@envseal/detector 0.1.1 → 0.1.3

package/dist/exclusions.js

@@ -73,34 +73,85 @@ function isUUID(candidate) {
     const uuidPattern = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
     return uuidPattern.test(candidate);
 }
+/**
+ * Audit fix: these buckets previously excluded on PREFIX alone (`sha256:` +
+ * anything), letting attacker-controlled context park a real credential
+ * behind an algorithm label or an unvalidated `integrity=` shape. Each now
+ * demands a base64/hex body of plausible digest length for its algorithm.
+ */
+const DIGEST_BODY_FLOOR = {
+    'sha256:': 43,
+    'sha256-': 43,
+    'sha512-': 86,
+    'sha1-': 27,
+    'md5-': 22,
+};
 function isDigest(candidate, context) {
-    if (candidate.startsWith('sha256:') || candidate.startsWith('sha256-') ||
-        candidate.startsWith('sha512-') || candidate.startsWith('sha1-') ||
-        candidate.startsWith('md5-')) {
-        return true;
+    // Standard-base64/hex charset only: SRI and docker-style digest bodies
+    // never contain `-` or `_`, but vendor key shapes (sk-proj-*, ghp-*) do.
+    // That charset distinction — plus the length floor — is what keeps a real
+    // credential from hiding behind an algorithm label.
+    const DIGEST_BODY = /^[A-Za-z0-9+/=]+$/;
+    for (const [prefix, floor] of Object.entries(DIGEST_BODY_FLOOR)) {
+        if (candidate.startsWith(prefix)) {
+            const body = candidate.slice(prefix.length);
+            return (DIGEST_BODY.test(body) && body.length >= floor && body.length <= 88);
+        }
     }
     if (context.before.endsWith('integrity=') || context.before.endsWith('integrity="')) {
-        return /^[A-Za-z0-9+/=]+$/.test(candidate);
+        // SRI values carry their own algorithm prefix; bare base64 in this
+        // position is not an SRI hash and gets no exclusion.
+        return /^sha(256|384|512)-[A-Za-z0-9+/=]+$/.test(candidate);
     }
     return false;
 }
 function isDataUri(candidate, context) {
-    if (candidate.startsWith('data:'))
+    // Audit fix: was prefix-only. A data: URI must now look like one — a MIME
+    // type, and if base64 is claimed, a decodable-length body — before its
+    // content can hide from detection.
+    const match = /^data:([a-z0-9.+-]+\/[a-z0-9.+-]+)?(;?[a-z0-9-]+=[a-z0-9-]+)*(;base64,)?(.*)$/i.exec(candidate);
+    if (match !== null) {
+        const [, mime, , base64Marker, body] = match;
+        if ((mime ?? '') === '')
+            return false; // `data:` alone proves nothing
+        if (base64Marker !== undefined) {
+            return /^[A-Za-z0-9+/=]*$/.test(body ?? '') && (body ?? '').length % 4 === 0 && (body ?? '').length > 0;
+        }
         return true;
-    return /data:[^/]*\/[^;]*;base64,$/.test(context.before);
+    }
+    return /data:[a-z0-9.+-]+\/[a-z0-9.+-]+(;[a-z0-9-]+=[a-z0-9-]+)*;base64,[A-Za-z0-9+/=]+$/.test(context.before);
 }
 function isFilesystemPath(candidate) {
     const hasPathSep = candidate.includes('/') || candidate.includes(String.fromCharCode(92));
     if (!hasPathSep)
         return false;
     const hasCredential = /[a-z][a-z0-9+.-]*:\/\/[^@]*:.*@/.test(candidate);
-    return !hasCredential;
+    if (hasCredential)
+        return false;
+    // Audit fix: any slash-containing string used to be excluded, but ~27% of
+    // random base64 credentials contain `/`. Require actual path structure:
+    // an anchored form or a path-like extension — not merely a slash.
+    const pathlike = /^\.\.?[/\\]/.test(candidate) || // ./x, ../x
+        /^[/\\]/.test(candidate) || // absolute POSIX
+        /^[A-Za-z]:[/\\]/.test(candidate) || // drive path
+        /\.[A-Za-z][A-Za-z0-9]{0,7}$/.test(candidate); // ends in an extension
+    return pathlike;
 }
 function isPlainUrl(candidate) {
     try {
         const url = new URL(candidate);
-        return (url.protocol === 'http:' || url.protocol === 'https:') &&
-            url.username === '' && url.password === '';
+        if (url.protocol !== 'http:' && url.protocol !== 'https:') {
+            return false;
+        }
+        if (url.username !== '' || url.password !== '') {
+            return false;
+        }
+        // Audit fix: URLs whose query carries credential-shaped parameters are a
+        // real delivery channel for keys (Google-style ?key=...), not plain links.
+        if (/[?&](key|token|secret|password|passwd|api[-_]?key|access[-_]?token|sig|signature|credential)s?=/i.test(url.search)) {
+            return false;
+        }
+        return true;
     }
     catch {
         return false;

package/dist/patterns.js

@@ -5,6 +5,11 @@ function escapeRegExp(s) {
 const SW = '[A-Za-z0-9_\\-]';
 const HAND_PATTERNS = [
     { id: 'openai-project-key', label: 'OpenAI project API key', providerId: 'openai', source: `sk-proj-${SW}{20,}` },
+    // F5: legacy OpenAI live keys (`sk-live-…`) and bare `sk-` runs were not
+    // covered — the W4 battle-test pasted `KEY=sk-live-w4bt…` straight through
+    // the user-prompt redactor. Same shape family as sk-proj-, so same guard.
+    { id: 'openai-legacy-key', label: 'OpenAI API key', providerId: 'openai', source: `sk-live-${SW}{20,}` },
+    { id: 'openai-generic-key', label: 'possible OpenAI API key', providerId: 'openai', source: `sk-(?!proj-|live-)[A-Za-z0-9]{20,}` },
     { id: 'anthropic-api03', label: 'Anthropic API key', providerId: 'anthropic', source: `sk-ant-api03-${SW}{20,}` },
     { id: 'github-pat', label: 'GitHub personal access token', providerId: 'github', source: `ghp_${SW}{30,}` },
     { id: 'github-oauth', label: 'GitHub OAuth access token', providerId: 'github', source: `gho_${SW}{30,}` },

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@envseal/detector",
-  "version": "0.1.1",
+  "version": "0.1.3",
   "type": "module",
   "license": "Apache-2.0",
   "main": "./dist/index.js",
@@ -20,7 +20,7 @@
     "provenance": true
   },
   "dependencies": {
-    "@envseal/registry": "0.1.1"
+    "@envseal/registry": "0.1.3"
   },
   "repository": {
     "type": "git",