Documentation
¶
Index ¶
- Constants
- func MaskSecret(secret string, percent uint) string
- func ValidationStyle(status string, noColor bool) color.Style
- type ArtifactLocation
- type ComponentFinding
- type ComponentSet
- type ContextRegion
- type CredentialComponentReport
- type CredentialComponentSetReport
- type CredentialReport
- type CredentialReportFormat
- type CredentialReporter
- type CredentialRuleList
- type CredentialRuleSummary
- type CredentialValidationReport
- type CsvReporter
- type Driver
- type Failure
- type Finding
- func (f Finding) Attr(key string) string
- func (f Finding) Attribute(key string) string
- func (f *Finding) BuildComponentSets(componentFindings []*ComponentFinding, maxComponentSets int)
- func (f Finding) Print(noColor bool, redact uint)
- func (f *Finding) PrintComponentFindings(noColor bool, redact uint)
- func (f Finding) PrintLegacy(noColor bool, redact uint)
- func (f *Finding) Redact(percent uint)
- func (f *Finding) SetAttr(key, value string)
- func (f *Finding) SetAttributes(attrs map[string]string)
- func (f *Finding) SetExprContext(context string)
- func (f *Finding) SetFingerprint()
- func (f *Finding) SyncDeprecatedSourceFields()
- func (f *Finding) ToExprMap() map[string]string
- type FullDescription
- type JsonReporter
- type JunitReporter
- type Locations
- type Message
- type PartialFingerPrints
- type PhysicalLocation
- type Properties
- type Region
- type Reporter
- type Results
- type Rules
- type Runs
- type Sarif
- type SarifReporter
- type ShortDescription
- type Snippet
- type TemplateReporter
- type TestCase
- type TestSuite
- type TestSuites
- type Tool
- type ValidationStatus
Constants ¶
const ( // https://cwe.mitre.org/data/definitions/798.html CWE = "CWE-798" CWE_DESCRIPTION = "Use of Hard-coded Credentials" StdoutReportPath = "-" )
const CredentialReportSchemaVersion = 1
Variables ¶
This section is empty.
Functions ¶
func MaskSecret ¶
MaskSecret applies partial masking to a secret string based on the given percentage. At 100% the caller should use "REDACTED" instead.
Types ¶
type ArtifactLocation ¶
type ArtifactLocation struct {
URI string `json:"uri"`
}
type ComponentFinding ¶
type ComponentFinding struct {
// contains a subset of the Finding fields
// only used for reporting
RuleID string
Optional bool
StartLine int
EndLine int
StartColumn int
EndColumn int
Line string `json:"-"`
Match string
Secret string
// CaptureGroups holds named regex capture groups from the component match.
CaptureGroups map[string]string `json:",omitempty"`
RuleSpecificity int `json:"-"`
}
type ComponentSet ¶
type ComponentSet struct {
Components []*ComponentFinding `json:"components"`
ValidationStatus ValidationStatus `json:"validationStatus,omitempty"`
ValidationReason string `json:"validationReason,omitempty"`
}
ComponentSet represents one combination of component findings (one element per matched component rule) from the Cartesian product. Each set can be validated independently and carries its own validation result.
type ContextRegion ¶
type ContextRegion struct {
Snippet Snippet `json:"snippet"`
}
type CredentialComponentReport ¶
type CredentialComponentReport struct {
RuleID string `json:"rule_id"`
Optional bool `json:"optional,omitempty"`
}
CredentialComponentReport identifies one component and whether the rule declares it optional.
type CredentialComponentSetReport ¶
type CredentialComponentSetReport struct {
Status ValidationStatus `json:"status,omitempty"`
Reason string `json:"reason,omitempty"`
Components []CredentialComponentReport `json:"components"`
}
CredentialComponentSetReport describes one validated set of companion credentials.
type CredentialReport ¶
type CredentialReport struct {
SchemaVersion int `json:"schema_version"`
RuleID string `json:"rule_id"`
Attributes map[string]string `json:"attributes,omitempty"`
Validation CredentialValidationReport `json:"validation"`
}
CredentialReport keeps validation in its own namespace. Credential access analysis can be added later as an "analysis" sibling without changing the validation result contract.
func NewCredentialReport ¶
func NewCredentialReport(finding Finding, secrets []string, includeEmpty bool) CredentialReport
NewCredentialReport builds a redacted report from a validated finding.
type CredentialReportFormat ¶
type CredentialReportFormat string
CredentialReportFormat identifies a supported direct-validation report format.
const ( CredentialReportFormatPretty CredentialReportFormat = "pretty" CredentialReportFormatJSONL CredentialReportFormat = "jsonl" )
func ResolveCredentialReportFormat ¶
func ResolveCredentialReportFormat(format string) (CredentialReportFormat, error)
ResolveCredentialReportFormat validates an explicit format. Pretty output is the default; JSONL emits one compact credential record per line.
type CredentialReporter ¶
type CredentialReporter struct {
Format CredentialReportFormat
NoColor bool
Simple bool
}
CredentialReporter renders direct-validation results and rule lists.
func (CredentialReporter) Write ¶
func (r CredentialReporter) Write(w io.Writer, result CredentialReport) error
Write renders a direct-validation result.
func (CredentialReporter) WriteRuleList ¶
func (r CredentialReporter) WriteRuleList(w io.Writer, result CredentialRuleList) error
WriteRuleList renders the rules that support direct validation.
type CredentialRuleList ¶
type CredentialRuleList struct {
SchemaVersion int `json:"schema_version"`
Rules []CredentialRuleSummary `json:"rules"`
}
CredentialRuleList is the versioned output produced by validate --list.
type CredentialRuleSummary ¶
type CredentialRuleSummary struct {
RuleID string `json:"rule_id"`
Description string `json:"description,omitempty"`
Components []CredentialComponentReport `json:"components,omitempty"`
Captures []string `json:"captures,omitempty"`
}
CredentialRuleSummary describes a rule that supports direct validation.
type CredentialValidationReport ¶
type CredentialValidationReport struct {
Status ValidationStatus `json:"status"`
Reason string `json:"reason,omitempty"`
Metadata map[string]any `json:"metadata,omitempty"`
ComponentSets []CredentialComponentSetReport `json:"component_sets,omitempty"`
}
CredentialValidationReport is the validation portion of a credential report.
type CsvReporter ¶
type CsvReporter struct {
}
func (*CsvReporter) Write ¶
func (r *CsvReporter) Write(w io.WriteCloser, findings []Finding) error
type Finding ¶
type Finding struct {
// Rule is the name of the rule that was matched
RuleID string
Description string
StartLine int
EndLine int
StartColumn int
EndColumn int
// Regex match that triggered the finding
Match string
// Captured secret
Secret string
// MatchContext contains surrounding lines around the match
MatchContext string `json:",omitempty"`
Line string `json:"-"`
// CaptureGroups holds named regex capture groups from the match.
CaptureGroups map[string]string `json:",omitempty"`
// Fragment used for multi-part rule checking and CEL filtering
Fragment *sources.Fragment `json:",omitempty"`
// Attributes holds additional metadata about the finding.
// Keys are defined in sources.Attr* constants (subject to change), but this is extensible for custom use cases.
// Attributes are initially populated from the source's Fragment attributes and can be added to in the Detector or ValidationPool.
// Deprecated "attribute" fields (File, Commit, etc.) are synced from Attributes for compatibility.
Attributes map[string]string `json:",omitempty"`
Tags []string
RuleSpecificity int `json:"-"`
// ComponentSets holds the Cartesian-product combinations of component findings.
// Each set is one complete group of components that can be validated independently.
ComponentSets []ComponentSet `json:",omitempty"`
ValidationStatus ValidationStatus `json:",omitempty"`
ValidationReason string `json:",omitempty"`
// TODO maybe just use the Attribute map
ValidationMeta map[string]any `json:",omitempty"`
// unique identifier
Fingerprint string
// Deprecated
// File is the name of the file containing the finding
// Deprecated
File string
// Deprecated
SymlinkFile string
// Deprecated
Commit string
// Deprecated
Link string `json:",omitempty"`
// Entropy is the shannon entropy of Value
// Deprecated
Entropy float32
// Deprecated
Author string
// Deprecated
Email string
// Deprecated
Date string
// Deprecated
Message string
// contains filtered or unexported fields
}
Finding contains a whole bunch of information about a secret finding. Plenty of real estate in this bad boy so fillerup as needed.
func (*Finding) BuildComponentSets ¶
func (f *Finding) BuildComponentSets(componentFindings []*ComponentFinding, maxComponentSets int)
BuildComponentSets generates the Cartesian product of the given component findings grouped by RuleID and populates f.ComponentSets. maxComponentSets caps the total number of combos to prevent excessive memory use.
func (*Finding) PrintComponentFindings ¶
func (Finding) PrintLegacy ¶
PrintLegacy prints a finding using the legacy key/value verbose format.
func (*Finding) SetAttributes ¶
SetAttributes stores a copy of attrs and syncs deprecated source fields for compatibility.
func (*Finding) SetExprContext ¶
func (*Finding) SetFingerprint ¶
func (f *Finding) SetFingerprint()
func (*Finding) SyncDeprecatedSourceFields ¶
func (f *Finding) SyncDeprecatedSourceFields()
SyncDeprecatedSourceFields backfills deprecated fields from Attributes so legacy reporters, baselines, and templates continue to work.
type FullDescription ¶
type FullDescription struct {
Text string `json:"text"`
}
type JsonReporter ¶
type JsonReporter struct {
}
func (*JsonReporter) Write ¶
func (t *JsonReporter) Write(w io.WriteCloser, findings []Finding) error
type JunitReporter ¶
type JunitReporter struct {
}
func (*JunitReporter) Write ¶
func (r *JunitReporter) Write(w io.WriteCloser, findings []Finding) error
type Locations ¶
type Locations struct {
PhysicalLocation PhysicalLocation `json:"physicalLocation"`
}
type PartialFingerPrints ¶
type PhysicalLocation ¶
type PhysicalLocation struct {
ArtifactLocation ArtifactLocation `json:"artifactLocation"`
Region Region `json:"region"`
ContextRegion *ContextRegion `json:"contextRegion,omitempty"`
}
type Properties ¶
type Properties struct {
Tags []string `json:"tags"`
}
type Results ¶
type Results struct {
Message Message `json:"message"`
RuleId string `json:"ruleId"`
Locations []Locations `json:"locations"`
PartialFingerPrints `json:"partialFingerprints"`
Properties Properties `json:"properties"`
}
type Rules ¶
type Rules struct {
ID string `json:"id"`
Description ShortDescription `json:"shortDescription"`
}
type SarifReporter ¶
func (*SarifReporter) Write ¶
func (r *SarifReporter) Write(w io.WriteCloser, findings []Finding) error
type ShortDescription ¶
type ShortDescription struct {
Text string `json:"text"`
}
type TemplateReporter ¶
type TemplateReporter struct {
// contains filtered or unexported fields
}
func NewTemplateReporter ¶
func NewTemplateReporter(templatePath string) (*TemplateReporter, error)
func (*TemplateReporter) Write ¶
func (t *TemplateReporter) Write(w io.WriteCloser, findings []Finding) error
writeTemplate renders the findings using the user-provided template. https://www.digitalocean.com/community/tutorials/how-to-use-templates-in-go
type TestSuites ¶
type ValidationStatus ¶
type ValidationStatus string
ValidationStatus describes the liveness state of a finding's secret as determined by the validation engine. It is a string-backed type so that it serializes identically to the previous plain-string field, while giving callers a single, type-safe set of values to compare against.
const ( // ValidationStatusNone is the zero value: no validation was performed. ValidationStatusNone ValidationStatus = "" // ValidationStatusValid means the secret was confirmed active. ValidationStatusValid ValidationStatus = "valid" // ValidationStatusNeedsValidation means the secret could not be validated // automatically and needs a manual check. ValidationStatusNeedsValidation ValidationStatus = "needs_validation" // ValidationStatusInvalid means the secret was rejected by the provider. ValidationStatusInvalid ValidationStatus = "invalid" // ValidationStatusRevoked means the secret is known to be revoked. ValidationStatusRevoked ValidationStatus = "revoked" // ValidationStatusUnknown means validation produced an indeterminate result. ValidationStatusUnknown ValidationStatus = "unknown" // ValidationStatusError means validation could not be completed due to an error. ValidationStatusError ValidationStatus = "error" )
func (ValidationStatus) String ¶
func (s ValidationStatus) String() string
String returns the underlying string value, satisfying fmt.Stringer.