@envseal/detector 0.1.2 → 0.1.4

package/dist/exclusions.js

@@ -1,3 +1,4 @@
+import { charsetClasses, shannonEntropy } from './entropy.js';
 import { WORDLIST_LOWER } from './wordlist.js';
 const WORDLIST_SET = new Set(WORDLIST_LOWER.trim().split('\n'));
 export function exclusionReason(candidate, context) {
@@ -55,6 +56,8 @@ export function isExcluded(candidate, context) {
  * never consults the exclusion list.
  */
 const MIN_GENERIC_LENGTH = 24;
+const MIN_ENTROPY = 3.5;
+const MIN_CHARSET_CLASSES = 2;
 function isNonSecretAssignment(candidate) {
     const match = /^[A-Z][A-Z0-9_]{2,}=(.*)$/.exec(candidate);
     if (match === null)
@@ -73,34 +76,95 @@ function isUUID(candidate) {
     const uuidPattern = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
     return uuidPattern.test(candidate);
 }
+/**
+ * Audit fix: these buckets previously excluded on PREFIX alone (`sha256:` +
+ * anything), letting attacker-controlled context park a real credential
+ * behind an algorithm label or an unvalidated `integrity=` shape. Each now
+ * demands a base64/hex body of plausible digest length for its algorithm.
+ */
+const DIGEST_BODY_FLOOR = {
+    'sha256:': 43,
+    'sha256-': 43,
+    'sha512-': 86,
+    'sha1-': 27,
+    'md5-': 22,
+};
 function isDigest(candidate, context) {
-    if (candidate.startsWith('sha256:') || candidate.startsWith('sha256-') ||
-        candidate.startsWith('sha512-') || candidate.startsWith('sha1-') ||
-        candidate.startsWith('md5-')) {
-        return true;
+    // Standard-base64/hex charset only: SRI and docker-style digest bodies
+    // never contain `-` or `_`, but vendor key shapes (sk-proj-*, ghp-*) do.
+    // That charset distinction — plus the length floor — is what keeps a real
+    // credential from hiding behind an algorithm label.
+    const DIGEST_BODY = /^[A-Za-z0-9+/=]+$/;
+    for (const [prefix, floor] of Object.entries(DIGEST_BODY_FLOOR)) {
+        if (candidate.startsWith(prefix)) {
+            const body = candidate.slice(prefix.length);
+            return (DIGEST_BODY.test(body) && body.length >= floor && body.length <= 88);
+        }
     }
     if (context.before.endsWith('integrity=') || context.before.endsWith('integrity="')) {
-        return /^[A-Za-z0-9+/=]+$/.test(candidate);
+        // SRI values carry their own algorithm prefix; bare base64 in this
+        // position is not an SRI hash and gets no exclusion.
+        return /^sha(256|384|512)-[A-Za-z0-9+/=]+$/.test(candidate);
     }
     return false;
 }
 function isDataUri(candidate, context) {
-    if (candidate.startsWith('data:'))
+    // Audit fix: was prefix-only. A data: URI must now look like one — a MIME
+    // type, and if base64 is claimed, a decodable-length body — before its
+    // content can hide from detection.
+    const match = /^data:([a-z0-9.+-]+\/[a-z0-9.+-]+)?(;?[a-z0-9-]+=[a-z0-9-]+)*(;base64,)?(.*)$/i.exec(candidate);
+    if (match !== null) {
+        const [, mime, , base64Marker, body] = match;
+        if ((mime ?? '') === '')
+            return false; // `data:` alone proves nothing
+        if (base64Marker !== undefined) {
+            return /^[A-Za-z0-9+/=]*$/.test(body ?? '') && (body ?? '').length % 4 === 0 && (body ?? '').length > 0;
+        }
         return true;
-    return /data:[^/]*\/[^;]*;base64,$/.test(context.before);
+    }
+    return /data:[a-z0-9.+-]+\/[a-z0-9.+-]+(;[a-z0-9-]+=[a-z0-9-]+)*;base64,[A-Za-z0-9+/=]+$/.test(context.before) || ((context.before.endsWith(';base64,') || context.before.endsWith('base64,')) &&
+        /^[A-Za-z0-9+/=]*$/.test(candidate) &&
+        candidate.length % 4 === 0 &&
+        candidate.length > 0);
 }
 function isFilesystemPath(candidate) {
+    if (/^\([^)]*[/\\][^)]*\)$/.test(candidate))
+        return true;
+    if (/\/[a-zA-Z0-9_./-]+:\d+(?::\d+)?$/.test(candidate))
+        return true;
     const hasPathSep = candidate.includes('/') || candidate.includes(String.fromCharCode(92));
     if (!hasPathSep)
         return false;
     const hasCredential = /[a-z][a-z0-9+.-]*:\/\/[^@]*:.*@/.test(candidate);
-    return !hasCredential;
+    if (hasCredential)
+        return false;
+    // Audit fix: any slash-containing string used to be excluded, but ~27% of
+    // random base64 credentials contain `/`. Require actual path structure:
+    // an anchored form or a path-like extension — not merely a slash.
+    const pathlike = /^\.\.?[/\\]/.test(candidate) || // ./x, ../x
+        /^[/\\]/.test(candidate) || // absolute POSIX
+        /^[A-Za-z]:[/\\]/.test(candidate) || // drive path
+        /\.[A-Za-z][A-Za-z0-9]{0,7}$/.test(candidate); // ends in an extension
+    return pathlike;
 }
 function isPlainUrl(candidate) {
+    if (/^(?:postgres|postgresql|mysql|mongodb(?:\+srv)?|redis|amqp):\/\/[^@\s]+/i.test(candidate) && !candidate.includes('@')) {
+        return true;
+    }
     try {
         const url = new URL(candidate);
-        return (url.protocol === 'http:' || url.protocol === 'https:') &&
-            url.username === '' && url.password === '';
+        if (url.protocol !== 'http:' && url.protocol !== 'https:') {
+            return false;
+        }
+        if (url.username !== '' || url.password !== '') {
+            return false;
+        }
+        // Audit fix: URLs whose query carries credential-shaped parameters are a
+        // real delivery channel for keys (Google-style ?key=...), not plain links.
+        if (/[?&](key|token|secret|password|passwd|api[-_]?key|access[-_]?token|sig|signature|credential)s?=/i.test(url.search)) {
+            return false;
+        }
+        return true;
     }
     catch {
         return false;
@@ -139,20 +203,58 @@ function splitOnBoundaries(candidate) {
     });
     return result.filter((s) => s.length > 0);
 }
-function isCodeAdjacent(candidate, context) {
-    const codeChars = /[{}();,:]/;
+/**
+ * High-entropy `[A-Za-z0-9]{32,}` blobs in JSON/JS (`{"key":"<secret>"}` or
+ * `{secret:<value>}`) are credentials, not identifier tokens. The generic
+ * scanner uses the same entropy/charset gates.
+ */
+function qualifiesAsGenericHighEntropy(candidate) {
+    if (!/^[A-Za-z0-9]{32,}$/.test(candidate))
+        return false;
+    if (isIdentifierLike(candidate))
+        return false;
+    if (shannonEntropy(candidate) < MIN_ENTROPY)
+        return false;
+    if (charsetClasses(candidate) < MIN_CHARSET_CLASSES)
+        return false;
+    return true;
+}
+function isIdentifierLike(candidate) {
+    if (candidate.startsWith('$'))
+        return true;
+    if (isDictionaryText(candidate))
+        return true;
+    // Digits in a token point at key material, not a source-code identifier.
+    if (/\d/.test(candidate))
+        return false;
+    if (/^[a-z_$][\w$]*$/i.test(candidate) && /[a-z][A-Z]|[A-Z][a-z]|_/.test(candidate)) {
+        return true;
+    }
+    return /^[a-z][a-z0-9]*(_[a-z0-9]+)+$/i.test(candidate);
+}
+function isAdjacentToCodeStructure(context) {
+    const structural = /[{}(),:]/;
     if (context.before.length > 0) {
         const lastChar = context.before.at(-1);
-        if (lastChar !== undefined && codeChars.test(lastChar) && !/\s/.test(lastChar))
+        if (lastChar !== undefined && structural.test(lastChar) && !/\s/.test(lastChar)) {
             return true;
+        }
     }
     if (context.after.length > 0) {
         const firstChar = context.after.at(0);
-        if (firstChar !== undefined && codeChars.test(firstChar) && !/\s/.test(firstChar))
+        if (firstChar !== undefined && structural.test(firstChar) && !/\s/.test(firstChar)) {
             return true;
+        }
     }
     return false;
 }
+function isCodeAdjacent(candidate, context) {
+    if (!isAdjacentToCodeStructure(context))
+        return false;
+    if (qualifiesAsGenericHighEntropy(candidate))
+        return false;
+    return isIdentifierLike(candidate);
+}
 function isNumeric(candidate) {
     return /^\d+$/.test(candidate);
 }

package/dist/patterns.d.ts

@@ -5,5 +5,14 @@ export interface SecretPattern {
     confidence: 'high' | 'medium';
     label: string;
 }
+/** Registry patterns must be bounded before compilation (ReDoS guard). */
+export declare function isBoundedRegistryPattern(source: string): boolean;
+/**
+ * Skip compiling single-segment `[charset]{n,m}` patterns — they match git SHAs,
+ * UUID-shaped noise, and other corpus negatives. Patterns with literal structure
+ * outside char classes (Discord's dot-separated segments, Clerk's `sk_live_`, …)
+ * are specific enough to register as high-confidence detectors.
+ */
+export declare function isSpecificRegistryPattern(source: string): boolean;
 export declare function allPatterns(): SecretPattern[];
 //# sourceMappingURL=patterns.d.ts.map

package/dist/patterns.js

@@ -39,29 +39,116 @@ const HAND_PATTERNS = [
     { id: 'jwt', label: 'JWT token', source: `eyJ[A-Za-z0-9_\\-]+\\.[A-Za-z0-9_\\-]+\\.[A-Za-z0-9_\\-]+` },
     { id: 'conn-string', label: 'database connection string', source: `(?:postgres|postgresql|mysql|mongodb(?:\\+srv)?|redis|amqp)://[^:\\s/]+:[^@\\s]+@` },
 ];
+/** Registry patterns must be bounded before compilation (ReDoS guard). */
+export function isBoundedRegistryPattern(source) {
+    if (source.length >= 256)
+        return false;
+    if (/\([^)]*[+*][^)]*\)[+*]/.test(source))
+        return false;
+    if (!/\{\d+(?:,\d*)?\}/.test(source))
+        return false;
+    for (const match of source.matchAll(/\{(\d+)(?:,(\d*))?\}/g)) {
+        const low = Number(match[1]);
+        const high = match[2] === undefined || match[2] === '' ? low : Number(match[2]);
+        if (low > 256 || high > 256)
+            return false;
+    }
+    return true;
+}
+/**
+ * Skip compiling single-segment `[charset]{n,m}` patterns — they match git SHAs,
+ * UUID-shaped noise, and other corpus negatives. Patterns with literal structure
+ * outside char classes (Discord's dot-separated segments, Clerk's `sk_live_`, …)
+ * are specific enough to register as high-confidence detectors.
+ */
+export function isSpecificRegistryPattern(source) {
+    const body = stripPatternAnchors(source);
+    const withoutClasses = body.replace(/\[[^\]]*\]/g, '\0');
+    if (/[^\0\d{},+?*|\\]/.test(withoutClasses))
+        return true;
+    return (body.match(/\{\d+(?:,\d*)?\}/g) ?? []).length > 1;
+}
+function shouldUseRegistryPattern(entry) {
+    if (entry.pattern === undefined)
+        return false;
+    if (!isBoundedRegistryPattern(entry.pattern))
+        return false;
+    if (isUuidValidationPattern(entry.pattern))
+        return false;
+    return isSpecificRegistryPattern(entry.pattern);
+}
+function stripPatternAnchors(source) {
+    let body = source;
+    if (body.startsWith('^'))
+        body = body.slice(1);
+    if (body.endsWith('$'))
+        body = body.slice(0, -1);
+    return body;
+}
+function isUuidValidationPattern(source) {
+    const normalized = stripPatternAnchors(source)
+        .toLowerCase()
+        .replace(/\[[0-9a-f-]+\]/g, '[hex]');
+    return normalized === '[hex]{8}-[hex]{4}-[hex]{4}-[hex]{4}-[hex]{12}';
+}
+function withLeadingBoundary(source) {
+    return source.startsWith('(?') ? source : `(?<![A-Za-z0-9_-])${source}`;
+}
+function registryPatternToRegex(source) {
+    return new RegExp(withLeadingBoundary(stripPatternAnchors(source)), 'g');
+}
+function synthesizePrefixBody(pattern) {
+    if (pattern === undefined)
+        return '[A-Za-z0-9]{16,}';
+    if (/\[A-Za-z0-9_\\-]/.test(pattern) || /\[A-Za-z0-9_-]/.test(pattern)) {
+        return '[A-Za-z0-9_\\-]{16,}';
+    }
+    if (/\[A-Za-z0-9_]/.test(pattern))
+        return '[A-Za-z0-9_]{16,}';
+    return '[A-Za-z0-9]{16,}';
+}
+function registryEntryPattern(entry) {
+    const id = `registry:${entry.providerId}:${entry.envVar}`;
+    const label = `${entry.providerId} ${entry.envVar}`;
+    if (entry.pattern !== undefined && shouldUseRegistryPattern(entry)) {
+        try {
+            return {
+                id,
+                regex: registryPatternToRegex(entry.pattern),
+                providerId: entry.providerId,
+                confidence: 'high',
+                label,
+            };
+        }
+        catch {
+            // Fall through to prefix synthesis when compilation fails.
+        }
+    }
+    if (entry.prefix === undefined)
+        return null;
+    // Two guards, both load-bearing for registry-derived patterns synthesised
+    // from a bare prefix when no bounded pattern is available:
+    //
+    // 1. A leading boundary. Without it a short prefix matches mid-identifier —
+    //    Twilio's `AC` matched inside `REACT_APP_FEATURE_FLAG_ENABLED`, turning
+    //    an ordinary env-var name into a "high confidence" credential hit.
+    // 2. A body charset inferred from the registry pattern when present so keys
+    //    that allow `_` (Clerk `sk_test_…`) are not forced through `[A-Za-z0-9]`.
+    const body = synthesizePrefixBody(entry.pattern);
+    return {
+        id,
+        regex: new RegExp(`(?<![A-Za-z0-9_-])${escapeRegExp(entry.prefix)}${body}`, 'g'),
+        providerId: entry.providerId,
+        confidence: 'high',
+        label,
+    };
+}
 export function allPatterns() {
     const patterns = [];
     for (const entry of allPrefixPatterns()) {
-        if (entry.prefix === undefined) {
-            continue;
-        }
-        // Two guards, both load-bearing for registry-derived patterns, which are
-        // synthesised from a bare prefix and so are far weaker than the hand-written
-        // ones:
-        //
-        // 1. A leading boundary. Without it a short prefix matches mid-identifier —
-        //    Twilio's `AC` matched inside `REACT_APP_FEATURE_FLAG_ENABLED`, turning
-        //    an ordinary env-var name into a "high confidence" credential hit.
-        // 2. An alphanumeric-only body. Real key material is random alphanumerics;
-        //    SCREAMING_SNAKE identifiers are not. Excluding `_` and `-` from the body
-        //    stops the pattern from running through word separators.
-        patterns.push({
-            id: `registry:${entry.providerId}:${entry.envVar}`,
-            regex: new RegExp(`(?<![A-Za-z0-9_-])${escapeRegExp(entry.prefix)}[A-Za-z0-9]{16,}`, 'g'),
-            providerId: entry.providerId,
-            confidence: 'high',
-            label: `${entry.providerId} ${entry.envVar}`,
-        });
+        const compiled = registryEntryPattern(entry);
+        if (compiled !== null)
+            patterns.push(compiled);
     }
     for (const hp of HAND_PATTERNS) {
         patterns.push({

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@envseal/detector",
-  "version": "0.1.2",
+  "version": "0.1.4",
   "type": "module",
   "license": "Apache-2.0",
   "main": "./dist/index.js",
@@ -20,7 +20,7 @@
     "provenance": true
   },
   "dependencies": {
-    "@envseal/registry": "0.1.2"
+    "@envseal/registry": "0.1.4"
   },
   "repository": {
     "type": "git",