Paste a secret, get a link, send it. The first person to open it and press
Reveal sees the secret; the link dies at that moment. The recipient needs a
browser and nothing else — no account, no client, no installed tooling.
The server cannot read what it stores. AES-256-GCM happens in the browser and
the key lives in the URL fragment, which browsers never transmit, so hushd
holds ciphertext and no key material. That is a property of where the key sits
rather than a promise about our conduct, which is why there is deliberately no
endpoint accepting a plaintext secret and no server-side-encryption fallback:
two guarantees behind one URL would be worse than one honest guarantee.
Three decisions carry the design:
* GET /s/{id} touches NO storage, not even to check existence. Slack, Teams,
WhatsApp, iMessage and Outlook Safe Links all fetch a URL before a human
sees it, so destroying on GET would destroy most secrets in transit and the
recipient's "already used" would be indistinguishable from interception.
Only POST /reveal consumes. Bot user-agent detection is an arms race;
removing the side effect from GET is not. Pinned by
TestGettingTheRevealPageNeverConsumesTheSecret.
* Destruction is one Redis GETDEL, which is atomic. GET-then-DEL has a window
where two simultaneous readers both win, and for a one-time secret that
window is the product. The store contract demands atomicity and the same
concurrency test runs against both implementations.
* Missing, already-revealed, expired and evicted are ONE indistinguishable
410. Separating them would confirm to a prober that a given link was real.
The secret id IS the capability, so secret.ID is a struct whose every
accidental path — %v, %s, String(), slog, json.Marshal — emits a redacted
handle or refuses, and the raw value needs an explicit Value(). The first
version tried to prevent leaks by implementing no String() at all; its own test
caught that Go's fmt prints unexported fields anyway, so forbidding the method
had removed the control rather than the leak.
Operationally: structured JSON on stdout in the fleet's wire format, which
Vector already collects with no annotation; six hush_* metrics on the chassis
registry with no id, IP or path in any label; five alert rules wired into
vmalert. The public Ingress enumerates /, /s/ and /api/ so /metrics, /healthz
and /readyz share the port but are unreachable from the internet — no
basic-auth middleware to maintain and get wrong.
Dependencies are vendored because go-chassis is private: the Woodpecker test
step and the in-cluster Kaniko build both run -mod=vendor with GOPROXY=off and
hold no git credential.
cmd/hush-mcp is a stdio MCP server doing the same client-side crypto locally,
so using hush from an agent preserves the same guarantee as using it from a
browser.
197 lines
5.3 KiB
Go
197 lines
5.3 KiB
Go
// Copyright 2019 The Go Authors. All rights reserved.
|
|
// Use of this source code is governed by a BSD-style
|
|
// license that can be found in the LICENSE file.
|
|
|
|
// Package strs provides string manipulation functionality specific to protobuf.
|
|
package strs
|
|
|
|
import (
|
|
"go/token"
|
|
"strings"
|
|
"unicode"
|
|
"unicode/utf8"
|
|
|
|
"google.golang.org/protobuf/internal/flags"
|
|
"google.golang.org/protobuf/reflect/protoreflect"
|
|
)
|
|
|
|
// EnforceUTF8 reports whether to enforce strict UTF-8 validation.
|
|
func EnforceUTF8(fd protoreflect.FieldDescriptor) bool {
|
|
if flags.ProtoLegacy || fd.Syntax() == protoreflect.Editions {
|
|
if fd, ok := fd.(interface{ EnforceUTF8() bool }); ok {
|
|
return fd.EnforceUTF8()
|
|
}
|
|
}
|
|
return fd.Syntax() == protoreflect.Proto3
|
|
}
|
|
|
|
// GoCamelCase camel-cases a protobuf name for use as a Go identifier.
|
|
//
|
|
// If there is an interior underscore followed by a lower case letter,
|
|
// drop the underscore and convert the letter to upper case.
|
|
func GoCamelCase(s string) string {
|
|
// Invariant: if the next letter is lower case, it must be converted
|
|
// to upper case.
|
|
// That is, we process a word at a time, where words are marked by _ or
|
|
// upper case letter. Digits are treated as words.
|
|
var b []byte
|
|
for i := 0; i < len(s); i++ {
|
|
c := s[i]
|
|
switch {
|
|
case c == '.' && i+1 < len(s) && isASCIILower(s[i+1]):
|
|
// Skip over '.' in ".{{lowercase}}".
|
|
case c == '.':
|
|
b = append(b, '_') // convert '.' to '_'
|
|
case c == '_' && (i == 0 || s[i-1] == '.'):
|
|
// Convert initial '_' to ensure we start with a capital letter.
|
|
// Do the same for '_' after '.' to match historic behavior.
|
|
b = append(b, 'X') // convert '_' to 'X'
|
|
case c == '_' && i+1 < len(s) && isASCIILower(s[i+1]):
|
|
// Skip over '_' in "_{{lowercase}}".
|
|
case isASCIIDigit(c):
|
|
b = append(b, c)
|
|
default:
|
|
// Assume we have a letter now - if not, it's a bogus identifier.
|
|
// The next word is a sequence of characters that must start upper case.
|
|
if isASCIILower(c) {
|
|
c -= 'a' - 'A' // convert lowercase to uppercase
|
|
}
|
|
b = append(b, c)
|
|
|
|
// Accept lower case sequence that follows.
|
|
for ; i+1 < len(s) && isASCIILower(s[i+1]); i++ {
|
|
b = append(b, s[i+1])
|
|
}
|
|
}
|
|
}
|
|
return string(b)
|
|
}
|
|
|
|
// GoSanitized converts a string to a valid Go identifier.
|
|
func GoSanitized(s string) string {
|
|
// Sanitize the input to the set of valid characters,
|
|
// which must be '_' or be in the Unicode L or N categories.
|
|
s = strings.Map(func(r rune) rune {
|
|
if unicode.IsLetter(r) || unicode.IsDigit(r) {
|
|
return r
|
|
}
|
|
return '_'
|
|
}, s)
|
|
|
|
// Prepend '_' in the event of a Go keyword conflict or if
|
|
// the identifier is invalid (does not start in the Unicode L category).
|
|
r, _ := utf8.DecodeRuneInString(s)
|
|
if token.Lookup(s).IsKeyword() || !unicode.IsLetter(r) {
|
|
return "_" + s
|
|
}
|
|
return s
|
|
}
|
|
|
|
// JSONCamelCase converts a snake_case identifier to a camelCase identifier,
|
|
// according to the protobuf JSON specification.
|
|
func JSONCamelCase(s string) string {
|
|
var b []byte
|
|
var wasUnderscore bool
|
|
for i := 0; i < len(s); i++ { // proto identifiers are always ASCII
|
|
c := s[i]
|
|
if c != '_' {
|
|
if wasUnderscore && isASCIILower(c) {
|
|
c -= 'a' - 'A' // convert to uppercase
|
|
}
|
|
b = append(b, c)
|
|
}
|
|
wasUnderscore = c == '_'
|
|
}
|
|
return string(b)
|
|
}
|
|
|
|
// JSONSnakeCase converts a camelCase identifier to a snake_case identifier,
|
|
// according to the protobuf JSON specification.
|
|
func JSONSnakeCase(s string) string {
|
|
var b []byte
|
|
for i := 0; i < len(s); i++ { // proto identifiers are always ASCII
|
|
c := s[i]
|
|
if isASCIIUpper(c) {
|
|
b = append(b, '_')
|
|
c += 'a' - 'A' // convert to lowercase
|
|
}
|
|
b = append(b, c)
|
|
}
|
|
return string(b)
|
|
}
|
|
|
|
// MapEntryName derives the name of the map entry message given the field name.
|
|
// See protoc v3.8.0: src/google/protobuf/descriptor.cc:254-276,6057
|
|
func MapEntryName(s string) string {
|
|
var b []byte
|
|
upperNext := true
|
|
for _, c := range s {
|
|
switch {
|
|
case c == '_':
|
|
upperNext = true
|
|
case upperNext:
|
|
b = append(b, byte(unicode.ToUpper(c)))
|
|
upperNext = false
|
|
default:
|
|
b = append(b, byte(c))
|
|
}
|
|
}
|
|
b = append(b, "Entry"...)
|
|
return string(b)
|
|
}
|
|
|
|
// EnumValueName derives the camel-cased enum value name.
|
|
// See protoc v3.8.0: src/google/protobuf/descriptor.cc:297-313
|
|
func EnumValueName(s string) string {
|
|
var b []byte
|
|
upperNext := true
|
|
for _, c := range s {
|
|
switch {
|
|
case c == '_':
|
|
upperNext = true
|
|
case upperNext:
|
|
b = append(b, byte(unicode.ToUpper(c)))
|
|
upperNext = false
|
|
default:
|
|
b = append(b, byte(unicode.ToLower(c)))
|
|
upperNext = false
|
|
}
|
|
}
|
|
return string(b)
|
|
}
|
|
|
|
// TrimEnumPrefix trims the enum name prefix from an enum value name,
|
|
// where the prefix is all lowercase without underscores.
|
|
// See protoc v3.8.0: src/google/protobuf/descriptor.cc:330-375
|
|
func TrimEnumPrefix(s, prefix string) string {
|
|
s0 := s // original input
|
|
for len(s) > 0 && len(prefix) > 0 {
|
|
if s[0] == '_' {
|
|
s = s[1:]
|
|
continue
|
|
}
|
|
if unicode.ToLower(rune(s[0])) != rune(prefix[0]) {
|
|
return s0 // no prefix match
|
|
}
|
|
s, prefix = s[1:], prefix[1:]
|
|
}
|
|
if len(prefix) > 0 {
|
|
return s0 // no prefix match
|
|
}
|
|
s = strings.TrimLeft(s, "_")
|
|
if len(s) == 0 {
|
|
return s0 // avoid returning empty string
|
|
}
|
|
return s
|
|
}
|
|
|
|
func isASCIILower(c byte) bool {
|
|
return 'a' <= c && c <= 'z'
|
|
}
|
|
func isASCIIUpper(c byte) bool {
|
|
return 'A' <= c && c <= 'Z'
|
|
}
|
|
func isASCIIDigit(c byte) bool {
|
|
return '0' <= c && c <= '9'
|
|
}
|