output

func BuildEvidence ¶

func BuildEvidence(label, request, response string) string

BuildEvidence renders one request/response pair into a single AdditionalEvidence entry. When label is non-empty it is prefixed as a "# [label]" marker line so a reviewer — and the UI's evidence tabs — can tell a baseline pair from an attack pair from a confirmation round. Returns "" when both halves are empty (so an empty pair is never recorded).

func EscapeOneLine ¶

func EscapeOneLine(s string) string

EscapeOneLine renders embedded control characters (newlines, carriage returns, tabs) as their literal backslash-escape sequences so a finding's extracted value always prints as a single console line — while preserving the visual cue that the value spanned multiple lines (e.g. a JS snippet), rather than collapsing the structure away into spaces. Values without such characters pass through untouched.

func FormatPhaseFindingLine ¶

func FormatPhaseFindingLine(phaseTag string, r *ResultEvent) string

FormatPhaseFindingLine renders a phase-prefixed one-line summary of a finding for live display on stderr during a scan, e.g.:

❯ dynamic-assessment │ [passive] [crypto-weakness-detect] [• low] GET https://h/p

It mirrors the chevron/pipe prefix of the phase status line plus the bracketed [type] [module] severity METHOD URL layout of the console result writer (formatScreen), so streamed findings read identically whether they reach the terminal via stdout (console format) or this stderr echo (jsonl/html format, where the stdout result stream is deferred to files). The trailing newline is included.

func GenerateDocumentReport ¶

func GenerateDocumentReport(items []any, outputPath string, meta HTMLReportMeta) error

func GenerateHTMLReport ¶

func GenerateHTMLReport(items []any, outputPath string, meta HTMLReportMeta) error

GenerateHTMLReport renders the embedded template.html template with the provided items to outputPath. If title is empty it defaults to "Vigolium Scan Report".

Each item should be a ready-to-marshal envelope (e.g. struct with Type and Data fields). Items are streamed one at a time to keep memory usage constant regardless of result set size.

func GenerateHTMLReportStreaming ¶

func GenerateHTMLReportStreaming(produce ReportItemProducer, outputPath string, meta HTMLReportMeta) error

GenerateHTMLReportStreaming renders the embedded template.html to outputPath by pulling items from produce one at a time, so the full result set never lives in memory. The output is byte-identical to a GenerateHTMLReport call over the same items. The report is written to a temp sibling and atomically renamed into place on success, so a mid-stream error never leaves a half-written report behind.

func GenerateMarkdownReport ¶

func GenerateMarkdownReport(items []any, outputPath string, meta HTMLReportMeta) error

func GeneratePDFReport ¶

func GeneratePDFReport(items []any, outputPath string, meta HTMLReportMeta) error

func GenerateSARIFReport ¶

func GenerateSARIFReport(items []any, outputPath string, meta HTMLReportMeta) error

GenerateSARIFReport writes the run's findings as a SARIF 2.1.0 log. It shares the signature of every other report generator (GenerateHTMLReport, GenerateMarkdownReport, …) so it drops into reportGenerator and the scan commands' reportFormats table unchanged.

func GroupingBranch ¶

func GroupingBranch(moduleID, rule, value, severity string, tags []string, byModule, byRule, bundleSuspect, tagSet map[string]struct{}) (moduleKey, valueKey string, ok bool)

GroupingBranch decides how one finding folds into a group, shared by the DB grouping pass and the live console grouper so the by-module / suspect-bundle / by-rule / value branches can't drift between the two. value is the finding's already-normalized extracted-value key (see NormalizedValueKey); severity is its severity name; tags is its tag list; byModule, byRule, bundleSuspect and tagSet are the resolved option sets.

It returns the module component of the grouping key (moduleID, or the rule-folded key for a by-rule module), the value component (emptied for by-module, suspect-bundle, and by-rule so every value collapses into one group), and ok=false when the finding is ungroupable — no stable extracted value, or the tag gate rejects it. A returned empty valueKey with ok=true therefore marks a collapse-all group, where distinct values get unioned onto the survivor.

The suspect-bundle branch (see IsSuspectBundle) sits between by-module and by-rule: a module can be BOTH by-rule and bundle-suspect (secret-detect is), so its Suspect-severity findings collapse by module (every low-confidence rule on a host folds into one bundle) while its higher-severity findings stay per-rule. Severity is also a component of the outer GroupingKey, so the two tiers never share a group regardless.

func GroupingKey ¶

func GroupingKey(moduleID, severity, value, host string, perHost bool) string

GroupingKey assembles the finding grouping key from its components, prefixing the host when perHost is set. The single source of truth for the key layout (and its separator) shared by the live console grouper and the DB grouping pass — callers compute value via NormalizedValueKey (or "" to collapse a whole module) and pass it in.

func IsSuspectBundle ¶

func IsSuspectBundle(moduleID, severity string, tags []string, bundleSuspect map[string]struct{}) bool

IsSuspectBundle reports whether a finding folds into a module's Suspect-tier bundle: the module is listed in bundleSuspect, the finding's severity is "suspect", AND the finding carries SuspectBundleTag — the marker a module sets only on its generic, family-less matches. Such findings group by module (the rule/value is dropped from the key), collapsing the low-signal noise on a host into a single bundle, while a NAMED provider family (which the module leaves untagged) stays per-rule so distinct families are never merged into one rollup. The same module's higher-severity findings group by rule regardless.

Currently only secret-detect uses this — its generic-namespace rules (the "Generic Password" / "Generic API Key" matchers) are the noisy, family-less tier that warrants one per-host rollup; a recognisable provider key (Google, Storyblok, …) keeps its own triage row even when severity-downgraded to Suspect.

func MatchedURL ¶

func MatchedURL(r *ResultEvent) string

MatchedURL returns the location a finding points at, preferring the precise matched-at over the request URL and finally the host. Single source of truth for the Matched→URL→Host fallback used by screen formatting and grouping.

func NormalizeStringSet ¶

func NormalizeStringSet(items []string) map[string]struct{}

NormalizeStringSet trims each entry and drops empties and duplicates, returning a lookup set (nil when nothing usable remains). Unlike NormalizeTagSet it does NOT lowercase — it is for exact-match identifiers such as module IDs, which are matched case-sensitively against module_id in the DB.

func NormalizeTagSet ¶

func NormalizeTagSet(tags []string) map[string]struct{}

NormalizeTagSet lowercases and trims a tag filter into a set, returning nil when nothing usable remains (meaning "match regardless of tags").

func NormalizedValueKey ¶

func NormalizedValueKey(values []string) string

NormalizedValueKey builds a stable grouping key from a finding's extracted results: each entry trimmed, empties dropped, the remainder sorted (so order doesn't matter), joined with a separator that can't appear inside a single value. Returns "" when nothing usable remains (callers treat that as "ungroupable"). This is the single source of truth for the value-identity contract shared by the live console grouper and the DB grouping pass.

func RuleGroupKey ¶

func RuleGroupKey(moduleID, rule string) string

RuleGroupKey folds a module's per-finding rule identity (e.g. secret-detect's secret-scan rule name, carried in Info.Name / module_name) into the module component of a grouping key. ByRule grouping then collapses repeats of the SAME rule on a host while keeping DISTINCT rules — a "Looker Client ID" vs an "AWS Access Key", both emitted by secret-detect — as separate findings. Uses groupKeySeparator so the composite slots cleanly into GroupingKey's module position (every component there is control-char delimited, so the extra slot is unambiguous).

func TagsIntersect ¶

func TagsIntersect(tags []string, set map[string]struct{}) bool

TagsIntersect reports whether any of tags is present in set (built by NormalizeTagSet). An empty/nil set never matches — callers gate on len(set) first.