cribra 0.3.0

Privacy-first Rust core for detecting, querying, and safely transforming secrets and sensitive data
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55

//! Public transformation tests.

use cribra::{
    Redaction, Rule, Scanner, Severity,
    transform::{redact, redact_with},
};

#[test]
fn public_redaction_uses_scanner_spans() {
    let scanner = Scanner::builder()
        .rule(Rule::literal("secret", "SECRET", Severity::High))
        .build()
        .expect("scanner should build");

    let source = "before SECRET after";
    let results = scanner.scan([("memory", source)]);
    let report = results.single_report().expect("one report");

    assert_eq!(redact(source, report).unwrap(), "before [REDACTED] after",);
}

#[test]
fn public_redaction_supports_custom_markers() {
    let scanner = Scanner::builder()
        .rule(Rule::literal("secret", "SECRET", Severity::High))
        .build()
        .expect("scanner should build");

    let source = "TOKEN=SECRET";
    let results = scanner.scan([("memory", source)]);
    let report = results.single_report().expect("one report");

    assert_eq!(
        redact_with(source, report, &Redaction::new("<hidden>")).unwrap(),
        "TOKEN=<hidden>",
    );
}

#[test]
fn overlapping_public_findings_cannot_leak_partial_secret_text() {
    let scanner = Scanner::builder()
        .rule(Rule::literal("short", "github", Severity::Low))
        .rule(Rule::literal("long", "github_pat", Severity::High))
        .build()
        .expect("scanner should build");

    let source = "github_pat_value";
    let results = scanner.scan([("memory", source)]);
    let report = results.single_report().expect("one report");

    let transformed = redact(source, report).unwrap();

    assert_eq!(transformed, "[REDACTED]_value");
    assert!(!transformed.contains("github"));
}