diff --git a/pkg/detectors/detectors.go b/pkg/detectors/detectors.go index 610ecfbc8..ac87fc29a 100644 --- a/pkg/detectors/detectors.go +++ b/pkg/detectors/detectors.go @@ -114,7 +114,15 @@ type Result struct { AnalysisInfo map[string]string } -// SetVerificationError is the only way to set a verification error. Any sensitive values should be passed-in as secrets to be redacted. +// CopyVerificationInfo clones verification info (status and error) from another Result struct. This is used when +// loading verification info from a verification cache. (A method is necessary because verification errors are not +// exported, to prevent the accidental storage of sensitive information in them.) +func (r *Result) CopyVerificationInfo(from *Result) { + r.Verified = from.Verified + r.verificationError = from.verificationError +} + +// SetVerificationError is the only way to set a new verification error. Any sensitive values should be passed-in as secrets to be redacted. func (r *Result) SetVerificationError(err error, secrets ...string) { if err != nil { r.verificationError = redactSecrets(err, secrets...) diff --git a/pkg/verificationcaching/verificationcaching.go b/pkg/verificationcaching/verificationcaching.go index 68ab06956..8f217a87e 100644 --- a/pkg/verificationcaching/verificationcaching.go +++ b/pkg/verificationcaching/verificationcaching.go @@ -37,23 +37,19 @@ func FromDataCached( } if !forceCacheUpdate { - withoutVerification, err := detector.FromData(ctx, false, data) + withoutRemoteVerification, err := detector.FromData(ctx, false, data) if err != nil { return nil, err } if !verify { - return withoutVerification, nil + return withoutRemoteVerification, nil } isEverythingCached := false - var fromCache []detectors.Result - for _, r := range withoutVerification { + for _, r := range withoutRemoteVerification { if cacheHit, ok := verificationCache.Get(getCacheKey(&r)); ok { - fromCache = append(fromCache, *cacheHit) - fromCache[len(fromCache)-1].Raw = r.Raw - fromCache[len(fromCache)-1].RawV2 = r.RawV2 - fromCache[len(fromCache)-1].VerificationFromCache = true + r.CopyVerificationInfo(cacheHit) } else { isEverythingCached = false break @@ -61,16 +57,16 @@ func FromDataCached( } if isEverythingCached { - return fromCache, nil + return withoutRemoteVerification, nil } } - withVerification, err := detector.FromData(ctx, verify, data) + withRemoteVerification, err := detector.FromData(ctx, verify, data) if err != nil { return nil, err } - for _, r := range withVerification { + for _, r := range withRemoteVerification { copyForCaching := r // Do not persist raw secret values in a long-lived cache copyForCaching.Raw = nil @@ -80,5 +76,5 @@ func FromDataCached( verificationCache.Set(getCacheKey(&r), ©ForCaching) } - return withVerification, nil + return withRemoteVerification, nil }