Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Add support for negative lookups to constraints. #38

Merged
merged 5 commits into from
Nov 11, 2024

Conversation

Clorith
Copy link
Member

@Clorith Clorith commented Nov 11, 2024

Constraints are used to specifically state if am entry should be anonymized, but there are cases where the opposite scenario is needed, where an explicit declaration should not be anonymized.

This PR introduces the concept of negative constraints, specifically not like (or just not and similar shorthands), when a not rule is hit, it will not perform anonymization for the given value, this can be useful for example when needing to anonymize, but wanting to keep your username and password for your personal account.

Taking the example above, the following field rule would only replace the username and password for accounts that do not have the username marius:

{
  "tableName": ".*_users",
  "fields": [
	{
		"field": "user_login",
		"position": 2,
		"type": "username",
		"constraints": [
			{
				"field": "user_login",
				"position": 2,
				"value": "marius",
				"compare": "not like"
			}
		]
	},
	{
		"field": "user_pass",
		"position": 3,
		"type": "password",
		"constraints": [
			{
				"field": "user_login",
				"position": 2,
				"value": "marius",
				"compare": "not like"
			}
		]
	}
}

It is of course still possible to mix multiple constraints, but as soon as a rule that would prevent anonymization is found, it will short-circuit the remaining rules.

The example above is bad, because it looks for the user_login and needs it to not match a value, this could potentially suddenly trigger based on an anonymized value put in, and should instead be matched against a later column ( user_email in field 5 for example, but left it like this intentionally for emphasis).

In addition to the not like, two other entries are also found now: regex and regex not like. The explicit not like variant is because Go regex does not support negative lookahead or lookbehind, so it can not be used to do a negative lookup within a single rule type.

@Clorith Clorith merged commit 308bb40 into main Nov 11, 2024
1 check passed
@Clorith Clorith deleted the feature/constraint-comparison-rules branch November 11, 2024 14:17
@PeterBooker
Copy link
Contributor

LGTM! 👍

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants