cribra 0.3.0

Privacy-first Rust core for detecting, querying, and safely transforming secrets and sensitive data
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83

//! Public deterministic pseudonymization tests.

use cribra::{
    Rule, Scanner, Severity,
    transform::{PseudonymizationOptions, pseudonymize},
};

#[test]
fn same_secret_across_sources_has_same_pseudonym() {
    let scanner = Scanner::builder()
        .rule(Rule::literal("secret", "SECRET", Severity::High))
        .build()
        .expect("scanner should build");

    let key = [42; 32];
    let options = PseudonymizationOptions::new(key);

    let first_source = "A=SECRET";
    let second_source = "B=SECRET";

    let first_results = scanner.scan([("first", first_source)]);
    let second_results = scanner.scan([("second", second_source)]);

    let first = pseudonymize(
        first_source,
        first_results.single_report().unwrap(),
        &options,
    )
    .unwrap();
    let second = pseudonymize(
        second_source,
        second_results.single_report().unwrap(),
        &options,
    )
    .unwrap();

    assert_eq!(
        first.strip_prefix("A=").unwrap(),
        second.strip_prefix("B=").unwrap(),
    );
}

#[test]
fn changing_pseudonymization_key_breaks_cross_run_linkability() {
    let scanner = Scanner::builder()
        .rule(Rule::literal("secret", "SECRET", Severity::High))
        .build()
        .expect("scanner should build");

    let source = "TOKEN=SECRET";
    let results = scanner.scan([("memory", source)]);
    let report = results.single_report().unwrap();

    let first = pseudonymize(source, report, &PseudonymizationOptions::new([1; 32])).unwrap();
    let second = pseudonymize(source, report, &PseudonymizationOptions::new([2; 32])).unwrap();

    assert_ne!(first, second);
}

#[test]
fn pseudonymization_does_not_embed_rule_or_secret() {
    let scanner = Scanner::builder()
        .rule(Rule::literal(
            "provider.secret.rule",
            "SECRET",
            Severity::Critical,
        ))
        .build()
        .expect("scanner should build");

    let source = "TOKEN=SECRET";
    let results = scanner.scan([("memory", source)]);
    let output = pseudonymize(
        source,
        results.single_report().unwrap(),
        &PseudonymizationOptions::new([7; 32]),
    )
    .unwrap();

    assert!(!output.contains("SECRET"));
    assert!(!output.contains("provider.secret.rule"));
    assert!(output.contains("cribra_pseudo_"));
}