scanner

Documentation

Overview

Package scanner defines the contract every detector implements, plus the shared file-walking machinery so each scanner doesn't reinvent it.

Index

• func LoadIgnore(root string) []string
• type Options
• type Scanner
• type TextFile
  • func WalkText(root string, ignore []string) ([]TextFile, error)

Functions

func LoadIgnore

func LoadIgnore(root string) []string

LoadIgnore reads .andasignore from root, returning its patterns. A missing file yields no patterns. Blank lines and lines starting with '#' are skipped.

Types

type Options

type Options struct {
	Validate    bool     // perform live validation of secrets
	Offline     bool     // make no network calls at all (no validation, no OSV)
	Entropy     bool     // flag high-entropy secret-like values beyond the known rules
	TimeoutS    int      // per-request network timeout, seconds
	IgnorePaths []string // .andasignore patterns for file-based scanners
}

Options carries run-wide settings down to individual scanners.

type Scanner

type Scanner interface {
	// Name is a short identifier shown in output.
	Name() string
	// Scan inspects root and returns any findings.
	Scan(root string, opts Options) ([]finding.Finding, error)
}

Scanner is one detection module (secrets, vulnerabilities, ...).

type TextFile

type TextFile struct {
	Path  string
	Lines []string
}

TextFile is a source file read into memory, ready for line-based scanning.

func WalkText

func WalkText(root string, ignore []string) ([]TextFile, error)

WalkText walks root and yields every readable, non-binary text file under the size limit, skipping the directories in skipDirs and anything matching a user-supplied ignore pattern (from .andasignore).