Skip to content

Commit ef3e72c

Browse files
authored
Merge pull request #328 from mongodb/development
2 parents d00a5dc + 1628dac commit ef3e72c

138 files changed

Lines changed: 8784 additions & 2450 deletions

File tree

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

.github/workflows/docs.yml

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -27,7 +27,7 @@ jobs:
2727

2828
- uses: astral-sh/setup-uv@cec208311dfd045dd5311c1add060b2062131d57 # v8.0.0
2929

30-
- uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0
30+
- uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
3131
with:
3232
python-version: '3.12'
3333

@@ -46,7 +46,7 @@ jobs:
4646
CI: true
4747

4848
- name: Upload artifact
49-
uses: actions/upload-pages-artifact@56afc609e74202658d3ffba0e8f6dda462b719fa # v3.0.1
49+
uses: actions/upload-pages-artifact@7b1f4a764d45c48632c6b24a0339c27f5614fb0b # v4.0.0
5050
with:
5151
path: docs-site/site
5252

@@ -59,4 +59,4 @@ jobs:
5959
steps:
6060
- name: Deploy to GitHub Pages
6161
id: deployment
62-
uses: actions/deploy-pages@d6db90164ac5ed86f2b6aed7e0febac5b3c0c03e # v4.0.5
62+
uses: actions/deploy-pages@cd2ce8fcbc39b97be8ca5fce6e763baed58fa128 # v5.0.0

.github/workflows/release.yml

Lines changed: 3 additions & 23 deletions
Original file line numberDiff line numberDiff line change
@@ -411,36 +411,16 @@ jobs:
411411
412412
provenance:
413413
name: Generate SLSA provenance
414-
needs: [hash]
414+
needs: [hash, release]
415415
permissions:
416416
actions: read
417417
id-token: write
418418
contents: write
419419
uses: slsa-framework/slsa-github-generator/.github/workflows/generator_generic_slsa3.yml@f7dd8c54c2067bafc12ca7a55595d5ee9b75204a # v2.1.0
420420
with:
421421
base64-subjects: "${{ needs.hash.outputs.hashes }}"
422-
upload-assets: false
423-
424-
upload-provenance:
425-
name: Upload provenance to release
426-
needs: [provenance, release]
427-
runs-on: ubuntu-latest
428-
permissions:
429-
contents: write
430-
steps:
431-
- name: Download provenance artifact
432-
uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
433-
with:
434-
name: ${{ needs.provenance.outputs.provenance-name }}
435-
- name: Upload to release
436-
env:
437-
GH_TOKEN: ${{ github.token }}
438-
TAG: ${{ needs.release.outputs.tag }}
439-
PROVENANCE_FILE: ${{ needs.provenance.outputs.provenance-name }}
440-
run: |
441-
gh release upload "${TAG}" "${PROVENANCE_FILE}" \
442-
--repo "${{ github.repository }}" \
443-
--clobber
422+
upload-assets: true
423+
upload-tag-name: "${{ needs.release.outputs.tag }}"
444424

445425
# ──────────────── Publish Docker image ────────────────
446426
publish-docker:

.gitignore

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -7,6 +7,8 @@
77
*.json
88
!webserver/static/sample-report.json
99
!docs/access-map-viewer/sample-report.json
10+
!testdata/parsers/context_verifier_golden.json
11+
!testdata/parsers/scan_findings_baseline.json
1012
!testdata/parsers/tree_sitter_capture_baseline.json
1113
*.jsonl
1214
*.bson
@@ -17,7 +19,10 @@ logs/*
1719
*.orig
1820
*.rej
1921
*.html
22+
!testdata/html_vulnerable.html
23+
!testdata/html_embedded_vulnerable.html
2024
!docs/access-map-viewer/index.html
25+
!docs-site/overrides/*.html
2126
*.dot
2227
fuzz/*
2328
!fuzz/Cargo.toml

AGENTS.md

Lines changed: 10 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -22,16 +22,16 @@ Key capabilities:
2222
## Repository Structure
2323
- `src/`: main binary source
2424
- `src/cli/commands/`: CLI command implementations
25-
- `src/validation/`: provider-specific credential validators
2625
- `src/matcher/`: pattern matching engine
2726
- `src/scanner/`: core scanning logic
28-
- `src/parser/`: language-aware parsing (`tree-sitter`)
27+
- `src/parser/`: language-aware context verification (lightweight lexers, `tl` for HTML, `cssparser` for CSS)
2928
- `src/reporter/`: TOON/JSON/SARIF/HTML report generation
3029
- `src/access_map/`: access mapping analysis
3130
- `crates/kingfisher-core/`: shared types and core logic
3231
- `crates/kingfisher-rules/`: rule loading and rule data
3332
- `crates/kingfisher-rules/data/rules/`: YAML detection rules
3433
- `crates/kingfisher-scanner/`: embeddable high-level scanning API
34+
- `crates/kingfisher-scanner/src/validation/`: shared typed and raw credential validators
3535
- `tests/`: integration/e2e tests
3636
- `testdata/`: test fixtures
3737
- `docs/`: user and developer docs
@@ -81,18 +81,21 @@ Key capabilities:
8181
- `use-mimalloc` (default)
8282
- `use-jemalloc`
8383
- `system-alloc`
84-
- Validation modules live in `crates/kingfisher-scanner/src/validation/`; optional validation feature sets are defined in `crates/kingfisher-scanner/Cargo.toml` (e.g., `validation-aws`, `validation-gcp`, `validation-database`, `validation-all`).
84+
- Validation modules live in `crates/kingfisher-scanner/src/validation/`; optional validation feature sets are defined in `crates/kingfisher-scanner/Cargo.toml` (e.g., `validation-raw`, `validation-aws`, `validation-gcp`, `validation-database`, `validation-all`).
8585

8686
## Validation and Revocation Policy
87-
- Default rule: define validation logic in rule YAML (`validation:` block), not Rust code.
88-
- Code-based validation in `crates/kingfisher-scanner/src/validation/` is an exception path for cases that cannot be expressed reliably in YAML alone (for example AWS, GCP, Coinbase, MongoDB, and similar complex/provider-specific flows).
87+
- Default rule: define validation logic in rule YAML (`validation:` block), especially `Http` or `Grpc`, not Rust code.
88+
- Typed validators are first-class schema variants (`AWS`, `AzureStorage`, `Coinbase`, `GCP`, `MongoDB`, `MySQL`, `Postgres`, `Jdbc`, `JWT`) for stable, reusable validation families.
89+
- Raw validators use `validation: { type: Raw, content: <name> }` and are the ad-hoc exception path for provider-specific or protocol-specific validation that cannot be expressed reliably in YAML alone. Implement them in `crates/kingfisher-scanner/src/validation/raw.rs`.
8990
- Treat Rust validation additions as rare; prefer extending YAML-based validation first.
91+
- If a Rust exception path is required, prefer adding a raw validator before introducing a new typed validator. Add a new typed validator only when it represents a reusable schema-level validation family.
92+
- Do not convert existing typed validators to `Raw` just for consistency.
9093
- For rules that include validation, add a `revocation:` section whenever the third-party API safely supports revocation.
9194

9295
## Common Development Tasks
9396
- Add a detection rule: follow the workflow below and validate with relevant tests.
9497
- Add a CLI command: implement under `src/cli/commands/` and register in the CLI command wiring.
95-
- Add a validator (rare exception path): implement in `crates/kingfisher-scanner/src/validation/` and wire feature flags/dependencies in `crates/kingfisher-scanner/Cargo.toml` only when YAML validation cannot express the required logic.
98+
- Add a validator (rare exception path): implement it in `crates/kingfisher-scanner/src/validation/`, prefer `raw.rs` for one-off provider flows, and wire the narrowest feature/dependencies in `crates/kingfisher-scanner/Cargo.toml` only when YAML validation cannot express the required logic.
9699

97100
## Rule Authoring Workflow
98101
Use this when creating or updating rules in `crates/kingfisher-rules/data/rules/`.
@@ -105,7 +108,7 @@ Use this when creating or updating rules in `crates/kingfisher-rules/data/rules/
105108
- `pattern_requirements` (e.g., `min_digits`, `min_uppercase`, `min_lowercase`, `min_special_chars`, `ignore_if_contains`) when format constraints are known.
106109
- `pattern_requirements.checksum` when provider formats include check digits/signatures.
107110
5. Add `validation` only when a reliable provider/API check exists.
108-
6. Put validation in YAML by default; only use Rust validator logic for rare, justified exceptions.
111+
6. Put validation in YAML by default. If YAML cannot express the check, use an existing typed validator or `type: Raw` exception path; add new Rust validator logic only for rare, justified cases.
109112
7. Add `revocation` when the provider API supports safe revocation and the flow is well understood.
110113
8. If a rule needs context from another match (for example ID + secret pair), use `depends_on_rule` and consider `visible: false` on the helper rule.
111114
9. Verify locally:

CHANGELOG.md

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -2,6 +2,12 @@
22

33
All notable changes to this project will be documented in this file.
44

5+
## [v1.95.0]
6+
- Added 80+ built-in rules, bringing the bundled ruleset to 820 total. New coverage includes Amazon OAuth, Asaas, multiple Azure credential families, Bitrise, Canva, CockroachDB, eBay, Elastic, hCaptcha, Highnote, Lichess, MailerSend, Onfido, Paddle, Pangea, Persona, Pinterest, Proof, Rootly, Runpod, Telnyx, Thunderstore, Valtown, Volcengine, and more.
7+
- Replaced tree-sitter with a lighter parser-based context verifier built from handwritten lexers plus `tl`/`cssparser`, preserving context-dependent matching while cutting about 19 MB from the release binary.
8+
- Added a `validation: type: Raw` exception path for provider-specific checks, with new raw validators for Azure Batch, FTP, Kraken, LDAP, RabbitMQ, and Redis. Also added stable request-scoped template values plus new Liquid filters for HMAC-SHA384 hex output and timestamp generation.
9+
- Expanded live validation coverage for several built-in rules, including Agora, Bitfinex, DocuSign, Dwolla, GitLab, KuCoin, RingCentral, Snowflake, Tableau, Trello, and Webex. Also tightened newly added helper regex to avoid high-match scan regressions, and made preflight-blocked raw validations report as skipped/not attempted instead of failed.
10+
511
## [v1.94.0]
612
- Updated vendored `vectorscan-rs` from v0.0.5 (Vectorscan 5.4.11) to v0.0.6 (Vectorscan 5.4.12). The upstream crate now ships pre-extracted sources instead of a tarball+patch, and fixes the `cpu_native` feature flag. Local Windows and musl build patches have been re-applied.
713
- Added more built-in rules

0 commit comments

Comments
 (0)