claude-plugins/plugins/claude-security/scripts/lib/secret.py

"""The snippet of a hard-coded credential finding, withheld from what the products carry.

The line such a finding quotes is the credential itself, and the JSONL and
SARIF files exist to leave the machine (a code scanning upload, a CI
artifact), so neither file quotes it: the finding's file, line and symbol
still locate the code, and the SARIF result's message says why no line is
quoted. Only the emitted copy changes: the finding is still placed on the
snippet as the researcher quoted it, and its fingerprint hashes no text of
the file (see sarif.fingerprint).
"""

from __future__ import annotations

from typing import TYPE_CHECKING

from . import cwe

if TYPE_CHECKING:
    from .finding import Finding

# CWE's Simplified Mapping entry Use of Hard-coded Credentials; CWE-259, 321 and 671 roll up to it.
CREDENTIALS = 798


def is_credential(finding: Finding) -> bool:
    """Whether the finding's CWE rolls up to Use of Hard-coded Credentials."""
    return cwe.catalog.category_of.get(cwe.id_number(finding["cwe_id"])) == CREDENTIALS


def withheld(finding: Finding) -> Finding:
    """`finding` as the products carry it: a hard-coded credential's snippet is empty."""
    return {**finding, "snippet": ""} if is_credential(finding) else finding