keyhog 0.5.40

keyhog: detects leaked credentials in source trees, git history, and cloud storage
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43

//! E2E: JSON findings carry required contract fields.

use crate::e2e::support::scan_text_file;

#[test]
fn scan_json_required_fields() {
    let (stdout, _, _) = scan_text_file(
        // Checksum-valid GitHub classic PAT (trailing 6 = base62 CRC32 of the
        // leading 30): a fabricated `ghp_` is now dropped, so the planted token
        // must validate to surface as the single expected finding.
        "GH_TOKEN = \"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\"\n",
        &[],
    );
    let arr = serde_json::from_str::<serde_json::Value>(&stdout)
        .expect("json")
        .as_array()
        .expect("array")
        .clone();
    assert_eq!(
        arr.len(),
        1,
        "exactly one finding for the planted ghp_ token"
    );
    // Truth: identity of the single finding, not just that fields exist.
    let only = &arr[0];
    assert_eq!(only["detector_id"], "github-classic-pat");
    assert_eq!(only["service"], "github");
    assert_eq!(only["severity"], "critical");
    assert_eq!(only["credential_redacted"], "ghp_...K7n2");
    assert_eq!(only["location"]["line"], 1);
    for f in &arr {
        for field in [
            "detector_id",
            "detector_name",
            "service",
            "severity",
            "credential_redacted",
            "location",
        ] {
            assert!(f.get(field).is_some(), "missing {field}: {f}");
        }
    }
}