keyhog 0.5.73

GPU-accelerated secret scanner for code, Git history, cloud, containers, browser assets, and live credential verification
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113

use std::{path::PathBuf, process::Command};

fn binary() -> PathBuf {
    PathBuf::from(env!("CARGO_BIN_EXE_keyhog"))
}

#[test]
fn malformed_har_parse_fallback_is_visible_to_operator() {
    let dir = tempfile::tempdir().expect("tempdir");
    let path = dir.path().join("broken.har");
    std::fs::write(
        &path,
        r#"{"log": {"entries": [{"request": {"method": "GET", "url": "https://example.test", "headers": [{"name": "X-Key", "value": "har-cli-raw-marker"}]"#,
    )
    .expect("write malformed HAR");

    let output = Command::new(binary())
        .args([
            "scan",
            "--backend",
            "simd",
            "--daemon=off",
            "--progress",
            "--format",
            "json",
        ])
        .arg(&path)
        .stdout(std::process::Stdio::piped())
        .stderr(std::process::Stdio::piped())
        .output()
        .expect("spawn keyhog");

    // A structured-source raw-text fallback is only PARTIAL coverage: the raw
    // text is scanned (inline values are caught) but the derived
    // request/response/body chunks are not expanded, so an encoded-body secret
    // could be missed. keyhog fails closed on incomplete source coverage, with
    // no findings it must NOT report "clean", it exits EXIT_SOURCE_FAILED (13).
    // The gap must still be surfaced to the operator / SARIF (asserted below);
    // fail-closed and gap-visibility are complementary, not alternatives.
    assert_eq!(
        output.status.code(),
        Some(13),
        "incomplete structured coverage must fail closed (EXIT_SOURCE_FAILED=13); status={:?} stderr={}",
        output.status.code(),
        String::from_utf8_lossy(&output.stderr)
    );

    let stderr = String::from_utf8_lossy(&output.stderr);
    assert!(
        stderr.contains("structured source file(s) only PARTIALLY scanned"),
        "operator-visible summary must name the structured-source coverage gap; stderr={stderr}"
    );
    assert!(
        stderr.contains("raw text was scanned")
            && stderr.contains("request/response/body chunks were not expanded"),
        "summary must distinguish recall-preserving raw text fallback from missing HAR expansion; stderr={stderr}"
    );
}

#[test]
fn malformed_har_parse_fallback_is_visible_in_sarif_notifications() {
    let dir = tempfile::tempdir().expect("tempdir");
    let path = dir.path().join("broken.har");
    std::fs::write(
        &path,
        r#"{"log": {"entries": [{"request": {"method": "GET", "url": "https://example.test", "headers": [{"name": "X-Key", "value": "har-cli-raw-marker"}]"#,
    )
    .expect("write malformed HAR");

    let output = Command::new(binary())
        .args([
            "scan",
            "--backend",
            "simd",
            "--daemon=off",
            "--format",
            "sarif",
        ])
        .arg(&path)
        .stdout(std::process::Stdio::piped())
        .stderr(std::process::Stdio::piped())
        .output()
        .expect("spawn keyhog");

    // A structured-source raw-text fallback is only PARTIAL coverage: the raw
    // text is scanned (inline values are caught) but the derived
    // request/response/body chunks are not expanded, so an encoded-body secret
    // could be missed. keyhog fails closed on incomplete source coverage, with
    // no findings it must NOT report "clean", it exits EXIT_SOURCE_FAILED (13).
    // The gap must still be surfaced to the operator / SARIF (asserted below);
    // fail-closed and gap-visibility are complementary, not alternatives.
    assert_eq!(
        output.status.code(),
        Some(13),
        "incomplete structured coverage must fail closed (EXIT_SOURCE_FAILED=13); status={:?} stderr={}",
        output.status.code(),
        String::from_utf8_lossy(&output.stderr)
    );

    let sarif: serde_json::Value =
        serde_json::from_slice(&output.stdout).expect("SARIF stdout must be JSON");
    let notifications = sarif["runs"][0]["invocations"][0]["toolExecutionNotifications"]
        .as_array()
        .expect("structured-source coverage gap must create SARIF notifications");
    assert!(
        notifications.iter().any(|notification| {
            notification["properties"]["reason"].as_str()
                == Some("structured source parse failed (raw text scanned; derived chunks not expanded)")
                && notification["properties"]["count"].as_u64() == Some(1)
        }),
        "SARIF notifications must include the structured-source parse gap; sarif={sarif}"
    );
}