cribra 0.3.0

Privacy-first Rust core for detecting, querying, and safely transforming secrets and sensitive data
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125

//! Contextual validation for Google Cloud service-account credentials.
//!
//! Service-account private material is identified through the canonical JSON
//! field names and PEM structure rather than through a standalone opaque-token
//! prefix.

use super::{
    context::ValidationContext,
    utils::{DEFAULT_KEY_WINDOW, contains_ascii_case_insensitive, key_matches_any, nearest_key},
};
use crate::validators::utils::is_obvious_placeholder;

/// Google Cloud credential artifact recognized by contextual validation.
#[derive(Debug, Copy, Clone, Eq, PartialEq, Ord, PartialOrd, Hash)]
pub(crate) enum GcpCredentialKind {
    /// Service-account private key under the `private_key` field.
    ServiceAccountPrivateKey,

    /// Private-key identifier under the `private_key_id` field.
    ServiceAccountPrivateKeyId,

    /// Client secret under the `client_secret` field.
    OAuthClientSecret,
}

/// Successful Google Cloud contextual validation.
#[derive(Debug, Copy, Clone, Eq, PartialEq)]
pub(crate) struct GcpValidation {
    kind: GcpCredentialKind,
}

impl GcpValidation {
    pub(crate) const fn kind(self) -> GcpCredentialKind {
        self.kind
    }
}

/// Validates a candidate found in Google Cloud credential context.
pub(crate) fn validate_gcp(context: &ValidationContext<'_>) -> Option<GcpValidation> {
    let candidate = context.candidate();

    if candidate.is_empty() || is_obvious_placeholder(candidate) {
        return None;
    }

    let before = context.before_window(DEFAULT_KEY_WINDOW);
    let key = nearest_key(before)?;

    if key_matches_any(key, &["private_key"]) && looks_like_private_key(candidate) {
        return Some(GcpValidation {
            kind: GcpCredentialKind::ServiceAccountPrivateKey,
        });
    }

    if key_matches_any(key, &["private_key_id"])
        && candidate.len() >= 16
        && candidate.len() <= 128
        && candidate.bytes().all(|byte| byte.is_ascii_hexdigit())
    {
        return Some(GcpValidation {
            kind: GcpCredentialKind::ServiceAccountPrivateKeyId,
        });
    }

    if key_matches_any(key, &["client_secret"])
        && candidate.len() >= 16
        && candidate.len() <= 255
        && candidate.is_ascii()
    {
        return Some(GcpValidation {
            kind: GcpCredentialKind::OAuthClientSecret,
        });
    }

    None
}

fn looks_like_private_key(candidate: &str) -> bool {
    candidate.len() >= 64
        && contains_ascii_case_insensitive(candidate, "begin private key")
        && contains_ascii_case_insensitive(candidate, "end private key")
}

#[cfg(test)]
mod tests {
    use super::*;

    fn context<'a>(source: &'a str, value: &'a str) -> ValidationContext<'a> {
        let start = source.find(value).expect("fixture must contain value");
        ValidationContext::new(source, start..start + value.len())
    }

    #[test]
    fn recognizes_service_account_private_key_id() {
        let value = "0123456789abcdef0123456789abcdef01234567";
        let source = format!(r#""private_key_id": "{value}""#);

        assert_eq!(
            validate_gcp(&context(&source, value)).map(GcpValidation::kind),
            Some(GcpCredentialKind::ServiceAccountPrivateKeyId),
        );
    }

    #[test]
    fn recognizes_service_account_private_key() {
        let value = concat!(
            "-----BEGIN PRIVATE KEY-----\n",
            "MIIEvQIBADANBgkqhkiG9w0BAQEFAASC",
            "0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZ\n",
            "-----END PRIVATE KEY-----",
        );
        let source = format!(r#""private_key": "{value}""#);

        assert_eq!(
            validate_gcp(&context(&source, value)).map(GcpValidation::kind),
            Some(GcpCredentialKind::ServiceAccountPrivateKey),
        );
    }

    #[test]
    fn rejects_private_key_id_without_field_context() {
        let value = "0123456789abcdef0123456789abcdef01234567";
        assert!(validate_gcp(&context(value, value)).is_none());
    }
}