plzplz 0.0.19

A simple cross-platform task runner with helpful defaults
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67

use super::{CheckResult, FileEntry, Finding, file_is_ignored, line_bytes_ignored};
use anyhow::Result;
use std::path::Path;

pub const NAME: &str = "private-key";

const PRIVATE_KEY_MARKERS: &[&[u8]] = &[
    b"BEGIN RSA PRIVATE KEY",            // plz:ignore private-key
    b"BEGIN DSA PRIVATE KEY",            // plz:ignore private-key
    b"BEGIN EC PRIVATE KEY",             // plz:ignore private-key
    b"BEGIN OPENSSH PRIVATE KEY",        // plz:ignore private-key
    b"BEGIN PRIVATE KEY",                // plz:ignore private-key
    b"BEGIN ENCRYPTED PRIVATE KEY",      // plz:ignore private-key
    b"BEGIN SSH2 ENCRYPTED PRIVATE KEY", // plz:ignore private-key
    b"BEGIN PGP PRIVATE KEY BLOCK",      // plz:ignore private-key
    b"BEGIN OpenVPN Static key V1",      // plz:ignore private-key
    b"PuTTY-User-Key-File-2",            // plz:ignore private-key
];

pub fn run(base_dir: &Path, files: &[FileEntry]) -> Result<CheckResult> {
    let mut findings = Vec::new();

    for file in files {
        if file.is_binary {
            continue;
        }
        let path = base_dir.join(&file.path);
        if !path.is_file() {
            continue;
        }
        let Ok(content) = std::fs::read(&path) else {
            continue;
        };
        if file_is_ignored(&content, NAME) {
            continue;
        }
        for (line_num, line) in content.split(|&b| b == b'\n').enumerate() {
            if line_bytes_ignored(line, NAME) {
                continue;
            }
            if PRIVATE_KEY_MARKERS
                .iter()
                .any(|m| memchr_find(line, m).is_some())
            {
                findings.push(Finding {
                    file: file.path.clone(),
                    detail: format!("line {}", line_num + 1),
                });
                break;
            }
        }
    }

    Ok(CheckResult {
        name: NAME,
        description: "Detect private keys",
        passed: findings.is_empty(),
        findings,
    })
}

fn memchr_find(haystack: &[u8], needle: &[u8]) -> Option<usize> {
    if needle.is_empty() || needle.len() > haystack.len() {
        return None;
    }
    haystack.windows(needle.len()).position(|w| w == needle)
}