@envseal/detector 0.1.3 → 0.1.5

package/dist/exclusions.js

@@ -1,3 +1,4 @@
+import { charsetClasses, shannonEntropy } from './entropy.js';
 import { WORDLIST_LOWER } from './wordlist.js';
 const WORDLIST_SET = new Set(WORDLIST_LOWER.trim().split('\n'));
 export function exclusionReason(candidate, context) {
@@ -55,6 +56,8 @@ export function isExcluded(candidate, context) {
  * never consults the exclusion list.
  */
 const MIN_GENERIC_LENGTH = 24;
+const MIN_ENTROPY = 3.5;
+const MIN_CHARSET_CLASSES = 2;
 function isNonSecretAssignment(candidate) {
     const match = /^[A-Z][A-Z0-9_]{2,}=(.*)$/.exec(candidate);
     if (match === null)
@@ -119,9 +122,16 @@ function isDataUri(candidate, context) {
         }
         return true;
     }
-    return /data:[a-z0-9.+-]+\/[a-z0-9.+-]+(;[a-z0-9-]+=[a-z0-9-]+)*;base64,[A-Za-z0-9+/=]+$/.test(context.before);
+    return /data:[a-z0-9.+-]+\/[a-z0-9.+-]+(;[a-z0-9-]+=[a-z0-9-]+)*;base64,[A-Za-z0-9+/=]+$/.test(context.before) || ((context.before.endsWith(';base64,') || context.before.endsWith('base64,')) &&
+        /^[A-Za-z0-9+/=]*$/.test(candidate) &&
+        candidate.length % 4 === 0 &&
+        candidate.length > 0);
 }
 function isFilesystemPath(candidate) {
+    if (/^\([^)]*[/\\][^)]*\)$/.test(candidate))
+        return true;
+    if (/\/[a-zA-Z0-9_./-]+:\d+(?::\d+)?$/.test(candidate))
+        return true;
     const hasPathSep = candidate.includes('/') || candidate.includes(String.fromCharCode(92));
     if (!hasPathSep)
         return false;
@@ -138,6 +148,9 @@ function isFilesystemPath(candidate) {
     return pathlike;
 }
 function isPlainUrl(candidate) {
+    if (/^(?:postgres|postgresql|mysql|mongodb(?:\+srv)?|redis|amqp):\/\/[^@\s]+/i.test(candidate) && !candidate.includes('@')) {
+        return true;
+    }
     try {
         const url = new URL(candidate);
         if (url.protocol !== 'http:' && url.protocol !== 'https:') {
@@ -190,20 +203,58 @@ function splitOnBoundaries(candidate) {
     });
     return result.filter((s) => s.length > 0);
 }
-function isCodeAdjacent(candidate, context) {
-    const codeChars = /[{}();,:]/;
+/**
+ * High-entropy `[A-Za-z0-9]{32,}` blobs in JSON/JS (`{"key":"<secret>"}` or
+ * `{secret:<value>}`) are credentials, not identifier tokens. The generic
+ * scanner uses the same entropy/charset gates.
+ */
+function qualifiesAsGenericHighEntropy(candidate) {
+    if (!/^[A-Za-z0-9]{32,}$/.test(candidate))
+        return false;
+    if (isIdentifierLike(candidate))
+        return false;
+    if (shannonEntropy(candidate) < MIN_ENTROPY)
+        return false;
+    if (charsetClasses(candidate) < MIN_CHARSET_CLASSES)
+        return false;
+    return true;
+}
+function isIdentifierLike(candidate) {
+    if (candidate.startsWith('$'))
+        return true;
+    if (isDictionaryText(candidate))
+        return true;
+    // Digits in a token point at key material, not a source-code identifier.
+    if (/\d/.test(candidate))
+        return false;
+    if (/^[a-z_$][\w$]*$/i.test(candidate) && /[a-z][A-Z]|[A-Z][a-z]|_/.test(candidate)) {
+        return true;
+    }
+    return /^[a-z][a-z0-9]*(_[a-z0-9]+)+$/i.test(candidate);
+}
+function isAdjacentToCodeStructure(context) {
+    const structural = /[{}(),:]/;
     if (context.before.length > 0) {
         const lastChar = context.before.at(-1);
-        if (lastChar !== undefined && codeChars.test(lastChar) && !/\s/.test(lastChar))
+        if (lastChar !== undefined && structural.test(lastChar) && !/\s/.test(lastChar)) {
             return true;
+        }
     }
     if (context.after.length > 0) {
         const firstChar = context.after.at(0);
-        if (firstChar !== undefined && codeChars.test(firstChar) && !/\s/.test(firstChar))
+        if (firstChar !== undefined && structural.test(firstChar) && !/\s/.test(firstChar)) {
             return true;
+        }
     }
     return false;
 }
+function isCodeAdjacent(candidate, context) {
+    if (!isAdjacentToCodeStructure(context))
+        return false;
+    if (qualifiesAsGenericHighEntropy(candidate))
+        return false;
+    return isIdentifierLike(candidate);
+}
 function isNumeric(candidate) {
     return /^\d+$/.test(candidate);
 }

package/dist/patterns.d.ts

@@ -5,5 +5,14 @@ export interface SecretPattern {
     confidence: 'high' | 'medium';
     label: string;
 }
+/** Registry patterns must be bounded before compilation (ReDoS guard). */
+export declare function isBoundedRegistryPattern(source: string): boolean;
+/**
+ * Skip compiling single-segment `[charset]{n,m}` patterns — they match git SHAs,
+ * UUID-shaped noise, and other corpus negatives. Patterns with literal structure
+ * outside char classes (Discord's dot-separated segments, Clerk's `sk_live_`, …)
+ * are specific enough to register as high-confidence detectors.
+ */
+export declare function isSpecificRegistryPattern(source: string): boolean;
 export declare function allPatterns(): SecretPattern[];
 //# sourceMappingURL=patterns.d.ts.map

package/dist/patterns.js

@@ -39,29 +39,116 @@ const HAND_PATTERNS = [
     { id: 'jwt', label: 'JWT token', source: `eyJ[A-Za-z0-9_\\-]+\\.[A-Za-z0-9_\\-]+\\.[A-Za-z0-9_\\-]+` },
     { id: 'conn-string', label: 'database connection string', source: `(?:postgres|postgresql|mysql|mongodb(?:\\+srv)?|redis|amqp)://[^:\\s/]+:[^@\\s]+@` },
 ];
+/** Registry patterns must be bounded before compilation (ReDoS guard). */
+export function isBoundedRegistryPattern(source) {
+    if (source.length >= 256)
+        return false;
+    if (/\([^)]*[+*][^)]*\)[+*]/.test(source))
+        return false;
+    if (!/\{\d+(?:,\d*)?\}/.test(source))
+        return false;
+    for (const match of source.matchAll(/\{(\d+)(?:,(\d*))?\}/g)) {
+        const low = Number(match[1]);
+        const high = match[2] === undefined || match[2] === '' ? low : Number(match[2]);
+        if (low > 256 || high > 256)
+            return false;
+    }
+    return true;
+}
+/**
+ * Skip compiling single-segment `[charset]{n,m}` patterns — they match git SHAs,
+ * UUID-shaped noise, and other corpus negatives. Patterns with literal structure
+ * outside char classes (Discord's dot-separated segments, Clerk's `sk_live_`, …)
+ * are specific enough to register as high-confidence detectors.
+ */
+export function isSpecificRegistryPattern(source) {
+    const body = stripPatternAnchors(source);
+    const withoutClasses = body.replace(/\[[^\]]*\]/g, '\0');
+    if (/[^\0\d{},+?*|\\]/.test(withoutClasses))
+        return true;
+    return (body.match(/\{\d+(?:,\d*)?\}/g) ?? []).length > 1;
+}
+function shouldUseRegistryPattern(entry) {
+    if (entry.pattern === undefined)
+        return false;
+    if (!isBoundedRegistryPattern(entry.pattern))
+        return false;
+    if (isUuidValidationPattern(entry.pattern))
+        return false;
+    return isSpecificRegistryPattern(entry.pattern);
+}
+function stripPatternAnchors(source) {
+    let body = source;
+    if (body.startsWith('^'))
+        body = body.slice(1);
+    if (body.endsWith('$'))
+        body = body.slice(0, -1);
+    return body;
+}
+function isUuidValidationPattern(source) {
+    const normalized = stripPatternAnchors(source)
+        .toLowerCase()
+        .replace(/\[[0-9a-f-]+\]/g, '[hex]');
+    return normalized === '[hex]{8}-[hex]{4}-[hex]{4}-[hex]{4}-[hex]{12}';
+}
+function withLeadingBoundary(source) {
+    return source.startsWith('(?') ? source : `(?<![A-Za-z0-9_-])${source}`;
+}
+function registryPatternToRegex(source) {
+    return new RegExp(withLeadingBoundary(stripPatternAnchors(source)), 'g');
+}
+function synthesizePrefixBody(pattern) {
+    if (pattern === undefined)
+        return '[A-Za-z0-9]{16,}';
+    if (/\[A-Za-z0-9_\\-]/.test(pattern) || /\[A-Za-z0-9_-]/.test(pattern)) {
+        return '[A-Za-z0-9_\\-]{16,}';
+    }
+    if (/\[A-Za-z0-9_]/.test(pattern))
+        return '[A-Za-z0-9_]{16,}';
+    return '[A-Za-z0-9]{16,}';
+}
+function registryEntryPattern(entry) {
+    const id = `registry:${entry.providerId}:${entry.envVar}`;
+    const label = `${entry.providerId} ${entry.envVar}`;
+    if (entry.pattern !== undefined && shouldUseRegistryPattern(entry)) {
+        try {
+            return {
+                id,
+                regex: registryPatternToRegex(entry.pattern),
+                providerId: entry.providerId,
+                confidence: 'high',
+                label,
+            };
+        }
+        catch {
+            // Fall through to prefix synthesis when compilation fails.
+        }
+    }
+    if (entry.prefix === undefined)
+        return null;
+    // Two guards, both load-bearing for registry-derived patterns synthesised
+    // from a bare prefix when no bounded pattern is available:
+    //
+    // 1. A leading boundary. Without it a short prefix matches mid-identifier —
+    //    Twilio's `AC` matched inside `REACT_APP_FEATURE_FLAG_ENABLED`, turning
+    //    an ordinary env-var name into a "high confidence" credential hit.
+    // 2. A body charset inferred from the registry pattern when present so keys
+    //    that allow `_` (Clerk `sk_test_…`) are not forced through `[A-Za-z0-9]`.
+    const body = synthesizePrefixBody(entry.pattern);
+    return {
+        id,
+        regex: new RegExp(`(?<![A-Za-z0-9_-])${escapeRegExp(entry.prefix)}${body}`, 'g'),
+        providerId: entry.providerId,
+        confidence: 'high',
+        label,
+    };
+}
 export function allPatterns() {
     const patterns = [];
     for (const entry of allPrefixPatterns()) {
-        if (entry.prefix === undefined) {
-            continue;
-        }
-        // Two guards, both load-bearing for registry-derived patterns, which are
-        // synthesised from a bare prefix and so are far weaker than the hand-written
-        // ones:
-        //
-        // 1. A leading boundary. Without it a short prefix matches mid-identifier —
-        //    Twilio's `AC` matched inside `REACT_APP_FEATURE_FLAG_ENABLED`, turning
-        //    an ordinary env-var name into a "high confidence" credential hit.
-        // 2. An alphanumeric-only body. Real key material is random alphanumerics;
-        //    SCREAMING_SNAKE identifiers are not. Excluding `_` and `-` from the body
-        //    stops the pattern from running through word separators.
-        patterns.push({
-            id: `registry:${entry.providerId}:${entry.envVar}`,
-            regex: new RegExp(`(?<![A-Za-z0-9_-])${escapeRegExp(entry.prefix)}[A-Za-z0-9]{16,}`, 'g'),
-            providerId: entry.providerId,
-            confidence: 'high',
-            label: `${entry.providerId} ${entry.envVar}`,
-        });
+        const compiled = registryEntryPattern(entry);
+        if (compiled !== null)
+            patterns.push(compiled);
     }
     for (const hp of HAND_PATTERNS) {
         patterns.push({

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@envseal/detector",
-  "version": "0.1.3",
+  "version": "0.1.5",
   "type": "module",
   "license": "Apache-2.0",
   "main": "./dist/index.js",
@@ -20,7 +20,7 @@
     "provenance": true
   },
   "dependencies": {
-    "@envseal/registry": "0.1.3"
+    "@envseal/registry": "0.1.5"
   },
   "repository": {
     "type": "git",