cha_core/plugins/
hardcoded_secret.rs

1use crate::{AnalysisContext, Finding, Location, Plugin, Severity, SmellCategory};
2use regex::Regex;
3use std::sync::LazyLock;
4
5pub struct HardcodedSecretAnalyzer;
6
7impl Default for HardcodedSecretAnalyzer {
8    fn default() -> Self {
9        Self
10    }
11}
12
13static PATTERNS: LazyLock<Vec<(&str, Regex)>> = LazyLock::new(|| {
14    [
15        ("AWS Access Key", r#"(?i)(aws_access_key_id|aws_secret_access_key)\s*[=:]\s*["']?[A-Za-z0-9/+=]{20,}"#),
16        ("Generic Secret", r#"(?i)(secret|password|passwd|token|api_key|apikey|auth_token|access_token)\s*[=:]\s*["'][^"']{8,}["']"#),
17        ("Private Key", r#"-----BEGIN (RSA |EC |DSA |OPENSSH )?PRIVATE KEY-----"#),
18        ("GitHub Token", r#"gh[ps]_[A-Za-z0-9_]{36,}"#),
19        ("Slack Token", r#"xox[bpors]-[A-Za-z0-9-]{10,}"#),
20        ("JWT", r#"eyJ[A-Za-z0-9_-]{10,}\.eyJ[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}"#),
21        ("Hex Secret (32+)", r#"(?i)(secret|key|token|password)\s*[=:]\s*["'][0-9a-f]{32,}["']"#),
22    ]
23    .iter()
24    .map(|(name, pat)| (*name, Regex::new(pat).unwrap()))
25    .collect()
26});
27
28impl Plugin for HardcodedSecretAnalyzer {
29    fn name(&self) -> &str {
30        "hardcoded_secret"
31    }
32
33    fn description(&self) -> &str {
34        "Hardcoded API keys, tokens, passwords"
35    }
36
37    fn analyze(&self, ctx: &AnalysisContext) -> Vec<Finding> {
38        let mut findings = Vec::new();
39        for (line_num, line) in ctx.file.content.lines().enumerate() {
40            let ln = line_num + 1;
41            if is_skip_line(line) {
42                continue;
43            }
44            for (label, re) in PATTERNS.iter() {
45                if re.is_match(line) {
46                    findings.push(Finding {
47                        smell_name: "hardcoded_secret".into(),
48                        category: SmellCategory::Security,
49                        severity: Severity::Warning,
50                        location: Location {
51                            path: ctx.file.path.clone(),
52                            start_line: ln,
53                            end_line: ln,
54                            name: Some(label.to_string()),
55                        },
56                        message: format!("Possible hardcoded {label} detected"),
57                        suggested_refactorings: vec![
58                            "Use environment variables".into(),
59                            "Use a secrets manager".into(),
60                        ],
61                        ..Default::default()
62                    });
63                    break; // one finding per line
64                }
65            }
66        }
67        findings
68    }
69}
70
71fn is_skip_line(line: &str) -> bool {
72    let trimmed = line.trim();
73    trimmed.starts_with("//")
74        || trimmed.starts_with('#')
75        || trimmed.starts_with("/*")
76        || trimmed.starts_with('*')
77        || trimmed.contains("example")
78        || trimmed.contains("placeholder")
79        || trimmed.contains("xxx")
80        || trimmed.contains("TODO")
81}
cha_core/plugins/hardcoded_secret.rs

cha_core/plugins/
hardcoded_secret.rs
