@frockbot/secret-shapes 0.3.3 → 0.3.5
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/package.json +1 -1
- package/src/index.ts +18 -1
package/package.json
CHANGED
package/src/index.ts
CHANGED
|
@@ -78,8 +78,25 @@ export const SECRET_SHAPES_V1: readonly SecretShapeV1[] = [
|
|
|
78
78
|
{
|
|
79
79
|
id: "credential-assignment",
|
|
80
80
|
reason: "it assigns a value to a credential-shaped name",
|
|
81
|
+
// The keyword is NOT anchored on `\b`, because `_` is a word character:
|
|
82
|
+
// `\bsecret\b` does not match inside `AWS_SECRET_ACCESS_KEY`, so
|
|
83
|
+
// `AWS_SECRET_ACCESS_KEY=…`, `GITHUB_TOKEN=…` and `MYSQL_PASSWORD=…`
|
|
84
|
+
// landed verbatim in the durable audit preview — the exact shape a leased
|
|
85
|
+
// credential takes in a `computer_exec` command. The name is matched
|
|
86
|
+
// whole, keyword anywhere inside it.
|
|
81
87
|
pattern:
|
|
82
|
-
|
|
88
|
+
/(?<![A-Za-z0-9])[A-Za-z0-9_-]{0,64}(?:api[_-]?key|secret|password|passwd|token|credential|passphrase)[A-Za-z0-9_-]{0,64}\s*[:=]\s*\S{8,}/gi,
|
|
89
|
+
},
|
|
90
|
+
{
|
|
91
|
+
id: "url-credentials",
|
|
92
|
+
reason: "it contains credentials in a URL",
|
|
93
|
+
pattern: /\b[a-zA-Z][a-zA-Z0-9+.-]*:\/\/[^\s/@:]+:[^\s/@]+@/g,
|
|
94
|
+
},
|
|
95
|
+
{
|
|
96
|
+
id: "url-secret-parameter",
|
|
97
|
+
reason: "it contains a secret in a URL parameter",
|
|
98
|
+
pattern:
|
|
99
|
+
/[?&](?:token|code|sig|signature|key|api[_-]?key|access[_-]?token|refresh[_-]?token|password|secret|auth)=[^\s&#]{6,}/gi,
|
|
83
100
|
},
|
|
84
101
|
];
|
|
85
102
|
|