keyhog-scanner 0.5.44

keyhog-scanner: high-performance SIMD-accelerated secret detection engine
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114

use keyhog_scanner::context::{infer_context, CodeContext};
use keyhog_scanner::testing::context::parse_test_path_rules_for_test;

fn valid_rules() -> &'static str {
    r#"
schema_version = 1

[test_paths]
filename_prefixes = ["test_"]
filename_suffixes = ["_test.rs", ".spec.ts"]
path_components = ["tests", "__tests__"]
"#
}

#[test]
fn test_path_rules_tier_b_parser_rejects_invalid_vocabularies() {
    let empty_suffixes = parse_test_path_rules_for_test(
        r#"
schema_version = 1

[test_paths]
filename_prefixes = ["test_"]
filename_suffixes = []
path_components = ["tests"]
"#,
    )
    .expect_err("empty suffix list must fail closed");
    assert!(
        empty_suffixes.contains("filename_suffixes")
            && empty_suffixes.contains("at least one entry"),
        "unexpected empty suffix error: {empty_suffixes}"
    );

    let unsupported_schema = parse_test_path_rules_for_test(
        &valid_rules().replace("schema_version = 1", "schema_version = 2"),
    )
    .expect_err("unsupported schema must fail closed");
    assert!(
        unsupported_schema.contains("schema_version"),
        "unexpected schema error: {unsupported_schema}"
    );

    let duplicate = parse_test_path_rules_for_test(
        r#"
schema_version = 1

[test_paths]
filename_prefixes = ["test_", "test_"]
filename_suffixes = ["_test.rs"]
path_components = ["tests"]
"#,
    )
    .expect_err("duplicate rule must fail closed");
    assert!(
        duplicate.contains("duplicate"),
        "unexpected duplicate error: {duplicate}"
    );

    let separator = parse_test_path_rules_for_test(
        r#"
schema_version = 1

[test_paths]
filename_prefixes = ["test_"]
filename_suffixes = ["foo/bar"]
path_components = ["tests"]
"#,
    )
    .expect_err("path separators in filename fragments must fail closed");
    assert!(
        separator.contains("path separators"),
        "unexpected separator error: {separator}"
    );

    let dotted_component = parse_test_path_rules_for_test(
        r#"
schema_version = 1

[test_paths]
filename_prefixes = ["test_"]
filename_suffixes = ["_test.rs"]
path_components = ["foo.spec"]
"#,
    )
    .expect_err("filename-shaped path components must fail closed");
    assert!(
        dotted_component.contains("path segment"),
        "unexpected dotted component error: {dotted_component}"
    );
}

#[test]
fn bundled_test_path_rules_drive_context_classification() {
    let lines = ["token = 'fixture_secret'"];
    for path in [
        "pkg/auth_test.go",
        "src/__tests__/fixture.ts",
        "spec/features/auth_spec.rb",
        "client/session.spec.ts",
        "tests/fixtures/creds.env",
    ] {
        assert_eq!(
            infer_context(&lines, 0, Some(path)),
            CodeContext::TestCode,
            "bundled Tier-B test path rules must classify {path} as TestCode"
        );
    }

    assert_ne!(
        infer_context(&lines, 0, Some("src/prod_auth.go")),
        CodeContext::TestCode,
        "ordinary production paths must not be classified as TestCode"
    );
}