cribra 0.2.0

Privacy-first Rust core for detecting, querying, and safely transforming secrets and sensitive data
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86

//! Built-in detection contracts.
//!
//! Built-ins combine candidate discovery, severity and validator selection into
//! reusable [`RuleSpec`] values.

mod contextual;
mod deterministic;

pub use contextual::{
    AWS_ACCESS_KEY_ID, AWS_SECRET_ACCESS_KEY, AWS_SESSION_TOKEN, AWS_TEMPORARY_ACCESS_KEY_ID,
    AZURE_CLIENT_SECRET, AZURE_SHARED_ACCESS_SIGNATURE, AZURE_STORAGE_ACCOUNT_KEY,
    DATABASE_PASSWORD_FIELD, GCP_CLIENT_SECRET, GCP_PRIVATE_KEY, GCP_PRIVATE_KEY_ID,
    GENERIC_API_KEY, GENERIC_AUTH_TOKEN, GENERIC_SECRET, PASSPHRASE_FIELD, PASSWORD_FIELD,
    SENSITIVE_HASH,
};
pub use deterministic::{
    CLOUDFLARE_ACCOUNT_API_TOKEN, CLOUDFLARE_GLOBAL_API_KEY, CLOUDFLARE_USER_API_TOKEN,
    GITHUB_APP_INSTALLATION_TOKEN, GITHUB_APP_REFRESH_TOKEN, GITHUB_APP_USER_TOKEN,
    GITHUB_CLASSIC_PAT, GITHUB_FINE_GRAINED_PAT, GITHUB_OAUTH_TOKEN,
    GITHUB_STATELESS_INSTALLATION_TOKEN, SIGNED_JWT, SLACK_APP_LEVEL_TOKEN, SLACK_BOT_TOKEN,
    SLACK_USER_TOKEN, SLACK_WORKFLOW_TOKEN, STRIPE_LIVE_RESTRICTED_KEY, STRIPE_LIVE_SECRET_KEY,
    STRIPE_TEST_RESTRICTED_KEY, STRIPE_TEST_SECRET_KEY, STRIPE_WEBHOOK_SIGNING_SECRET,
    TELEGRAM_BOT_TOKEN,
};

use crate::RuleSpec;

/// Complete built-in rule pack currently supported by the scanner core.
pub const CURRENT: &[RuleSpec] = &[
    GITHUB_CLASSIC_PAT,
    GITHUB_FINE_GRAINED_PAT,
    GITHUB_OAUTH_TOKEN,
    GITHUB_APP_USER_TOKEN,
    GITHUB_APP_INSTALLATION_TOKEN,
    GITHUB_STATELESS_INSTALLATION_TOKEN,
    GITHUB_APP_REFRESH_TOKEN,
    STRIPE_LIVE_SECRET_KEY,
    STRIPE_TEST_SECRET_KEY,
    STRIPE_LIVE_RESTRICTED_KEY,
    STRIPE_TEST_RESTRICTED_KEY,
    STRIPE_WEBHOOK_SIGNING_SECRET,
    CLOUDFLARE_GLOBAL_API_KEY,
    CLOUDFLARE_USER_API_TOKEN,
    CLOUDFLARE_ACCOUNT_API_TOKEN,
    SLACK_BOT_TOKEN,
    SLACK_USER_TOKEN,
    SLACK_APP_LEVEL_TOKEN,
    SLACK_WORKFLOW_TOKEN,
    TELEGRAM_BOT_TOKEN,
    SIGNED_JWT,
    AWS_ACCESS_KEY_ID,
    AWS_TEMPORARY_ACCESS_KEY_ID,
    AWS_SECRET_ACCESS_KEY,
    AWS_SESSION_TOKEN,
    AZURE_CLIENT_SECRET,
    AZURE_STORAGE_ACCOUNT_KEY,
    AZURE_SHARED_ACCESS_SIGNATURE,
    GCP_PRIVATE_KEY_ID,
    GCP_CLIENT_SECRET,
    GCP_PRIVATE_KEY,
    PASSWORD_FIELD,
    DATABASE_PASSWORD_FIELD,
    PASSPHRASE_FIELD,
    SENSITIVE_HASH,
    GENERIC_API_KEY,
    GENERIC_AUTH_TOKEN,
    GENERIC_SECRET,
];

use std::sync::{Arc, LazyLock};

use crate::{Scanner, compiled_rule::CompiledRuleSet};

static CURRENT_COMPILED: LazyLock<Arc<CompiledRuleSet>> = LazyLock::new(|| {
    let rules = CURRENT
        .iter()
        .map(|spec| spec.to_rule())
        .collect::<Result<Vec<_>, _>>()
        .expect("builtin rules must be valid");

    Arc::new(CompiledRuleSet::compile(rules).expect("builtin rules must compile"))
});

pub(crate) fn current_scanner() -> Scanner {
    Scanner::new(Arc::clone(&CURRENT_COMPILED))
}