cribra 0.4.0

Embeddable, local-first Rust engine for detecting, reviewing, and safely transforming secrets and sensitive data.
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73

use cribra::{Rule, Scanner, Severity, builtins, transform};

#[test]
fn default_scanner_is_external_consumer_accessible() {
    let scanner = Scanner::default();

    let results = scanner.scan([(
        "config.env",
        "GITHUB_TOKEN=ghp_AbCdEf0123456789_AbCdEf0123456789",
    )]);

    assert!(
        !results
            .single_report()
            .expect("one source")
            .findings()
            .is_empty()
    );
}

#[test]
fn selectable_builtins_are_external_consumer_accessible() {
    let scanner = Scanner::builder()
        .builtins([
            builtins::GITHUB_CLASSIC_PAT,
            builtins::STRIPE_LIVE_SECRET_KEY,
        ])
        .build()
        .expect("selected built-ins should compile");

    let _ = scanner;
}

#[test]
fn custom_and_builtin_rules_are_composable() {
    let scanner = Scanner::builder()
        .builtins([builtins::GITHUB_CLASSIC_PAT])
        .rule(Rule::literal(
            "domain.internal-secret",
            "PRIVATE_VALUE",
            Severity::High,
        ))
        .build()
        .expect("mixed scanner should compile");

    let results = scanner.scan([("source", "PRIVATE_VALUE")]);

    assert_eq!(
        results
            .single_report()
            .expect("one source")
            .findings()
            .len(),
        1
    );
}

#[test]
fn transform_namespace_is_external_consumer_accessible() {
    let scanner = Scanner::builder()
        .rule(Rule::literal("credential", "SECRET", Severity::High))
        .build()
        .expect("scanner should compile");

    let source = "TOKEN=SECRET";
    let results = scanner.scan([("source", source)]);
    let report = results.single_report().expect("one source");

    assert_eq!(
        transform::redact(source, report).expect("redaction should succeed"),
        "TOKEN=[REDACTED]"
    );
}