dictator-core 0.25.1

Core plugin loading and regime management for Dictator
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51

//! Classified-material detection: files whose contents must never be inspected,
//! quoted in snippets, or auto-fixed.

use camino::Utf8Path;

/// Rule id emitted for classified files
pub const CLASSIFIED_RULE: &str = "supreme/classified";

const CLASSIFIED_EXTENSIONS: &[&str] = &[
    "pem", "key", "enc", "p12", "pfx", "der", "jks", "keystore", "kdbx", "keytab",
];

const CLASSIFIED_FILENAMES: &[&str] = &[
    "master.key",
    "credentials.yml.enc",
    "secrets.yml",
    "id_rsa",
    "id_ed25519",
    "id_ecdsa",
    "id_dsa",
    ".netrc",
    ".pgpass",
    ".npmrc",
];

// Committed placeholders are lintable
const TEMPLATE_SUFFIXES: &[&str] = &[".example", ".sample", ".template", ".dist"];

/// True when a file's contents are secret material
#[must_use]
pub fn is_classified(path: &Utf8Path) -> bool {
    let Some(name) = path.file_name() else {
        return false;
    };
    let lower = name.to_ascii_lowercase();

    if TEMPLATE_SUFFIXES
        .iter()
        .any(|suffix| lower.ends_with(suffix))
    {
        return false;
    }
    if CLASSIFIED_FILENAMES.contains(&lower.as_str()) || lower.starts_with(".env") {
        return true;
    }
    path.extension()
        .is_some_and(|ext| CLASSIFIED_EXTENSIONS.contains(&ext.to_ascii_lowercase().as_str()))
}

#[cfg(test)]
mod tests;