keyhog-scanner 0.5.73

keyhog-scanner: high-performance SIMD-accelerated secret detection engine
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40

use keyhog_core::{Chunk, ChunkMetadata, DetectorSpec, PatternSpec, Severity};
use keyhog_scanner::{CompiledScanner, ScanBackend};
#[test]
fn scan_simd_cpu_empty_chunk() {
    // The literal MUST be >= MIN_LITERAL_PREFIX_CHARS (3) so the scanner builds a
    // SIMD/Hyperscan plan and selected-peer initialization succeeds. With a
    // sub-floor literal (e.g. `x`) no prefilter is built, and explicitly
    // requesting `SimdCpu` returns a structured error (Law 10: no silent
    // CPU fallback) rather than terminating the test process.
    let d = DetectorSpec {
        tests: Vec::new(),
        id: "a".into(),
        name: "A".into(),
        service: "s".into(),
        severity: Severity::Low,
        patterns: vec![PatternSpec {
            regex: "xyz_marker".into(),
            description: None,
            group: None,
            required_literals: Vec::new(),
            client_safe: false,
            weak_anchor: false,
            structural_password_slot: false,
        }],
        companions: vec![],
        verify: None,
        keywords: vec!["xyz_marker".into()],
        min_confidence: None,
        ..keyhog_scanner::testing::named_detector_fixture_defaults()
    };
    let s = CompiledScanner::compile_for_backend(vec![d], ScanBackend::SimdCpu).unwrap();
    let chunk = Chunk {
        data: "".into(),
        metadata: ChunkMetadata::default(),
    };
    assert!(s
        .scan_with_backend(&chunk, ScanBackend::SimdCpu)
        .expect("selected SIMD empty-chunk scan succeeds")
        .is_empty());
}