContext) ShouldProceed ¶
func (sc *SecurityContext) ShouldProceed(report *ScanReport) (bool, string)
ShouldProceed determines if sync should continue based on security findings
type SensitivityLevel ¶
type SensitivityLevel string
const ( SensitivityLow SensitivityLevel = "low" SensitivityMedium SensitivityLevel = "medium" SensitivityHigh SensitivityLevel = "high" SensitivityParanoid SensitivityLevel = "paranoid" )
type ValidationError ¶
func (*ValidationError) Error ¶
func (e *ValidationError) Error() string