cribra 0.3.0

Privacy-first Rust core for detecting, querying, and safely transforming secrets and sensitive data
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60

//! Public semantic-template transformation tests.

use cribra::{
    Rule, Scanner, Severity,
    transform::{TemplateOptions, template, template_with},
};

#[test]
fn public_template_uses_rule_identity_not_secret_value() {
    let scanner = Scanner::builder()
        .rule(Rule::literal(
            "example.credential",
            "SECRET",
            Severity::High,
        ))
        .build()
        .expect("scanner should build");

    let source = "TOKEN=SECRET";
    let results = scanner.scan([("memory", source)]);
    let report = results.single_report().expect("one report");

    let transformed = template(source, report).unwrap();

    assert_eq!(transformed, "TOKEN=<CRIBRA:example.credential>",);
    assert!(!transformed.contains("SECRET"));
}

#[test]
fn public_template_can_number_repeated_semantic_findings() {
    let scanner = Scanner::builder()
        .rule(Rule::literal("secret", "SECRET", Severity::High))
        .build()
        .expect("scanner should build");

    let source = "A=SECRET B=SECRET";
    let results = scanner.scan([("memory", source)]);
    let report = results.single_report().expect("one report");
    let options = TemplateOptions::new().numbered(true);

    assert_eq!(
        template_with(source, report, &options).unwrap(),
        "A=<CRIBRA:secret:1> B=<CRIBRA:secret:2>",
    );
}

#[test]
fn public_template_rejects_ambiguous_overlaps() {
    let scanner = Scanner::builder()
        .rule(Rule::literal("short", "github", Severity::Low))
        .rule(Rule::literal("long", "github_pat", Severity::High))
        .build()
        .expect("scanner should build");

    let source = "github_pat_value";
    let results = scanner.scan([("memory", source)]);
    let report = results.single_report().expect("one report");

    assert!(template(source, report).is_err());
}