@dcrays/mobook-security-plugin 2.0.12 → 2.0.14

package/index.js

@@ -137,34 +137,46 @@ const BANK_CARD_REGEX = /\b[3-6]\d{15,18}\b/g;
 
 // ---- 脱敏辅助：部分保留 + 星号遮盖 ----
 function maskKeep(str, keepHead, keepTail = 0, minStars = 4) {
-  if (str.length <= keepHead + keepTail) return "*".repeat(str.length);
+  if (str.length <= keepHead + keepTail) return "\\*".repeat(str.length);
   const stars = Math.max(minStars, str.length - keepHead - keepTail);
-  return str.slice(0, keepHead) + "*".repeat(stars) + (keepTail > 0 ? str.slice(-keepTail) : "");
+  return str.slice(0, keepHead) + "\\*".repeat(stars) + (keepTail > 0 ? str.slice(-keepTail) : "");
+}
+
+// ---- 智能识别：检测文本是否已脱敏 ----
+function looksLikeMasked(text) {
+  // 只识别"明显的脱敏模式"：数字/字母 + 连续4个以上星号 + 数字/字母/@
+  // 例如：138****5678、1**********@163.com
+  // 不误判 Markdown 格式（---、**粗体**）
+  return /[a-zA-Z0-9]\*{4,}[a-zA-Z0-9@]/.test(text);
 }
 
 const SENSITIVE_PATTERNS = [
+  // 优先级1：邮箱（避免被手机号规则破坏）
+  {
+    pattern: /\b([a-zA-Z0-9._%+-]+)@((?:qq|163|126|sina|sohu|gmail|outlook|hotmail|yahoo)\.[a-z]{2,})\b/gi,
+    replacer: (_m, local, domain) => maskKeep(local, 2, 0) + "@" + domain,  // jq*****@gmail.com
+    name: "个人邮箱"
+  },
+  // 优先级2：身份证
   {
     pattern: ID_CARD_REGEX,
     validator: verifyIdCard,
     replacer: (m) => maskKeep(m, 3, 4),  // 310***********1234
     name: "身份证号"
   },
+  // 优先级3：手机号（排除邮箱上下文）
   {
-    pattern: /\b1[3-9]\d{9}\b/g,
+    pattern: /\b1[3-9]\d{9}\b(?!@)/g,  // 负向前瞻：后面不能是 @
     replacer: (m) => maskKeep(m, 3, 4),  // 138****5678
     name: "手机号"
   },
+  // 优先级4：银行卡
   {
     pattern: BANK_CARD_REGEX,
     validator: verifyLuhn,
     replacer: (m) => maskKeep(m, 4, 4),  // 6222***********1234
     name: "银行卡号"
   },
-  {
-    pattern: /\b([a-zA-Z0-9._%+-]+)@((?:qq|163|126|sina|sohu|gmail|outlook|hotmail|yahoo)\.[a-z]{2,})\b/gi,
-    replacer: (_m, local, domain) => maskKeep(local, 1, 0) + "@" + domain,  // j*****@gmail.com
-    name: "个人邮箱"
-  },
   {
     pattern: /\b(sk-[a-zA-Z0-9-]{20,})\b/g,
     replacer: (m) => maskKeep(m, 5, 0),  // sk-pr**************
@@ -198,6 +210,12 @@ const SENSITIVE_PATTERNS = [
 ];
 
 function sanitizeContent(content) {
+  // 智能识别：如果整体内容看起来已脱敏，跳过处理
+  if (looksLikeMasked(content)) {
+    log(`SKIP: 检测到已脱敏文本，跳过二次脱敏 | 长度=${content.length}`);
+    return { sanitized: content, matches: [] };
+  }
+
   let sanitized = content;
   const matches = [];
 
@@ -209,6 +227,9 @@ function sanitizeContent(content) {
       let hasMatch = false;
       sanitized = sanitized.replace(rule.pattern, (...args) => {
         const match = args[0];
+        // 跳过已脱敏的匹配
+        if (looksLikeMasked(match)) return match;
+        
         if (rule.validator(match)) {
           hasMatch = true;
           return rule.replacer(...args);
@@ -219,7 +240,13 @@ function sanitizeContent(content) {
     } else if (rule.replacer) {
       // 使用 replacer 函数
       rule.pattern.lastIndex = 0;
-      const replaced = sanitized.replace(rule.pattern, (...args) => rule.replacer(...args));
+      const replaced = sanitized.replace(rule.pattern, (...args) => {
+        const match = args[0];
+        // 跳过已脱敏的匹配
+        if (looksLikeMasked(match)) return match;
+        
+        return rule.replacer(...args);
+      });
       if (replaced !== sanitized) {
         matches.push(rule.name);
         sanitized = replaced;

package/openclaw.plugin.json

@@ -1,9 +1,9 @@
 {
   "id": "mobook-security-plugin",
   "name": "MoBook 安全防护插件",
-  "version": "2.0.12",
+  "version": "2.0.14",
   "description": "MoBook 企业级安全插件 - 危险命令分级拦截、敏感信息全渠道脱敏（身份证GB11643/银行卡Luhn校验）、LLM响应拦截、操作审计",
   "entry": "./index.js",
   "type": "plugin",
   "configSchema": {}
-}
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@dcrays/mobook-security-plugin",
-  "version": "2.0.12",
+  "version": "2.0.14",
   "type": "module",
   "description": "MoBook 企业级安全插件 - 危险命令分级拦截、敏感信息全渠道脱敏（身份证GB11643/银行卡Luhn校验）、LLM响应拦截、操作审计",
   "main": "index.js",
@@ -20,4 +20,4 @@
       "./index.js"
     ]
   }
-}
+}