1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
|
package detector
import (
"strings"
"testing"
)
const (
awsKey = "AKIAIOSFODNN7EXAMPLE"
awsKey2 = "AKIAI44QH8DHBEXAMPLE"
)
func TestScannerSingleSecret(t *testing.T) {
s := NewScanner(nil)
anon, findings := s.Scan("key=" + awsKey)
if !strings.Contains(anon, "[SECRET_1]") {
t.Errorf("expected [SECRET_1] in %q", anon)
}
if strings.Contains(anon, awsKey) {
t.Errorf("secret should be redacted in %q", anon)
}
if len(findings) == 0 {
t.Fatal("expected at least one finding")
}
}
func TestScannerNoMatch(t *testing.T) {
s := NewScanner(nil)
text := "Kein Secret hier."
anon, findings := s.Scan(text)
if anon != text {
t.Errorf("text should be unchanged, got %q", anon)
}
if len(findings) != 0 {
t.Errorf("expected no findings, got %d", len(findings))
}
}
func TestScannerDeduplication(t *testing.T) {
s := NewScanner(nil)
// Same AWS key twice → same placeholder both times
text := awsKey + " and " + awsKey
anon, findings := s.Scan(text)
count := strings.Count(anon, "[SECRET_1]")
if count != 2 {
t.Errorf("expected [SECRET_1] twice, got %d times in %q", count, anon)
}
seen := map[string]bool{}
for _, f := range findings {
seen[f.Placeholder] = true
}
if len(seen) != 1 {
t.Errorf("expected 1 unique placeholder, got %d: %v", len(seen), findings)
}
}
func TestScannerFindingsSortedByStart(t *testing.T) {
s := NewScanner(nil)
_, findings := s.Scan(awsKey + " later " + awsKey2)
for i := 1; i < len(findings); i++ {
if findings[i].Start < findings[i-1].Start {
t.Errorf("findings not sorted: [%d].Start=%d < [%d].Start=%d",
i, findings[i].Start, i-1, findings[i-1].Start)
}
}
}
func TestScannerRestoreRoundtrip(t *testing.T) {
s := NewScanner(nil)
text := "Use key=" + awsKey + " to authenticate."
anon, findings := s.Scan(text)
restore := map[string]string{}
for _, f := range findings {
restore[f.Placeholder] = f.Text
}
restored := anon
for ph, orig := range restore {
restored = strings.ReplaceAll(restored, ph, orig)
}
if restored != text {
t.Errorf("roundtrip failed:\n got %q\n want %q", restored, text)
}
}
func TestScannerSelectiveDetectors(t *testing.T) {
// Only enable SECRET — second key should also be redacted
s := NewScanner([]string{"SECRET"})
text := awsKey + " and " + awsKey2
anon, findings := s.Scan(text)
if !strings.Contains(anon, "[SECRET_1]") {
t.Errorf("expected [SECRET_1] in %q", anon)
}
for _, f := range findings {
if f.Type != PiiSecret {
t.Errorf("expected only SECRET findings, got %v", f.Type)
}
}
}
func TestScannerPlaceholderFormat(t *testing.T) {
s := NewScanner(nil)
_, findings := s.Scan("key=" + awsKey)
if len(findings) == 0 {
t.Fatal("expected a finding")
}
f := findings[0]
if f.Placeholder != "[SECRET_1]" {
t.Errorf("placeholder = %q, want [SECRET_1]", f.Placeholder)
}
if f.Type != PiiSecret {
t.Errorf("type = %v, want SECRET", f.Type)
}
}
func TestScannerSecretDetected(t *testing.T) {
s := NewScanner(nil)
anon, findings := s.Scan("key=" + awsKey)
if !strings.Contains(anon, "[SECRET_1]") {
t.Errorf("expected [SECRET_1] in %q", anon)
}
if len(findings) == 0 {
t.Fatal("expected at least one finding")
}
if findings[0].Type != PiiSecret {
t.Errorf("type = %v, want SECRET", findings[0].Type)
}
}
func TestScannerWhitelistSkipsMatch(t *testing.T) {
s := NewScanner(nil)
text := awsKey + " and " + awsKey2
anon, findings := s.ScanWithWhitelist(text, []string{awsKey})
if strings.Contains(anon, awsKey2) {
t.Fatalf("non-whitelisted key must be masked: %q", anon)
}
if !strings.Contains(anon, awsKey) {
t.Fatalf("whitelisted key must remain: %q", anon)
}
if len(findings) != 1 {
t.Fatalf("expected 1 finding, got %d: %+v", len(findings), findings)
}
}
func TestScannerCountersPerType(t *testing.T) {
s := NewScanner(nil)
// Two different AWS keys → SECRET_1 and SECRET_2
anon, _ := s.Scan(awsKey + " and " + awsKey2)
if !strings.Contains(anon, "[SECRET_1]") {
t.Errorf("expected [SECRET_1] in %q", anon)
}
if !strings.Contains(anon, "[SECRET_2]") {
t.Errorf("expected [SECRET_2] in %q", anon)
}
}
func TestOverlapPriorityResolution(t *testing.T) {
// Two overlapping findings: longer match wins at equal priority.
short := Finding{Type: PiiSecret, Start: 0, End: 30, Confidence: 0.9}
long := Finding{Type: PiiSecret, Start: 10, End: 70, Confidence: 1.0}
result := resolveOverlaps([]Finding{short, long})
if len(result) != 1 {
t.Fatalf("expected 1 finding after resolution, got %d: %v", len(result), result)
}
}
|