cribra 0.3.0

Privacy-first Rust core for detecting, querying, and safely transforming secrets and sensitive data
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52

//! Custom-rule example for application/domain knowledge.

use cribra::{DetectionMode, Explanation, Remediation, Rule, Scanner, Severity, builtins};

fn main() -> Result<(), Box<dyn std::error::Error>> {
    let scanner = Scanner::builder()
        .builtins(builtins::CURRENT)
        .rule(
            Rule::prefix("acme.service-token", "acme_live_", Severity::Critical)
                .with_remediation(Remediation::RotateCredential),
        )
        .rule(
            Rule::pattern(
                "acme.recovery-code",
                r"\b[A-Z2-9]{4}(?:-[A-Z2-9]{4}){3}\b",
                Severity::High,
            )?
            .with_remediation(Remediation::RotateCredential),
        )
        .build()?;

    let source = "\
SERVICE_TOKEN=acme_live_1234567890
RECOVERY=ABCD-EFGH-IJKL-MNOP
";

    let results = scanner.scan([("config.env", source)]);
    let report = results.single_report().expect("one source was scanned");

    for finding in report.findings() {
        let explanation = finding
            .explanation(&scanner)
            .expect("finding should resolve against producing scanner");

        assert_eq!(
            explanation,
            Explanation::Classified(DetectionMode::MatcherOnly)
        );

        println!(
            "{}:{} {} {:?}",
            finding.location().line(),
            finding.location().column(),
            finding.rule_id(),
            finding.remediation(),
        );
    }

    assert_eq!(report.candidate_len(), 0);

    Ok(())
}