report

package
v0.2.0 Latest Latest
Warning

This package is not in the latest version of its module.

Go to latest
Published: Nov 4, 2026 License: MIT, MIT Imports: 19 Imported by: 0

Documentation

Index

Constants

View Source
const (
	// https://cwe.mitre.org/data/definitions/798.html
	CWE              = "CWE-798"
	CWE_DESCRIPTION  = "Use of Hard-coded Credentials"
	StdoutReportPath = "-"
)
View Source
const CredentialReportSchemaVersion = 1

Variables

This section is empty.

Functions

func MaskSecret

func MaskSecret(secret string, percent uint) string

MaskSecret applies partial masking to a secret string based on the given percentage. At 100% the caller should use "REDACTED" instead.

func ValidationStyle

func ValidationStyle(status string, noColor bool) color.Style

ValidationStyle returns the terminal style used for a validation status.

Types

type ArtifactLocation

type ArtifactLocation struct {
	URI string `json:"uri"`
}

type ComponentFinding

type ComponentFinding struct {
	// contains a subset of the Finding fields
	// only used for reporting
	RuleID      string
	Optional    bool
	StartLine   int
	EndLine     int
	StartColumn int
	EndColumn   int
	Line        string `json:"-"`
	Match       string
	Secret      string
	// CaptureGroups holds named regex capture groups from the component match.
	CaptureGroups   map[string]string `json:",omitempty"`
	RuleSpecificity int               `json:"-"`
}

type ComponentSet

type ComponentSet struct {
	Components       []*ComponentFinding `json:"components"`
	ValidationStatus ValidationStatus    `json:"validationStatus,omitempty"`
	ValidationReason string              `json:"validationReason,omitempty"`
}

ComponentSet represents one combination of component findings (one element per matched component rule) from the Cartesian product. Each set can be validated independently and carries its own validation result.

type ContextRegion

type ContextRegion struct {
	Snippet Snippet `json:"snippet"`
}

type CredentialComponentReport

type CredentialComponentReport struct {
	RuleID   string `json:"rule_id"`
	Optional bool   `json:"optional,omitempty"`
}

CredentialComponentReport identifies one component and whether the rule declares it optional.

type CredentialComponentSetReport

type CredentialComponentSetReport struct {
	Status     ValidationStatus            `json:"status,omitempty"`
	Reason     string                      `json:"reason,omitempty"`
	Components []CredentialComponentReport `json:"components"`
}

CredentialComponentSetReport describes one validated set of companion credentials.

type CredentialReport

type CredentialReport struct {
	SchemaVersion int                        `json:"schema_version"`
	RuleID        string                     `json:"rule_id"`
	Attributes    map[string]string          `json:"attributes,omitempty"`
	Validation    CredentialValidationReport `json:"validation"`
}

CredentialReport keeps validation in its own namespace. Credential access analysis can be added later as an "analysis" sibling without changing the validation result contract.

func NewCredentialReport

func NewCredentialReport(finding Finding, secrets []string, includeEmpty bool) CredentialReport

NewCredentialReport builds a redacted report from a validated finding.

type CredentialReportFormat

type CredentialReportFormat string

CredentialReportFormat identifies a supported direct-validation report format.

const (
	CredentialReportFormatPretty CredentialReportFormat = "pretty"
	CredentialReportFormatJSONL  CredentialReportFormat = "jsonl"
)

func ResolveCredentialReportFormat

func ResolveCredentialReportFormat(format string) (CredentialReportFormat, error)

ResolveCredentialReportFormat validates an explicit format. Pretty output is the default; JSONL emits one compact credential record per line.

type CredentialReporter

type CredentialReporter struct {
	Format  CredentialReportFormat
	NoColor bool
	Simple  bool
}

CredentialReporter renders direct-validation results and rule lists.

func (CredentialReporter) Write

func (r CredentialReporter) Write(w io.Writer, result CredentialReport) error

Write renders a direct-validation result.

func (CredentialReporter) WriteRuleList

func (r CredentialReporter) WriteRuleList(w io.Writer, result CredentialRuleList) error

WriteRuleList renders the rules that support direct validation.

type CredentialRuleList

type CredentialRuleList struct {
	SchemaVersion int                     `json:"schema_version"`
	Rules         []CredentialRuleSummary `json:"rules"`
}

CredentialRuleList is the versioned output produced by validate --list.

type CredentialRuleSummary

type CredentialRuleSummary struct {
	RuleID      string                      `json:"rule_id"`
	Description string                      `json:"description,omitempty"`
	Components  []CredentialComponentReport `json:"components,omitempty"`
	Captures    []string                    `json:"captures,omitempty"`
}

CredentialRuleSummary describes a rule that supports direct validation.

type CredentialValidationReport

type CredentialValidationReport struct {
	Status        ValidationStatus               `json:"status"`
	Reason        string                         `json:"reason,omitempty"`
	Metadata      map[string]any                 `json:"metadata,omitempty"`
	ComponentSets []CredentialComponentSetReport `json:"component_sets,omitempty"`
}

CredentialValidationReport is the validation portion of a credential report.

type CsvReporter

type CsvReporter struct {
}

func (*CsvReporter) Write

func (r *CsvReporter) Write(w io.WriteCloser, findings []Finding) error

type Driver

type Driver struct {
	Name            string  `json:"name"`
	SemanticVersion string  `json:"semanticVersion"`
	InformationUri  string  `json:"informationUri"`
	Rules           []Rules `json:"rules"`
}

type Failure

type Failure struct {
	XMLName xml.Name `xml:"failure"`
	Data    string   `xml:",chardata"`
	Message string   `xml:"message,attr"`
	Type    string   `xml:"type,attr"`
}

type Finding

type Finding struct {
	// Rule is the name of the rule that was matched
	RuleID      string
	Description string

	StartLine   int
	EndLine     int
	StartColumn int
	EndColumn   int

	// Regex match that triggered the finding
	Match string

	// Captured secret
	Secret string

	// MatchContext contains surrounding lines around the match
	MatchContext string `json:",omitempty"`

	Line string `json:"-"`

	// CaptureGroups holds named regex capture groups from the match.
	CaptureGroups map[string]string `json:",omitempty"`

	// Fragment used for multi-part rule checking and CEL filtering
	Fragment *sources.Fragment `json:",omitempty"`

	// Attributes holds additional metadata about the finding.
	// Keys are defined in sources.Attr* constants (subject to change), but this is extensible for custom use cases.
	// Attributes are initially populated from the source's Fragment attributes and can be added to in the Detector or ValidationPool.
	// Deprecated "attribute" fields (File, Commit, etc.) are synced from Attributes for compatibility.
	Attributes map[string]string `json:",omitempty"`

	Tags []string

	RuleSpecificity int `json:"-"`

	// ComponentSets holds the Cartesian-product combinations of component findings.
	// Each set is one complete group of components that can be validated independently.
	ComponentSets []ComponentSet `json:",omitempty"`

	ValidationStatus ValidationStatus `json:",omitempty"`
	ValidationReason string           `json:",omitempty"`
	// TODO maybe just use the Attribute map
	ValidationMeta map[string]any `json:",omitempty"`

	// unique identifier
	Fingerprint string

	// Deprecated
	// File is the name of the file containing the finding
	// Deprecated
	File string
	// Deprecated
	SymlinkFile string
	// Deprecated
	Commit string
	// Deprecated
	Link string `json:",omitempty"`

	// Entropy is the shannon entropy of Value
	// Deprecated
	Entropy float32

	// Deprecated
	Author string
	// Deprecated
	Email string
	// Deprecated
	Date string
	// Deprecated
	Message string
	// contains filtered or unexported fields
}

Finding contains a whole bunch of information about a secret finding. Plenty of real estate in this bad boy so fillerup as needed.

func (Finding) Attr

func (f Finding) Attr(key string) string

func (Finding) Attribute

func (f Finding) Attribute(key string) string

Attribute is retained as a compatibility wrapper around Attr.

func (*Finding) BuildComponentSets

func (f *Finding) BuildComponentSets(componentFindings []*ComponentFinding, maxComponentSets int)

BuildComponentSets generates the Cartesian product of the given component findings grouped by RuleID and populates f.ComponentSets. maxComponentSets caps the total number of combos to prevent excessive memory use.

func (Finding) Print

func (f Finding) Print(noColor bool, redact uint)

Print writes a verbose finding using the pretty box format.

func (*Finding) PrintComponentFindings

func (f *Finding) PrintComponentFindings(noColor bool, redact uint)

func (Finding) PrintLegacy

func (f Finding) PrintLegacy(noColor bool, redact uint)

PrintLegacy prints a finding using the legacy key/value verbose format.

func (*Finding) Redact

func (f *Finding) Redact(percent uint)

Redact removes sensitive information from a finding.

func (*Finding) SetAttr

func (f *Finding) SetAttr(key, value string)

func (*Finding) SetAttributes

func (f *Finding) SetAttributes(attrs map[string]string)

SetAttributes stores a copy of attrs and syncs deprecated source fields for compatibility.

func (*Finding) SetExprContext

func (f *Finding) SetExprContext(context string)

func (*Finding) SetFingerprint

func (f *Finding) SetFingerprint()

func (*Finding) SyncDeprecatedSourceFields

func (f *Finding) SyncDeprecatedSourceFields()

SyncDeprecatedSourceFields backfills deprecated fields from Attributes so legacy reporters, baselines, and templates continue to work.

func (*Finding) ToExprMap

func (f *Finding) ToExprMap() map[string]string

ToExprMap returns the fixed-shape map[string]string used as the `finding` variable in filter and validation expressions.

type FullDescription

type FullDescription struct {
	Text string `json:"text"`
}

type JsonReporter

type JsonReporter struct {
}

func (*JsonReporter) Write

func (t *JsonReporter) Write(w io.WriteCloser, findings []Finding) error

type JunitReporter

type JunitReporter struct {
}

func (*JunitReporter) Write

func (r *JunitReporter) Write(w io.WriteCloser, findings []Finding) error

type Locations

type Locations struct {
	PhysicalLocation PhysicalLocation `json:"physicalLocation"`
}

type Message

type Message struct {
	Text string `json:"text"`
}

type PartialFingerPrints

type PartialFingerPrints struct {
	CommitSha     string `json:"commitSha"`
	Email         string `json:"email"`
	Author        string `json:"author"`
	Date          string `json:"date"`
	CommitMessage string `json:"commitMessage"`
}

type PhysicalLocation

type PhysicalLocation struct {
	ArtifactLocation ArtifactLocation `json:"artifactLocation"`
	Region           Region           `json:"region"`
	ContextRegion    *ContextRegion   `json:"contextRegion,omitempty"`
}

type Properties

type Properties struct {
	Tags []string `json:"tags"`
}

type Region

type Region struct {
	StartLine   int     `json:"startLine"`
	StartColumn int     `json:"startColumn"`
	EndLine     int     `json:"endLine"`
	EndColumn   int     `json:"endColumn"`
	Snippet     Snippet `json:"snippet"`
}

type Reporter

type Reporter interface {
	Write(w io.WriteCloser, findings []Finding) error
}

type Results

type Results struct {
	Message             Message     `json:"message"`
	RuleId              string      `json:"ruleId"`
	Locations           []Locations `json:"locations"`
	PartialFingerPrints `json:"partialFingerprints"`
	Properties          Properties `json:"properties"`
}

type Rules

type Rules struct {
	ID          string           `json:"id"`
	Description ShortDescription `json:"shortDescription"`
}

type Runs

type Runs struct {
	Tool    Tool      `json:"tool"`
	Results []Results `json:"results"`
}

type Sarif

type Sarif struct {
	Schema  string `json:"$schema"`
	Version string `json:"version"`
	Runs    []Runs `json:"runs"`
}

type SarifReporter

type SarifReporter struct {
	OrderedRules []config.Rule
}

func (*SarifReporter) Write

func (r *SarifReporter) Write(w io.WriteCloser, findings []Finding) error

type ShortDescription

type ShortDescription struct {
	Text string `json:"text"`
}

type Snippet

type Snippet struct {
	Text string `json:"text"`
}

type TemplateReporter

type TemplateReporter struct {
	// contains filtered or unexported fields
}

func NewTemplateReporter

func NewTemplateReporter(templatePath string) (*TemplateReporter, error)

func (*TemplateReporter) Write

func (t *TemplateReporter) Write(w io.WriteCloser, findings []Finding) error

writeTemplate renders the findings using the user-provided template. https://www.digitalocean.com/community/tutorials/how-to-use-templates-in-go

type TestCase

type TestCase struct {
	XMLName   xml.Name `xml:"testcase"`
	Classname string   `xml:"classname,attr"`
	Failure   Failure  `xml:"failure"`
	File      string   `xml:"file,attr"`
	Name      string   `xml:"name,attr"`
	Time      string   `xml:"time,attr"`
}

type TestSuite

type TestSuite struct {
	XMLName   xml.Name   `xml:"testsuite"`
	Failures  string     `xml:"failures,attr"`
	Name      string     `xml:"name,attr"`
	Tests     string     `xml:"tests,attr"`
	TestCases []TestCase `xml:"testcase"`
	Time      string     `xml:"time,attr"`
}

type TestSuites

type TestSuites struct {
	XMLName    xml.Name `xml:"testsuites"`
	TestSuites []TestSuite
}

type Tool

type Tool struct {
	Driver Driver `json:"driver"`
}

type ValidationStatus

type ValidationStatus string

ValidationStatus describes the liveness state of a finding's secret as determined by the validation engine. It is a string-backed type so that it serializes identically to the previous plain-string field, while giving callers a single, type-safe set of values to compare against.

const (
	// ValidationStatusNone is the zero value: no validation was performed.
	ValidationStatusNone ValidationStatus = ""
	// ValidationStatusValid means the secret was confirmed active.
	ValidationStatusValid ValidationStatus = "valid"
	// ValidationStatusNeedsValidation means the secret could not be validated
	// automatically and needs a manual check.
	ValidationStatusNeedsValidation ValidationStatus = "needs_validation"
	// ValidationStatusInvalid means the secret was rejected by the provider.
	ValidationStatusInvalid ValidationStatus = "invalid"
	// ValidationStatusRevoked means the secret is known to be revoked.
	ValidationStatusRevoked ValidationStatus = "revoked"
	// ValidationStatusUnknown means validation produced an indeterminate result.
	ValidationStatusUnknown ValidationStatus = "unknown"
	// ValidationStatusError means validation could not be completed due to an error.
	ValidationStatusError ValidationStatus = "error"
)

func (ValidationStatus) String

func (s ValidationStatus) String() string

String returns the underlying string value, satisfying fmt.Stringer.

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL