cribra 0.2.0

Privacy-first Rust core for detecting, querying, and safely transforming secrets and sensitive data
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119

//! Contextual validation for password-like configuration fields.
//!
//! Password values rarely have a unique standalone shape. Detection is based
//! on an explicit password-related field name plus conservative value checks.

use super::{
    context::ValidationContext,
    utils::{DEFAULT_KEY_WINDOW, key_matches_any, nearest_key},
};
use crate::validators::utils::is_obvious_placeholder;

/// Password-like configuration field recognized by contextual validation.
#[derive(Debug, Copy, Clone, Eq, PartialEq, Ord, PartialOrd, Hash)]
pub(crate) enum PasswordKind {
    /// Generic password field.
    Password,

    /// Passphrase field.
    Passphrase,

    /// Database password field.
    DatabasePassword,
}

/// Successful password-field contextual validation.
#[derive(Debug, Copy, Clone, Eq, PartialEq)]
pub(crate) struct PasswordValidation {
    kind: PasswordKind,
}

impl PasswordValidation {
    pub(crate) const fn kind(self) -> PasswordKind {
        self.kind
    }
}

/// Validates a candidate assigned to a password-related configuration key.
pub(crate) fn validate_password(context: &ValidationContext<'_>) -> Option<PasswordValidation> {
    let candidate = context.candidate();

    if !valid_password_value(candidate) {
        return None;
    }

    let key = nearest_key(context.before_window(DEFAULT_KEY_WINDOW))?;

    let kind = if key_matches_any(
        key,
        &[
            "database_password",
            "db_password",
            "postgres_password",
            "mysql_password",
            "redis_password",
        ],
    ) {
        PasswordKind::DatabasePassword
    } else if key_matches_any(key, &["passphrase", "private_key_passphrase"]) {
        PasswordKind::Passphrase
    } else if key_matches_any(
        key,
        &[
            "password",
            "passwd",
            "pwd",
            "admin_password",
            "root_password",
        ],
    ) {
        PasswordKind::Password
    } else {
        return None;
    };

    Some(PasswordValidation { kind })
}

fn valid_password_value(candidate: &str) -> bool {
    (8..=1024).contains(&candidate.len())
        && !candidate.chars().any(char::is_control)
        && !is_obvious_placeholder(candidate)
}

#[cfg(test)]
mod tests {
    use super::*;

    fn context<'a>(source: &'a str, value: &'a str) -> ValidationContext<'a> {
        let start = source.find(value).expect("fixture must contain value");
        ValidationContext::new(source, start..start + value.len())
    }

    #[test]
    fn recognizes_password_and_database_password_fields() {
        let password = "CorrectHorseBatteryStaple!";
        let source = format!("password={password}");

        assert_eq!(
            validate_password(&context(&source, password)).map(PasswordValidation::kind),
            Some(PasswordKind::Password),
        );

        let source = format!("POSTGRES_PASSWORD={password}");
        assert_eq!(
            validate_password(&context(&source, password)).map(PasswordValidation::kind),
            Some(PasswordKind::DatabasePassword),
        );
    }

    #[test]
    fn rejects_placeholders_and_unrelated_fields() {
        let source = "password=changeme";
        assert!(validate_password(&context(source, "changeme")).is_none());

        let value = "CorrectHorseBatteryStaple!";
        let source = format!("display_name={value}");
        assert!(validate_password(&context(&source, value)).is_none());
    }
}