@dcrays/mobook-security-plugin 2.0.10 → 2.0.12

package/index.js

@@ -135,57 +135,64 @@ function verifyLuhn(cardNumber) {
 const ID_CARD_REGEX = /\b[1-9]\d{5}(?:19|20)\d{2}(?:0[1-9]|1[0-2])(?:0[1-9]|[12]\d|3[01])\d{3}[\dXx]\b/g;
 const BANK_CARD_REGEX = /\b[3-6]\d{15,18}\b/g;
 
+// ---- 脱敏辅助：部分保留 + 星号遮盖 ----
+function maskKeep(str, keepHead, keepTail = 0, minStars = 4) {
+  if (str.length <= keepHead + keepTail) return "*".repeat(str.length);
+  const stars = Math.max(minStars, str.length - keepHead - keepTail);
+  return str.slice(0, keepHead) + "*".repeat(stars) + (keepTail > 0 ? str.slice(-keepTail) : "");
+}
+
 const SENSITIVE_PATTERNS = [
   {
     pattern: ID_CARD_REGEX,
     validator: verifyIdCard,
-    replacementText: "***身份证号已脱敏***",
+    replacer: (m) => maskKeep(m, 3, 4),  // 310***********1234
     name: "身份证号"
   },
   {
     pattern: /\b1[3-9]\d{9}\b/g,
-    replacement: "***手机号已脱敏***",
+    replacer: (m) => maskKeep(m, 3, 4),  // 138****5678
     name: "手机号"
   },
   {
     pattern: BANK_CARD_REGEX,
     validator: verifyLuhn,
-    replacementText: "***银行卡号已脱敏***",
+    replacer: (m) => maskKeep(m, 4, 4),  // 6222***********1234
     name: "银行卡号"
   },
   {
-    pattern: /\b[a-zA-Z0-9._%+-]+@(qq|163|126|sina|sohu|gmail|outlook|hotmail|yahoo)\.[a-z]{2,}\b/gi,
-    replacement: "***邮箱已脱敏***",
+    pattern: /\b([a-zA-Z0-9._%+-]+)@((?:qq|163|126|sina|sohu|gmail|outlook|hotmail|yahoo)\.[a-z]{2,})\b/gi,
+    replacer: (_m, local, domain) => maskKeep(local, 1, 0) + "@" + domain,  // j*****@gmail.com
     name: "个人邮箱"
   },
   {
     pattern: /\b(sk-[a-zA-Z0-9-]{20,})\b/g,
-    replacement: "***API密钥已脱敏***",
+    replacer: (m) => maskKeep(m, 5, 0),  // sk-pr**************
     name: "API Key (sk-)"
   },
   {
     pattern: /\b(AKIA[0-9A-Z]{16})\b/g,
-    replacement: "***AWS密钥已脱敏***",
+    replacer: (m) => maskKeep(m, 4, 0),  // AKIA************
     name: "AWS Access Key"
   },
   {
     pattern: /\b(ghp_[a-zA-Z0-9]{36,})\b/g,
-    replacement: "***GitHub Token已脱敏***",
+    replacer: (m) => maskKeep(m, 4, 0),  // ghp_****...
     name: "GitHub Token"
   },
   {
     pattern: /(password|passwd|pwd|secret_key|secret|token|api_key|apikey|access_key|private_key)\s*[=:]\s*["']?[^\s"',]{6,}/gi,
-    replacement: "$1=***已脱敏***",
+    replacer: (_m, key) => key + "=***",  // password=***
     name: "密码/密钥字段"
   },
   {
     pattern: /\b(10\.\d{1,3}\.\d{1,3}\.\d{1,3}|172\.(1[6-9]|2\d|3[01])\.\d{1,3}\.\d{1,3}|192\.168\.\d{1,3}\.\d{1,3})\b/g,
-    replacement: "***内网IP已脱敏***",
+    replacer: (m) => m.split(".")[0] + ".*.*.*",  // 10.*.*.*
     name: "内网IP"
   },
   {
     pattern: /[^\s"']*\/extensions\/mobook-security-plugin[^\s"']*/g,
-    replacement: "***插件路径已脱敏***",
+    replacer: () => "***插件路径已脱敏***",
     name: "安全插件路径"
   },
 ];
@@ -198,19 +205,21 @@ function sanitizeContent(content) {
     rule.pattern.lastIndex = 0;
 
     if (rule.validator) {
+      // 有校验器的规则（身份证、银行卡等）
       let hasMatch = false;
-      sanitized = sanitized.replace(rule.pattern, (match) => {
+      sanitized = sanitized.replace(rule.pattern, (...args) => {
+        const match = args[0];
         if (rule.validator(match)) {
           hasMatch = true;
-          return rule.replacementText;
+          return rule.replacer(...args);
         }
         return match;
       });
       if (hasMatch) matches.push(rule.name);
-    } else if (rule.replacement) {
+    } else if (rule.replacer) {
+      // 使用 replacer 函数
       rule.pattern.lastIndex = 0;
-      const repl = rule.replacement; // 闭包捕获
-      const replaced = sanitized.replace(rule.pattern, () => repl);
+      const replaced = sanitized.replace(rule.pattern, (...args) => rule.replacer(...args));
       if (replaced !== sanitized) {
         matches.push(rule.name);
         sanitized = replaced;

package/openclaw.plugin.json

@@ -1,7 +1,7 @@
 {
   "id": "mobook-security-plugin",
   "name": "MoBook 安全防护插件",
-  "version": "2.0.9",
+  "version": "2.0.12",
   "description": "MoBook 企业级安全插件 - 危险命令分级拦截、敏感信息全渠道脱敏（身份证GB11643/银行卡Luhn校验）、LLM响应拦截、操作审计",
   "entry": "./index.js",
   "type": "plugin",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@dcrays/mobook-security-plugin",
-  "version": "2.0.10",
+  "version": "2.0.12",
   "type": "module",
   "description": "MoBook 企业级安全插件 - 危险命令分级拦截、敏感信息全渠道脱敏（身份证GB11643/银行卡Luhn校验）、LLM响应拦截、操作审计",
   "main": "index.js",