keyhog 0.5.73

GPU-accelerated secret scanner for code, Git history, cloud, containers, browser assets, and live credential verification
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73

//! The automatic daemon route owns stdin before IPC. Its in-process retry must
//! use the same bounded payload, not attempt to read the consumed pipe again.
//! This drives the real CLI source factory with the replay field and checks the
//! exact source bytes, metadata, and lossy UTF-8 contract.

use clap::Parser;
use keyhog::args::ScanArgs;
use keyhog::testing::{CliTestApi, API};

#[test]
fn buffered_stdin_replay_uses_one_source_with_exact_lossy_decoding() {
    let mut args =
        ScanArgs::try_parse_from(["scan", "--stdin"]).expect("stdin scan arguments must parse");
    let bytes = b"prefix=ok\xff\nsecret=AKIAQYLPM5HFIQR7XYA\n".to_vec();
    API.set_buffered_stdin(&mut args, bytes);

    let sources = API
        .build_sources(&args, Vec::new(), None)
        .expect("buffered stdin source must build");
    assert_eq!(
        sources.len(),
        1,
        "stdin replay must not add a filesystem source"
    );
    let chunks = sources[0]
        .chunks()
        .collect::<Result<Vec<_>, _>>()
        .expect("buffered stdin must decode within the default limit");
    assert_eq!(chunks.len(), 1, "stdin is one logical source chunk");
    assert_eq!(chunks[0].metadata.source_type.as_ref(), "stdin");
    assert_eq!(chunks[0].metadata.path, None);
    assert_eq!(
        chunks[0].data.as_ref(),
        "prefix=ok\u{fffd}\nsecret=AKIAQYLPM5HFIQR7XYA\n",
        "replay must match the normal lossy UTF-8 stdin decoder exactly"
    );
}

/// WHY: a failed daemon request can replay the full bounded stdin body in
/// process; retaining one whole decoded copy would make peak memory scale at
/// twice the input size instead of one shared body plus one scan window.
#[test]
fn buffered_stdin_replay_emits_bounded_overlapping_windows() {
    const WINDOW: usize = 1024 * 1024;
    const OVERLAP: usize = 128 * 1024;
    let mut args =
        ScanArgs::try_parse_from(["scan", "--stdin"]).expect("stdin scan arguments must parse");
    let mut bytes = vec![b'a'; WINDOW + 16];
    bytes[100] = b'\n';
    bytes[200] = b'\n';
    bytes[WINDOW - 10] = b'\n';
    API.set_buffered_stdin(&mut args, bytes.clone());

    let sources = API
        .build_sources(&args, Vec::new(), None)
        .expect("buffered stdin source must build");
    let chunks = sources[0]
        .chunks()
        .collect::<Result<Vec<_>, _>>()
        .expect("bounded buffered stdin must decode");

    assert_eq!(chunks.len(), 2);
    assert_eq!(chunks[0].data.len(), WINDOW);
    assert_eq!(chunks[0].metadata.base_offset, 0);
    assert_eq!(chunks[0].metadata.base_line, 0);
    assert_eq!(chunks[1].metadata.base_offset, WINDOW - OVERLAP);
    assert_eq!(chunks[1].metadata.base_line, 2);
    assert_eq!(
        chunks[1].data.as_bytes(),
        &bytes[WINDOW - OVERLAP..],
        "the retry window must preserve the exact overlap and trailing bytes"
    );
}