keyhog 0.5.73

GPU-accelerated secret scanner for code, Git history, cloud, containers, browser assets, and live credential verification
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133

use keyhog::testing::{CliTestApi as _, API};
use keyhog_core::{Chunk, ChunkMetadata, MatchLocation, RawMatch, SensitiveString, Severity};
use std::collections::HashMap;
use std::sync::Arc;

fn test_hash() -> [u8; 32] {
    [9u8; 32]
}

fn filesystem_chunk(path: &std::path::Path, data: &str) -> Chunk {
    filesystem_chunk_at(path, data, 0)
}

fn filesystem_chunk_at(path: &std::path::Path, data: &str, base_offset: usize) -> Chunk {
    Chunk {
        data: SensitiveString::from(data),
        metadata: ChunkMetadata {
            source_type: "filesystem".into(),
            path: Some(path.to_string_lossy().into_owned().into()),
            base_offset,
            ..Default::default()
        },
    }
}

fn raw_match(path: &std::path::Path, data: &str) -> RawMatch {
    raw_match_at(
        path,
        "secret",
        data.find("secret").expect("fixture contains credential"),
        Some(2),
    )
}

fn raw_match_at(
    path: &std::path::Path,
    credential: &str,
    offset: usize,
    line: Option<usize>,
) -> RawMatch {
    RawMatch {
        detector_id: Arc::from("demo"),
        detector_name: Arc::from("Demo"),
        service: Arc::from("demo"),
        severity: Severity::Low,
        credential: SensitiveString::from(credential),
        credential_hash: test_hash().into(),
        companions: HashMap::new(),
        location: MatchLocation {
            source: Arc::from("filesystem"),
            file_path: Some(Arc::from(path.to_string_lossy().as_ref())),
            line,
            offset,
            commit: None,
            author: None,
            date: None,
        },
        entropy: None,
        confidence: None,
    }
}

#[test]
fn inline_suppression_uses_scanned_bytes_when_file_mutates_after_scan() {
    let dir = tempfile::tempdir().unwrap();
    let path = dir.path().join("with_ignore.rs");
    let scanned = "// keyhog:ignore\nlet token = \"secret\";\n";
    std::fs::write(&path, scanned).unwrap();

    let chunk = filesystem_chunk(&path, scanned);
    let mut matches = vec![raw_match(&path, scanned)];
    API.attach_inline_suppression_context_for_test(&chunk, &mut matches);

    std::fs::write(&path, "let token = \"secret\";\n").unwrap();

    let kept = API.filter_inline_suppressions(matches);
    assert!(
        kept.is_empty(),
        "inline suppression must use the bytes that produced the finding, not a later disk read"
    );
}

#[test]
fn inline_context_is_stripped_from_unsuppressed_findings() {
    let dir = tempfile::tempdir().unwrap();
    let path = dir.path().join("without_ignore.rs");
    let scanned = "let marker = 1;\nlet token = \"secret\";\n";
    std::fs::write(&path, scanned).unwrap();

    let chunk = filesystem_chunk(&path, scanned);
    let mut matches = vec![raw_match(&path, scanned)];
    API.attach_inline_suppression_context_for_test(&chunk, &mut matches);

    let kept = API.filter_inline_suppressions(matches);
    assert_eq!(kept.len(), 1);
    assert!(
        kept[0]
            .companions
            .keys()
            .all(|key| !key.starts_with("__keyhog_internal_inline_")),
        "internal inline-suppression context must not leak into reports"
    );
}

#[test]
fn inline_suppression_context_resolves_boundary_match_owner_chunk() {
    let dir = tempfile::tempdir().unwrap();
    let path = dir.path().join("boundary.rs");
    let chunk_a_text = "// keyhog:ignore\nSTRADDLE_SE";
    let chunk_b_text = "CRET\n";
    let scanned = format!("{chunk_a_text}{chunk_b_text}");
    std::fs::write(&path, &scanned).unwrap();

    let chunks = vec![
        filesystem_chunk_at(&path, chunk_a_text, 0),
        filesystem_chunk_at(&path, chunk_b_text, chunk_a_text.len()),
    ];
    let boundary_offset = chunk_a_text
        .find("STRADDLE")
        .expect("fixture contains boundary credential start");
    let boundary_match = raw_match_at(&path, "STRADDLE_SECRET", boundary_offset, Some(2));
    let mut per_chunk = vec![Vec::new(), vec![boundary_match]];

    API.attach_inline_suppression_context_for_chunks_for_test(&chunks, &mut per_chunk);
    std::fs::write(&path, "STRADDLE_SECRET\n").unwrap();

    let matches = per_chunk.into_iter().flatten().collect();
    let kept = API.filter_inline_suppressions(matches);
    assert!(
        kept.is_empty(),
        "boundary findings assigned to the right-hand bucket must still use the owner chunk bytes for inline suppression"
    );
}