Documentation
¶
Overview ¶
Package rules screens bounded text against explicit host-owned regular expressions. Rules cover only their configured patterns. They do not establish semantic safety, factual correctness or resistance to arbitrary obfuscation.
Index ¶
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
This section is empty.
Types ¶
type Config ¶
type Config struct {
Revision string `json:"revision"`
MaxBytes int `json:"max_bytes"`
Rules []Rule `json:"rules"`
}
Config is trusted host policy. Both directions use every rule. MaxBytes is required and bounds input and transformed output to at most one MiB. Revision identifies the immutable installed policy; changing rules requires a new one.
type Rule ¶
type Rule struct {
ID string `json:"id"`
Pattern string `json:"pattern"`
Decision safety.Decision `json:"decision"`
Replacement string `json:"replacement,omitempty"`
}
Rule blocks or redacts a pattern. Replacement is literal text, never a regexp expansion. Findings name the rule and never contain matched input.
type Scanner ¶
type Scanner struct {
// contains filtered or unexported fields
}
Scanner is immutable after construction and safe for concurrent scans. Blocking rules take precedence over redaction regardless of policy order.
func New ¶
New compiles a nonempty, finite policy. Unsupported decisions, duplicate IDs, empty matches and malformed expressions prevent installation.
func (*Scanner) ScanInput ¶
func (s *Scanner) ScanInput(ctx context.Context, r *safety.ScanRequest) (*safety.ScanResult, error)
ScanInput checks complete input without mutating the request.
func (*Scanner) ScanOutput ¶
func (s *Scanner) ScanOutput(ctx context.Context, r *safety.ScanRequest) (*safety.ScanResult, error)
ScanOutput checks complete output. Use buffered publication for this scanner.
Source Files