keyhog 0.5.73

GPU-accelerated secret scanner for code, Git history, cloud, containers, browser assets, and live credential verification
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48

use super::{finding_digest, FindingIdentity};

fn identity() -> FindingIdentity {
    FindingIdentity {
        detector_id: "aws-access-key".to_string(),
        file_path: Some("data/repo/source.rs#record-7".to_string()),
        line: Some(42),
        span_start: 1_024,
        span_end: 1_044,
        credential_sha256: "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
            .to_string(),
    }
}

#[test]
fn finding_digest_binds_detector_file_line_span_and_credential_digest() {
    let original = identity();
    let expected = finding_digest(std::slice::from_ref(&original));

    let mut variants = Vec::new();
    let mut changed = original.clone();
    changed.detector_id = "github-pat".to_string();
    variants.push(changed);
    let mut changed = original.clone();
    changed.file_path = Some("data/repo/other.rs#record-7".to_string());
    variants.push(changed);
    let mut changed = original.clone();
    changed.line = Some(43);
    variants.push(changed);
    let mut changed = original.clone();
    changed.span_start += 1;
    variants.push(changed);
    let mut changed = original.clone();
    changed.span_end += 1;
    variants.push(changed);
    let mut changed = original;
    changed.credential_sha256 =
        "bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb".to_string();
    variants.push(changed);

    for variant in variants {
        assert_ne!(
            finding_digest(&[variant]),
            expected,
            "every required finding identity field must affect the digest"
        );
    }
}