@dcrays/mobook-security-plugin 2.0.11 → 2.0.14

package/index.js

@@ -135,62 +135,87 @@ function verifyLuhn(cardNumber) {
 const ID_CARD_REGEX = /\b[1-9]\d{5}(?:19|20)\d{2}(?:0[1-9]|1[0-2])(?:0[1-9]|[12]\d|3[01])\d{3}[\dXx]\b/g;
 const BANK_CARD_REGEX = /\b[3-6]\d{15,18}\b/g;
 
+// ---- 脱敏辅助：部分保留 + 星号遮盖 ----
+function maskKeep(str, keepHead, keepTail = 0, minStars = 4) {
+  if (str.length <= keepHead + keepTail) return "\\*".repeat(str.length);
+  const stars = Math.max(minStars, str.length - keepHead - keepTail);
+  return str.slice(0, keepHead) + "\\*".repeat(stars) + (keepTail > 0 ? str.slice(-keepTail) : "");
+}
+
+// ---- 智能识别：检测文本是否已脱敏 ----
+function looksLikeMasked(text) {
+  // 只识别"明显的脱敏模式"：数字/字母 + 连续4个以上星号 + 数字/字母/@
+  // 例如：138****5678、1**********@163.com
+  // 不误判 Markdown 格式（---、**粗体**）
+  return /[a-zA-Z0-9]\*{4,}[a-zA-Z0-9@]/.test(text);
+}
+
 const SENSITIVE_PATTERNS = [
+  // 优先级1：邮箱（避免被手机号规则破坏）
+  {
+    pattern: /\b([a-zA-Z0-9._%+-]+)@((?:qq|163|126|sina|sohu|gmail|outlook|hotmail|yahoo)\.[a-z]{2,})\b/gi,
+    replacer: (_m, local, domain) => maskKeep(local, 2, 0) + "@" + domain,  // jq*****@gmail.com
+    name: "个人邮箱"
+  },
+  // 优先级2：身份证
   {
     pattern: ID_CARD_REGEX,
     validator: verifyIdCard,
-    replacementText: "***身份证号已脱敏***",
+    replacer: (m) => maskKeep(m, 3, 4),  // 310***********1234
     name: "身份证号"
   },
+  // 优先级3：手机号（排除邮箱上下文）
   {
-    pattern: /\b1[3-9]\d{9}\b/g,
-    replacement: "***手机号已脱敏***",
+    pattern: /\b1[3-9]\d{9}\b(?!@)/g,  // 负向前瞻：后面不能是 @
+    replacer: (m) => maskKeep(m, 3, 4),  // 138****5678
     name: "手机号"
   },
+  // 优先级4：银行卡
   {
     pattern: BANK_CARD_REGEX,
     validator: verifyLuhn,
-    replacementText: "***银行卡号已脱敏***",
+    replacer: (m) => maskKeep(m, 4, 4),  // 6222***********1234
     name: "银行卡号"
   },
-  {
-    pattern: /\b[a-zA-Z0-9._%+-]+@(qq|163|126|sina|sohu|gmail|outlook|hotmail|yahoo)\.[a-z]{2,}\b/gi,
-    replacement: "***邮箱已脱敏***",
-    name: "个人邮箱"
-  },
   {
     pattern: /\b(sk-[a-zA-Z0-9-]{20,})\b/g,
-    replacement: "***API密钥已脱敏***",
+    replacer: (m) => maskKeep(m, 5, 0),  // sk-pr**************
     name: "API Key (sk-)"
   },
   {
     pattern: /\b(AKIA[0-9A-Z]{16})\b/g,
-    replacement: "***AWS密钥已脱敏***",
+    replacer: (m) => maskKeep(m, 4, 0),  // AKIA************
     name: "AWS Access Key"
   },
   {
     pattern: /\b(ghp_[a-zA-Z0-9]{36,})\b/g,
-    replacement: "***GitHub Token已脱敏***",
+    replacer: (m) => maskKeep(m, 4, 0),  // ghp_****...
     name: "GitHub Token"
   },
   {
     pattern: /(password|passwd|pwd|secret_key|secret|token|api_key|apikey|access_key|private_key)\s*[=:]\s*["']?[^\s"',]{6,}/gi,
-    replacement: "$1=***已脱敏***",
+    replacer: (_m, key) => key + "=***",  // password=***
     name: "密码/密钥字段"
   },
   {
     pattern: /\b(10\.\d{1,3}\.\d{1,3}\.\d{1,3}|172\.(1[6-9]|2\d|3[01])\.\d{1,3}\.\d{1,3}|192\.168\.\d{1,3}\.\d{1,3})\b/g,
-    replacement: "***内网IP已脱敏***",
+    replacer: (m) => m.split(".")[0] + ".*.*.*",  // 10.*.*.*
     name: "内网IP"
   },
   {
     pattern: /[^\s"']*\/extensions\/mobook-security-plugin[^\s"']*/g,
-    replacement: "***插件路径已脱敏***",
+    replacer: () => "***插件路径已脱敏***",
     name: "安全插件路径"
   },
 ];
 
 function sanitizeContent(content) {
+  // 智能识别：如果整体内容看起来已脱敏，跳过处理
+  if (looksLikeMasked(content)) {
+    log(`SKIP: 检测到已脱敏文本，跳过二次脱敏 | 长度=${content.length}`);
+    return { sanitized: content, matches: [] };
+  }
+
   let sanitized = content;
   const matches = [];
 
@@ -198,19 +223,30 @@ function sanitizeContent(content) {
     rule.pattern.lastIndex = 0;
 
     if (rule.validator) {
+      // 有校验器的规则（身份证、银行卡等）
       let hasMatch = false;
-      sanitized = sanitized.replace(rule.pattern, (match) => {
+      sanitized = sanitized.replace(rule.pattern, (...args) => {
+        const match = args[0];
+        // 跳过已脱敏的匹配
+        if (looksLikeMasked(match)) return match;
+        
         if (rule.validator(match)) {
           hasMatch = true;
-          return rule.replacementText;
+          return rule.replacer(...args);
         }
         return match;
       });
       if (hasMatch) matches.push(rule.name);
-    } else if (rule.replacement) {
+    } else if (rule.replacer) {
+      // 使用 replacer 函数
       rule.pattern.lastIndex = 0;
-      const repl = rule.replacement; // 闭包捕获
-      const replaced = sanitized.replace(rule.pattern, () => repl);
+      const replaced = sanitized.replace(rule.pattern, (...args) => {
+        const match = args[0];
+        // 跳过已脱敏的匹配
+        if (looksLikeMasked(match)) return match;
+        
+        return rule.replacer(...args);
+      });
       if (replaced !== sanitized) {
         matches.push(rule.name);
         sanitized = replaced;

package/openclaw.plugin.json

@@ -1,9 +1,9 @@
 {
   "id": "mobook-security-plugin",
   "name": "MoBook 安全防护插件",
-  "version": "2.0.11",
+  "version": "2.0.14",
   "description": "MoBook 企业级安全插件 - 危险命令分级拦截、敏感信息全渠道脱敏（身份证GB11643/银行卡Luhn校验）、LLM响应拦截、操作审计",
   "entry": "./index.js",
   "type": "plugin",
   "configSchema": {}
-}
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@dcrays/mobook-security-plugin",
-  "version": "2.0.11",
+  "version": "2.0.14",
   "type": "module",
   "description": "MoBook 企业级安全插件 - 危险命令分级拦截、敏感信息全渠道脱敏（身份证GB11643/银行卡Luhn校验）、LLM响应拦截、操作审计",
   "main": "index.js",
@@ -20,4 +20,4 @@
       "./index.js"
     ]
   }
-}
+}