keyhog 0.5.73

GPU-accelerated secret scanner for code, Git history, cloud, containers, browser assets, and live credential verification
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106

//! E2E: generic decode-through works on a plain file and reports source offsets.

use crate::e2e::support::{scan_path, scan_text_file, write_temp_file};

#[test]
fn scan_plain_file_base64_decodes_secret_at_encoded_source_offset() {
    const SECRET: &str = "AKIAQYLPMN5HFIQR7XYA";
    const ENCODED_ASSIGNMENT: &str = "QVdTX0FDQ0VTU19LRVlfSUQ9QUtJQVFZTFBNTjVIRklRUjdYWUE=";
    let text = format!("base64_payload = \"{ENCODED_ASSIGNMENT}\"\n");
    let encoded_start = text
        .find(ENCODED_ASSIGNMENT)
        .expect("fixture contains encoded assignment");
    let encoded_end = encoded_start + ENCODED_ASSIGNMENT.len();

    let (stdout, stderr, code) = scan_text_file(&text, &[]);
    assert_eq!(
        code,
        Some(1),
        "plain base64 file must surface the decoded AWS key; stderr={stderr}; stdout={stdout}"
    );

    let findings = serde_json::from_str::<serde_json::Value>(&stdout)
        .expect("json")
        .as_array()
        .expect("array")
        .clone();
    // `core::redact` shows `<first edge>...<last edge>` where edge =
    // (len/8).clamp(1,4); this 20-char key redacts to `AK...YA`. Match the
    // exact redaction so the finding is unambiguously the planted SECRET.
    let edge = (SECRET.len() / 8).clamp(1, 4);
    let expected_redacted = format!("{}...{}", &SECRET[..edge], &SECRET[SECRET.len() - edge..]);
    let aws = findings
        .iter()
        .find(|finding| {
            finding["detector_id"] == "aws-access-key"
                && finding["credential_redacted"].as_str() == Some(expected_redacted.as_str())
        })
        .unwrap_or_else(|| panic!("missing decoded AWS key finding; findings={findings:#?}"));

    assert_eq!(aws["location"]["line"], 1);
    let offset = aws["location"]["offset"]
        .as_u64()
        .expect("location.offset must be numeric") as usize;
    assert!(
        offset < text.len(),
        "decoded finding offset {offset} must be inside the {}-byte source file",
        text.len()
    );
    assert!(
        (encoded_start..encoded_end).contains(&offset),
        "decoded finding offset {offset} must point inside the encoded base64 run \
         {encoded_start}..{encoded_end} in the source file"
    );
}

#[test]
fn scan_k8s_secret_base64_decodes_secret_at_encoded_source_offset() {
    const ENCODED_ASSIGNMENT: &str = "QVdTX0FDQ0VTU19LRVlfSUQ9QUtJQVFZTFBNTjVIRklRUjdYWUE=";
    let text = format!(
        "apiVersion: v1\n\
         kind: Secret\n\
         metadata:\n\
         \x20\x20name: aws-creds\n\
         data:\n\
         \x20\x20aws_credentials: {ENCODED_ASSIGNMENT}\n"
    );
    let encoded_start = text
        .find(ENCODED_ASSIGNMENT)
        .expect("fixture contains encoded assignment");
    let encoded_end = encoded_start + ENCODED_ASSIGNMENT.len();
    let (_dir, path) = write_temp_file("k8s-secret.yaml", &text);

    let output = scan_path(&path, &[]);
    let stdout = String::from_utf8_lossy(&output.stdout);
    let stderr = String::from_utf8_lossy(&output.stderr);
    assert_eq!(
        output.status.code(),
        Some(1),
        "k8s Secret base64 data must surface the decoded AWS key; stderr={stderr}; stdout={stdout}"
    );

    let findings = serde_json::from_str::<serde_json::Value>(&stdout)
        .expect("json")
        .as_array()
        .expect("array")
        .clone();
    let aws = findings
        .iter()
        .find(|finding| finding["detector_id"] == "aws-access-key")
        .unwrap_or_else(|| panic!("missing decoded AWS key finding; findings={findings:#?}"));

    assert_eq!(aws["location"]["line"], 6);
    let offset = aws["location"]["offset"]
        .as_u64()
        .expect("location.offset must be numeric") as usize;
    assert!(
        offset < text.len(),
        "decoded k8s finding offset {offset} must be inside the {}-byte source file",
        text.len()
    );
    assert!(
        (encoded_start..encoded_end).contains(&offset),
        "decoded k8s finding offset {offset} must point inside the encoded base64 run \
         {encoded_start}..{encoded_end} in the source file"
    );
}