flareguard 0.1.0

package/src/secrets/env_parser.rs

@@ -0,0 +1,464 @@
+use crate::secrets::rules::types::{Rule, Severity};
+use std::collections::HashSet;
+use std::fs;
+use std::path::{Path, PathBuf};
+
+/// Known non-secret variable keys to ignore when scanning.
+const BENIGN_KEYS: &[&str] = &[
+    "port",
+    "host",
+    "hostname",
+    "node_env",
+    "env",
+    "environment",
+    "app_env",
+    "stage",
+    "debug",
+    "log_level",
+    "tz",
+    "lang",
+    "app_name",
+    "title",
+    "version",
+];
+
+/// Known non-secret string values to ignore when scanning for leaked environment variables.
+const BENIGN_VALUES: &[&str] = &[
+    "true",
+    "false",
+    "null",
+    "undefined",
+    "none",
+    "0",
+    "1",
+    "true\n",
+    "false\n",
+    "development",
+    "production",
+    "staging",
+    "test",
+    "local",
+    "dev",
+    "prod",
+    "localhost",
+    "127.0.0.1",
+    "0.0.0.0",
+    "::1",
+    "http://localhost",
+    "https://localhost",
+    "http://127.0.0.1",
+    "https://127.0.0.1",
+    "http://localhost:8787",
+    "http://localhost:3000",
+    "http://localhost:5173",
+    "http://localhost:4321",
+    "public",
+    "index.html",
+    "utf-8",
+    "application/json",
+    "text/html",
+    "text/plain",
+    "GET",
+    "POST",
+    "PUT",
+    "DELETE",
+    "info",
+    "warn",
+    "warning",
+    "error",
+    "trace",
+    "verbose",
+];
+
+/// Represents an extracted environment variable key-value pair.
+#[derive(Debug, Clone, PartialEq, Eq)]
+pub struct EnvSecret {
+    pub key: String,
+    pub value: String,
+    pub source_file: PathBuf,
+}
+
+/// Parses an env-style file (`.env`, `.dev.vars`) into key-value pairs.
+pub fn parse_env_file(path: &Path) -> Result<Vec<EnvSecret>, std::io::Error> {
+    let content = fs::read_to_string(path)?;
+    let mut secrets = Vec::new();
+
+    for line in content.lines() {
+        let trimmed = line.trim();
+        // Skip comments and empty lines
+        if trimmed.is_empty() || trimmed.starts_with('#') {
+            continue;
+        }
+
+        if let Some((k, v)) = trimmed.split_once('=') {
+            let key = k.trim().to_string();
+            let mut val = v.trim().to_string();
+
+            // Strip enclosing quotes if present
+            if ((val.starts_with('"') && val.ends_with('"'))
+                || (val.starts_with('\'') && val.ends_with('\'')))
+                && val.len() >= 2
+            {
+                val = val[1..val.len() - 1].to_string();
+            }
+
+            // Skip invalid or placeholder values
+            if is_secret_candidate(&key, &val) {
+                secrets.push(EnvSecret {
+                    key,
+                    value: val,
+                    source_file: path.to_path_buf(),
+                });
+            }
+        }
+    }
+
+    Ok(secrets)
+}
+
+/// Parses wrangler configuration files (`wrangler.json`, `wrangler.jsonc`, `wrangler.toml`)
+pub fn parse_wrangler_file(path: &Path) -> Result<Vec<EnvSecret>, std::io::Error> {
+    let content = fs::read_to_string(path)?;
+    let mut secrets = Vec::new();
+
+    let ext = path.extension().and_then(|e| e.to_str()).unwrap_or("");
+    if ext == "toml" {
+        // Simple TOML [vars] block extractor
+        let mut in_vars = false;
+        for line in content.lines() {
+            let trimmed = line.trim();
+            if trimmed.starts_with('[') {
+                in_vars = trimmed == "[vars]"
+                    || trimmed.starts_with("[env.") && trimmed.ends_with(".vars]");
+                continue;
+            }
+
+            if in_vars
+                && !trimmed.is_empty()
+                && !trimmed.starts_with('#')
+                && let Some((k, v)) = trimmed.split_once('=')
+            {
+                let key = k.trim().to_string();
+                let mut val = v.trim().to_string();
+                if ((val.starts_with('"') && val.ends_with('"'))
+                    || (val.starts_with('\'') && val.ends_with('\'')))
+                    && val.len() >= 2
+                {
+                    val = val[1..val.len() - 1].to_string();
+                }
+                if is_secret_candidate(&key, &val) {
+                    secrets.push(EnvSecret {
+                        key,
+                        value: val,
+                        source_file: path.to_path_buf(),
+                    });
+                }
+            }
+        }
+    } else {
+        // JSON or JSONC: strip comments if JSONC then parse
+        let cleaned = strip_jsonc_comments(&content);
+        if let Ok(val) = serde_json::from_str::<serde_json::Value>(&cleaned) {
+            extract_secrets_from_json(&val, path, &mut secrets);
+        }
+    }
+
+    Ok(secrets)
+}
+
+fn strip_jsonc_comments(jsonc: &str) -> String {
+    let mut result = String::with_capacity(jsonc.len());
+    let mut in_string = false;
+    let mut chars = jsonc.chars().peekable();
+
+    while let Some(c) = chars.next() {
+        if c == '"' && !in_string {
+            in_string = true;
+            result.push(c);
+        } else if c == '"' && in_string {
+            in_string = false;
+            result.push(c);
+        } else if in_string {
+            result.push(c);
+            if c == '\\'
+                && let Some(next) = chars.next()
+            {
+                result.push(next);
+            }
+        } else if c == '/' && chars.peek() == Some(&'/') {
+            // Line comment: skip until newline
+            for next in chars.by_ref() {
+                if next == '\n' {
+                    result.push('\n');
+                    break;
+                }
+            }
+        } else if c == '/' && chars.peek() == Some(&'*') {
+            // Block comment: skip until */
+            chars.next(); // consume '*'
+            let mut prev = ' ';
+            for next in chars.by_ref() {
+                if prev == '*' && next == '/' {
+                    break;
+                }
+                prev = next;
+            }
+        } else {
+            result.push(c);
+        }
+    }
+
+    result
+}
+
+fn extract_secrets_from_json(value: &serde_json::Value, path: &Path, secrets: &mut Vec<EnvSecret>) {
+    if let Some(obj) = value.as_object() {
+        // Look for vars block or top level
+        if let Some(vars) = obj.get("vars").and_then(|v| v.as_object()) {
+            for (k, v) in vars {
+                if let Some(s) = v.as_str()
+                    && is_secret_candidate(k, s)
+                {
+                    secrets.push(EnvSecret {
+                        key: k.clone(),
+                        value: s.to_string(),
+                        source_file: path.to_path_buf(),
+                    });
+                }
+            }
+        }
+
+        // Look for env.*.vars blocks
+        if let Some(env_obj) = obj.get("env").and_then(|e| e.as_object()) {
+            for (_env_name, env_val) in env_obj {
+                if let Some(vars) = env_val.get("vars").and_then(|v| v.as_object()) {
+                    for (k, v) in vars {
+                        if let Some(s) = v.as_str()
+                            && is_secret_candidate(k, s)
+                        {
+                            secrets.push(EnvSecret {
+                                key: k.clone(),
+                                value: s.to_string(),
+                                source_file: path.to_path_buf(),
+                            });
+                        }
+                    }
+                }
+            }
+        }
+    }
+}
+
+/// Decides whether a variable key/value should be monitored as a potential secret leak.
+pub fn is_secret_candidate(key: &str, value: &str) -> bool {
+    let trimmed_val = value.trim();
+    let lower_key = key.to_ascii_lowercase();
+
+    // Ignore known benign non-secret variable keys
+    if BENIGN_KEYS.contains(&lower_key.as_str()) {
+        return false;
+    }
+
+    // Ignore short values (< 4 chars) to prevent massive false positive substring matching
+    if trimmed_val.len() < 4 {
+        return false;
+    }
+
+    // Ignore purely numeric values (like ports, IDs, counts)
+    if trimmed_val.chars().all(|c| c.is_ascii_digit()) {
+        return false;
+    }
+
+    // Ignore placeholder templates like ${FOO} or $FOO
+    if (trimmed_val.starts_with("${") && trimmed_val.ends_with('}'))
+        || trimmed_val.starts_with('$')
+        || trimmed_val == "<secret>"
+        || trimmed_val == "CHANGE_ME"
+        || trimmed_val == "your-secret-here"
+    {
+        return false;
+    }
+
+    // Ignore known benign constants
+    let lower_val = trimmed_val.to_ascii_lowercase();
+    for &benign in BENIGN_VALUES {
+        if lower_val == benign {
+            return false;
+        }
+    }
+
+    // Keys explicitly indicating public variables are safe (e.g. PUBLIC_*, NEXT_PUBLIC_*, VITE_PUBLIC_*, ASTRO_PUBLIC_*)
+    if lower_key.starts_with("public_")
+        || lower_key.starts_with("next_public_")
+        || lower_key.starts_with("vite_public_")
+        || lower_key.starts_with("astro_public_")
+    {
+        return false;
+    }
+
+    true
+}
+
+/// Auto-discovers environment files in search directories and parent directory trees.
+pub fn discover_env_files(search_dirs: &[PathBuf]) -> Vec<PathBuf> {
+    let mut discovered = Vec::new();
+    let mut seen = HashSet::new();
+
+    let target_names = [
+        ".dev.vars",
+        ".env",
+        ".env.local",
+        ".env.production",
+        ".env.development",
+        "wrangler.jsonc",
+        "wrangler.json",
+        "wrangler.toml",
+    ];
+
+    let mut check_dirs = Vec::new();
+
+    // Include current working directory
+    if let Ok(cwd) = std::env::current_dir() {
+        check_dirs.push(cwd);
+    }
+
+    for dir in search_dirs {
+        let mut curr = if dir.is_file() {
+            dir.parent().unwrap_or(Path::new(".")).to_path_buf()
+        } else {
+            dir.to_path_buf()
+        };
+
+        // Walk up to 4 parent directory levels
+        for _ in 0..4 {
+            check_dirs.push(curr.clone());
+            if let Some(parent) = curr.parent() {
+                curr = parent.to_path_buf();
+            } else {
+                break;
+            }
+        }
+    }
+
+    for check_dir in check_dirs {
+        for name in &target_names {
+            let candidate = check_dir.join(name);
+            if candidate.is_file() {
+                let canonical = candidate.canonicalize().unwrap_or(candidate.clone());
+                if seen.insert(canonical) {
+                    discovered.push(candidate);
+                }
+            }
+        }
+    }
+
+    discovered
+}
+
+/// Converts a collection of `EnvSecret` into detection `Rule`s.
+pub fn env_secrets_to_rules(secrets: &[EnvSecret]) -> Vec<Rule> {
+    let mut rules = Vec::new();
+
+    for secret in secrets {
+        let rule = Rule::new_exact(
+            format!("ENV-{}", secret.key),
+            format!("Leaked Env Secret ({})", secret.key),
+            format!(
+                "Secret value for '{}' defined in {} was found in client build asset",
+                secret.key,
+                secret.source_file.display()
+            ),
+            Severity::Critical,
+            secret.value.clone(),
+            format!(
+                "Remove references to server variable '{}' from client-side code. Ensure environment variables accessed in client components are prefixed with PUBLIC_ or handled server-side.",
+                secret.key
+            ),
+        );
+        rules.push(rule);
+    }
+
+    rules
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use std::io::Write;
+    use tempfile::NamedTempFile;
+
+    #[test]
+    fn test_parse_env_file() {
+        let mut tmp = NamedTempFile::new().unwrap();
+        writeln!(
+            tmp,
+            r#"
+# Sample .dev.vars
+DATABASE_URL="postgres://postgres:secret123@db.example.com:5432/main"
+CLOUDFLARE_API_TOKEN=V48uXZ-e_92mKqT1pLwRtYuIoPsDfGhJkLxZc0vb
+PUBLIC_SITE_URL=https://mycoolsite.com
+IS_PROD=true
+PORT=8787
+"#
+        )
+        .unwrap();
+
+        let secrets = parse_env_file(tmp.path()).unwrap();
+        assert_eq!(secrets.len(), 2);
+
+        let keys: Vec<&str> = secrets.iter().map(|s| s.key.as_str()).collect();
+        assert!(keys.contains(&"DATABASE_URL"));
+        assert!(keys.contains(&"CLOUDFLARE_API_TOKEN"));
+        assert!(!keys.contains(&"PUBLIC_SITE_URL"));
+        assert!(!keys.contains(&"IS_PROD"));
+        assert!(!keys.contains(&"PORT"));
+    }
+
+    #[test]
+    fn test_parse_wrangler_jsonc() {
+        let mut tmp = tempfile::Builder::new()
+            .suffix(".jsonc")
+            .tempfile()
+            .unwrap();
+        writeln!(
+            tmp,
+            r#"
+{{
+  // Cloudflare Worker configuration
+  "name": "my-worker",
+  "vars": {{
+    "AUTH_SECRET": "super_secret_auth_token_987654321",
+    "PUBLIC_API_URL": "https://api.myworker.dev"
+  }}
+}}
+"#
+        )
+        .unwrap();
+
+        let secrets = parse_wrangler_file(tmp.path()).unwrap();
+        assert_eq!(secrets.len(), 1);
+        assert_eq!(secrets[0].key, "AUTH_SECRET");
+        assert_eq!(secrets[0].value, "super_secret_auth_token_987654321");
+    }
+
+    #[test]
+    fn test_parse_wrangler_toml() {
+        let mut tmp = tempfile::Builder::new().suffix(".toml").tempfile().unwrap();
+        writeln!(
+            tmp,
+            r#"
+name = "my-worker"
+compatibility_date = "2024-01-01"
+
+[vars]
+API_SIGNING_KEY = "my_custom_hmac_signing_key_456"
+PUBLIC_NAME = "My Public App"
+"#
+        )
+        .unwrap();
+
+        let secrets = parse_wrangler_file(tmp.path()).unwrap();
+        assert_eq!(secrets.len(), 1);
+        assert_eq!(secrets[0].key, "API_SIGNING_KEY");
+    }
+}

package/src/secrets/ignore.rs

@@ -0,0 +1,139 @@
+use glob::Pattern;
+use std::collections::HashSet;
+use std::fs;
+use std::path::Path;
+
+/// Manages ignore rules, file exclusion patterns, and secret allowlists.
+#[derive(Debug, Clone, Default)]
+pub struct IgnoreFilter {
+    pub ignored_rules: HashSet<String>,
+    pub ignored_secrets: HashSet<String>,
+    pub file_patterns: Vec<Pattern>,
+}
+
+impl IgnoreFilter {
+    pub fn new() -> Self {
+        Self::default()
+    }
+
+    /// Add an ignored rule ID (e.g. `CF-006` or `ENV-PORT`).
+    pub fn ignore_rule(&mut self, rule_id: &str) {
+        self.ignored_rules.insert(rule_id.to_string());
+    }
+
+    /// Add an exact secret string or fingerprint to ignore.
+    pub fn ignore_secret(&mut self, secret: &str) {
+        self.ignored_secrets.insert(secret.to_string());
+    }
+
+    /// Add a glob pattern to exclude matching files.
+    pub fn add_exclude_pattern(&mut self, pattern_str: &str) -> Result<(), glob::PatternError> {
+        let pat = Pattern::new(pattern_str)?;
+        self.file_patterns.push(pat);
+        Ok(())
+    }
+
+    /// Loads rules/patterns from a `.cfsecretignore` file.
+    pub fn load_from_file(&mut self, path: &Path) -> Result<(), std::io::Error> {
+        if !path.exists() {
+            return Ok(());
+        }
+
+        let content = fs::read_to_string(path)?;
+        for line in content.lines() {
+            let trimmed = line.trim();
+            if trimmed.is_empty() || trimmed.starts_with('#') {
+                continue;
+            }
+
+            if let Some(rule) = trimmed.strip_prefix("rule:") {
+                self.ignore_rule(rule.trim());
+            } else if let Some(secret) = trimmed.strip_prefix("secret:") {
+                self.ignore_secret(secret.trim());
+            } else {
+                // Treat as file glob or secret
+                if trimmed.contains('*') || trimmed.contains('?') || trimmed.contains('/') {
+                    if let Ok(pat) = Pattern::new(trimmed) {
+                        self.file_patterns.push(pat);
+                    }
+                } else {
+                    self.ignore_secret(trimmed);
+                }
+            }
+        }
+
+        Ok(())
+    }
+
+    /// Checks if a file path should be ignored.
+    pub fn is_file_ignored(&self, path: &Path) -> bool {
+        let path_str = path.to_string_lossy();
+        for pattern in &self.file_patterns {
+            if pattern.matches(&path_str) {
+                return true;
+            }
+            if let Some(file_name) = path.file_name().and_then(|f| f.to_str())
+                && pattern.matches(file_name)
+            {
+                return true;
+            }
+        }
+        false
+    }
+
+    /// Checks if a rule ID is ignored.
+    pub fn is_rule_ignored(&self, rule_id: &str) -> bool {
+        self.ignored_rules.contains(rule_id)
+    }
+
+    /// Checks if a matched secret value is ignored.
+    pub fn is_secret_ignored(&self, secret: &str) -> bool {
+        self.ignored_secrets.contains(secret)
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use std::io::Write;
+    use tempfile::NamedTempFile;
+
+    #[test]
+    fn test_ignore_filter() {
+        let mut filter = IgnoreFilter::new();
+        filter.ignore_rule("CF-006");
+        filter.ignore_secret("0x4AAAAAA_test_safe_dummy");
+        filter.add_exclude_pattern("*.map").unwrap();
+
+        assert!(filter.is_rule_ignored("CF-006"));
+        assert!(!filter.is_rule_ignored("CF-001"));
+
+        assert!(filter.is_secret_ignored("0x4AAAAAA_test_safe_dummy"));
+        assert!(!filter.is_secret_ignored("0x4AAAAAA_real_secret"));
+
+        assert!(filter.is_file_ignored(Path::new("dist/client/app.js.map")));
+        assert!(!filter.is_file_ignored(Path::new("dist/client/app.js")));
+    }
+
+    #[test]
+    fn test_load_ignore_file() {
+        let mut tmp = NamedTempFile::new().unwrap();
+        writeln!(
+            tmp,
+            r#"
+# Ignore configuration
+rule: CF-006
+*.test.js
+secret: safe_known_dummy_token
+"#
+        )
+        .unwrap();
+
+        let mut filter = IgnoreFilter::new();
+        filter.load_from_file(tmp.path()).unwrap();
+
+        assert!(filter.is_rule_ignored("CF-006"));
+        assert!(filter.is_file_ignored(Path::new("chunk.test.js")));
+        assert!(filter.is_secret_ignored("safe_known_dummy_token"));
+    }
+}

package/src/secrets/mod.rs

@@ -0,0 +1,14 @@
+pub mod cli;
+pub mod env_parser;
+pub mod ignore;
+pub mod report;
+pub mod rules;
+pub mod scanner;
+
+pub use env_parser::{
+    discover_env_files, env_secrets_to_rules, parse_env_file, parse_wrangler_file,
+};
+pub use ignore::IgnoreFilter;
+pub use report::{OutputFormat, render_report};
+pub use rules::{Finding, Rule, Severity, get_builtin_rules, redact_secret};
+pub use scanner::{ScanResult, ScannerOptions, discover_default_targets, scan_file, scan_targets};

package/src/secrets/report/json_format.rs

@@ -0,0 +1,97 @@
+use crate::secrets::rules::types::Finding;
+use crate::secrets::scanner::ScanStats;
+use serde::{Deserialize, Serialize};
+
+/// Top-level JSON report structure.
+#[derive(Debug, Clone, Serialize, Deserialize)]
+pub struct JsonReport {
+    pub tool_name: String,
+    pub tool_version: String,
+    pub timestamp: String,
+    pub stats: JsonStats,
+    pub findings: Vec<Finding>,
+}
+
+#[derive(Debug, Clone, Serialize, Deserialize)]
+pub struct JsonStats {
+    pub files_scanned: usize,
+    pub bytes_scanned: usize,
+    pub total_findings: usize,
+    pub critical_count: usize,
+    pub high_count: usize,
+    pub medium_count: usize,
+    pub low_count: usize,
+    pub duration_ms: u128,
+}
+
+impl From<ScanStats> for JsonStats {
+    fn from(stats: ScanStats) -> Self {
+        Self {
+            files_scanned: stats.files_scanned,
+            bytes_scanned: stats.bytes_scanned,
+            total_findings: stats.total_findings,
+            critical_count: stats.critical_count,
+            high_count: stats.high_count,
+            medium_count: stats.medium_count,
+            low_count: stats.low_count,
+            duration_ms: stats.duration_ms,
+        }
+    }
+}
+
+/// Formats scan results as pretty-printed JSON.
+pub fn format_json_report(
+    findings: &[Finding],
+    stats: &ScanStats,
+    tool_version: &str,
+) -> Result<String, serde_json::Error> {
+    let report = JsonReport {
+        tool_name: "cf-secret-leak-guard".to_string(),
+        tool_version: tool_version.to_string(),
+        timestamp: "2026-08-22T00:00:00Z".to_string(),
+        stats: stats.clone().into(),
+        findings: findings.to_vec(),
+    };
+
+    serde_json::to_string_pretty(&report)
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use crate::secrets::rules::types::Severity;
+
+    #[test]
+    fn test_json_report_format() {
+        let stats = ScanStats {
+            files_scanned: 10,
+            bytes_scanned: 1024,
+            total_findings: 1,
+            critical_count: 1,
+            high_count: 0,
+            medium_count: 0,
+            low_count: 0,
+            duration_ms: 15,
+        };
+
+        let finding = Finding {
+            rule_id: "CF-001".into(),
+            rule_name: "Cloudflare API Token".into(),
+            severity: Severity::Critical,
+            file_path: "dist/client/main.js".into(),
+            line_number: 10,
+            column_number: 5,
+            match_start: 100,
+            match_end: 140,
+            raw_secret: "secret123".into(),
+            redacted_secret: "sec...123".into(),
+            line_content: "token = [REDACTED]".into(),
+            description: "Leaked token".into(),
+            recommendation: "Rotate token".into(),
+        };
+
+        let json_str = format_json_report(&[finding], &stats, "0.1.0").unwrap();
+        assert!(json_str.contains("cf-secret-leak-guard"));
+        assert!(json_str.contains("CF-001"));
+    }
+}