updated for v1.61.0

src/baseline.rs

@@ -10,7 +10,7 @@ use chrono::Local;
 use serde::{Deserialize, Serialize};
 use tracing::debug;
 
-use crate::{findings_store::FindingsStore, matcher::compute_finding_fingerprint};
+use crate::findings_store::FindingsStore;
 
 #[derive(Debug, Default, Serialize, Deserialize)]
 pub struct BaselineFile {
@@ -53,20 +53,6 @@ fn normalize_path(p: &Path, roots: &[PathBuf]) -> String {
     p.to_string_lossy().replace('\\', "/")
 }
 
-fn compute_hash(secret: &str, path: &str) -> String {
-    let fp = compute_finding_fingerprint(secret, path, 0, 0);
-    format!("{:016x}", fp)
-}
-
-fn extract_secret(m: &crate::matcher::Match) -> String {
-    m.groups
-        .captures
-        .get(1)
-        .or_else(|| m.groups.captures.get(0))
-        .map(|c| c.value.to_string())
-        .unwrap_or_default()
-}
-
 pub fn apply_baseline(
     store: &mut FindingsStore,
     baseline_path: &Path,
@@ -87,10 +73,10 @@ pub fn apply_baseline(
     for arc_msg in store.get_matches_mut() {
         let (origin, _blob, m) = Arc::make_mut(arc_msg);
         let file_path = origin.iter().filter_map(|o| o.full_path()).next();
+        let hash = format!("{:016x}", m.finding_fingerprint);
+
         if let Some(fp) = file_path {
             let normalized = normalize_path(&fp, roots);
-            let secret = extract_secret(m);
-            let hash = compute_hash(&secret, &normalized);
             if known.contains(&hash) {
                 debug!("Skipping {} due to baseline (hash {})", normalized, hash);
                 m.visible = false;
@@ -108,6 +94,11 @@ pub fn apply_baseline(
                 };
                 new_entries.push(entry);
             }
+        } else if known.contains(&hash) {
+            m.visible = false;
+            if manage {
+                encountered.insert(hash.clone());
+            }
         }
     }
     if manage {
@@ -127,3 +118,136 @@ pub fn apply_baseline(
 
     Ok(())
 }
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use crate::{
+        blob::{BlobId, BlobMetadata},
+        location::{Location, OffsetSpan, SourcePoint, SourceSpan},
+        matcher::{Match, SerializableCapture, SerializableCaptures},
+        origin::{Origin, OriginSet},
+        rules::rule::{Confidence, Rule, RuleSyntax},
+    };
+    use anyhow::Result;
+    use smallvec::SmallVec;
+    use std::{path::Path, sync::Arc};
+    use tempfile::TempDir;
+
+    fn test_rule() -> Arc<Rule> {
+        Arc::new(Rule::new(RuleSyntax {
+            name: "test".to_string(),
+            id: "test.rule".to_string(),
+            pattern: "test".to_string(),
+            min_entropy: 0.0,
+            confidence: Confidence::Low,
+            visible: true,
+            examples: vec![],
+            negative_examples: vec![],
+            references: vec![],
+            validation: None,
+            depends_on_rule: vec![],
+        }))
+    }
+
+    fn empty_captures() -> SerializableCaptures {
+        SerializableCaptures { captures: SmallVec::<[SerializableCapture; 2]>::new() }
+    }
+
+    fn make_store_with_match(fingerprint: u64, file_path: &Path) -> FindingsStore {
+        let mut store = FindingsStore::new(PathBuf::from("."));
+        let rule = test_rule();
+        let match_item = Match {
+            location: Location {
+                offset_span: OffsetSpan { start: 0, end: 1 },
+                source_span: SourceSpan {
+                    start: SourcePoint { line: 1, column: 0 },
+                    end: SourcePoint { line: 1, column: 1 },
+                },
+            },
+            groups: empty_captures(),
+            blob_id: BlobId::default(),
+            finding_fingerprint: fingerprint,
+            rule: Arc::clone(&rule),
+            validation_response_body: String::new(),
+            validation_response_status: 0,
+            validation_success: false,
+            calculated_entropy: 0.0,
+            visible: true,
+            is_base64: false,
+        };
+
+        let origin = OriginSet::from(Origin::from_file(file_path.to_path_buf()));
+        let blob_meta = Arc::new(BlobMetadata {
+            id: BlobId::default(),
+            num_bytes: 0,
+            mime_essence: None,
+            language: None,
+        });
+
+        let entry = Arc::new((Arc::new(origin), blob_meta, match_item));
+        store.get_matches_mut().push(entry);
+        store
+    }
+
+    fn expected_relative_path(root: &Path, file: &Path) -> String {
+        let mut expected = PathBuf::from(root.file_name().unwrap());
+        if let Ok(stripped) = file.strip_prefix(root) {
+            expected = expected.join(stripped);
+        }
+        expected.to_string_lossy().replace('\\', "/")
+    }
+
+    #[test]
+    fn apply_baseline_filters_existing_fingerprints() -> Result<()> {
+        let tmp = TempDir::new()?;
+        let roots = [tmp.path().to_path_buf()];
+        let secret_file = tmp.path().join("secret.txt");
+        fs::write(&secret_file, "dummy")?;
+        let baseline_path = tmp.path().join("baseline.yaml");
+        let fingerprint = 0x1234_u64;
+
+        let mut store = make_store_with_match(fingerprint, &secret_file);
+        apply_baseline(&mut store, &baseline_path, true, &roots)?;
+
+        let baseline = load_baseline(&baseline_path)?;
+        assert_eq!(baseline.exact_findings.matches.len(), 1);
+        let entry = &baseline.exact_findings.matches[0];
+        assert_eq!(entry.fingerprint, format!("{:016x}", fingerprint));
+        assert_eq!(entry.filepath, expected_relative_path(roots[0].as_path(), &secret_file));
+
+        let (_, _, recorded) = store.get_matches()[0].as_ref();
+        assert!(recorded.visible);
+
+        let mut follow_up = make_store_with_match(fingerprint, &secret_file);
+        apply_baseline(&mut follow_up, &baseline_path, false, &roots)?;
+        let (_, _, filtered) = follow_up.get_matches()[0].as_ref();
+        assert!(!filtered.visible);
+
+        Ok(())
+    }
+
+    #[test]
+    fn managing_baseline_is_idempotent() -> Result<()> {
+        let tmp = TempDir::new()?;
+        let roots = [tmp.path().to_path_buf()];
+        let secret_file = tmp.path().join("secret.txt");
+        fs::write(&secret_file, "dummy")?;
+        let baseline_path = tmp.path().join("baseline.yaml");
+        let fingerprint = 0xfeed_beef_dade_f00d_u64;
+
+        let mut initial = make_store_with_match(fingerprint, &secret_file);
+        apply_baseline(&mut initial, &baseline_path, true, &roots)?;
+        let baseline_before = fs::read_to_string(&baseline_path)?;
+
+        let mut rerun = make_store_with_match(fingerprint, &secret_file);
+        apply_baseline(&mut rerun, &baseline_path, true, &roots)?;
+        let baseline_after = fs::read_to_string(&baseline_path)?;
+        assert_eq!(baseline_before, baseline_after);
+
+        let (_, _, suppressed) = rerun.get_matches()[0].as_ref();
+        assert!(!suppressed.visible);
+
+        Ok(())
+    }
+}