@futdevpro/fsm-dynamo 1.16.27 → 1.16.28
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/__documentations/2026-06-05-secret-mask-url-cred-any-scheme.md +37 -0
- package/build/_collections/utils/secret-mask.util.d.ts.map +1 -1
- package/build/_collections/utils/secret-mask.util.js +6 -2
- package/build/_collections/utils/secret-mask.util.js.map +1 -1
- package/package.json +1 -1
- package/src/_collections/utils/secret-mask.util.spec.ts +66 -0
- package/src/_collections/utils/secret-mask.util.ts +6 -2
|
@@ -0,0 +1,37 @@
|
|
|
1
|
+
# 2026-06-05 — DyFM_SecretMask: url-cred pattern BARMELY scheme-re (+ elso spec)
|
|
2
|
+
|
|
3
|
+
## Problema
|
|
4
|
+
|
|
5
|
+
A `DyFM_SECRET_PATTERNS` `url-cred` pattern-je CSAK `http(s)://user:pass@`-t fogott
|
|
6
|
+
(`/\b(https?:\/\/)([^/\s:@]+):([^\s@]+)@/g`). A `mongodb://user:pass@host` / `postgres://` /
|
|
7
|
+
`redis://` connection-string jelszo — a leggyakoribb DB-secret-leak vektor a CI-logokban, es
|
|
8
|
+
az FDP-stack MongoDB-t hasznal — NEM maszkolodott (runtime-igazolt gap a `fdp pipeline` secret-
|
|
9
|
+
maszkolas bekotesekor).
|
|
10
|
+
|
|
11
|
+
## Fix
|
|
12
|
+
|
|
13
|
+
- A scheme kiszelesitve BARMELY URL-protokollra: `https?` → `[a-z][a-z0-9+.-]*` + `i` flag.
|
|
14
|
+
- A user-resz `+` → `*` (ures user is): a `redis://:password@host` (username nelkuli, csak jelszo)
|
|
15
|
+
valos redis/DB auth-format.
|
|
16
|
+
- A `user:pass@` szerkezet KOTELEZO marad → nincs false-positive: sima URL (`https://h:8080/path`,
|
|
17
|
+
port-tal, de `@` nelkul) NEM matchel; a `mongodb://db:27017/app` (nincs cred) NEM matchel.
|
|
18
|
+
- A `$1` (scheme) + host megorzodik: `mongodb://[redacted-url-cred]@db:27017/app`.
|
|
19
|
+
|
|
20
|
+
Uj regex: `/\b([a-z][a-z0-9+.-]*:\/\/)([^/\s:@]*):([^\s@]+)@/gi`
|
|
21
|
+
|
|
22
|
+
## Test (uj — eddig NEM volt spec a maskerhez)
|
|
23
|
+
|
|
24
|
+
Uj `secret-mask.util.spec.ts` (16 assert):
|
|
25
|
+
- url-cred: http/https/mongodb/postgres/redis + case-insensitive + ures-user;
|
|
26
|
+
no-false-positive (port / cred-less URL);
|
|
27
|
+
- token-regresszio: github-pat + env-style-secret;
|
|
28
|
+
- non-secret: commit-SHA + verzio erintetlen;
|
|
29
|
+
- `DyFM_maskSecretsDeep`: rekurziv string-maszkolas + strukturа-megorzes.
|
|
30
|
+
|
|
31
|
+
`npx tsc` (exit 0) + `npx jasmine`: **1443 specs, 0 failures**, 72 pending.
|
|
32
|
+
|
|
33
|
+
## Consumer
|
|
34
|
+
|
|
35
|
+
Az `fdp-cli` (`pipeline-notify` Discord + `pipeline-report` Overseer-POST) mar hasznalja a
|
|
36
|
+
`DyFM_maskSecrets`/`DyFM_maskSecretsDeep`-et; a broadened url-cred a kovetkezo fsm-dynamo
|
|
37
|
+
dep-bump utan lep eletbe a fleeten (nem fleet-bump-olunk kezzel).
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"secret-mask.util.d.ts","sourceRoot":"","sources":["../../../src/_collections/utils/secret-mask.util.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AAEH,MAAM,WAAW,uCAAuC;IACtD,2DAA2D;IAC3D,MAAM,EAAE,MAAM,CAAC;IACf,6DAA6D;IAC7D,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,kCAAkC;IACjD;;;OAGG;IACH,aAAa,EAAE,uCAAuC,CAAC;IAEvD;;;OAGG;IACH,iBAAiB,EAAE,MAAM,CAAC;IAE1B;;;OAGG;IACH,eAAe,EAAE,MAAM,CAAC;CACzB;AAED,eAAO,MAAM,iCAAiC,EAAE,kCAO/C,CAAC;AAEF,UAAU,uBAAuB;IAC/B,2DAA2D;IAC3D,IAAI,EAAE,MAAM,CAAC;IACb,uFAAuF;IACvF,KAAK,EAAE,MAAM,CAAC;IACd;;;OAGG;IACH,UAAU,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,kCAAkC,KAAK,MAAM,CAAC;IACvF;;;;OAIG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAsBD,eAAO,MAAM,oBAAoB,EAAE,uBAAuB,
|
|
1
|
+
{"version":3,"file":"secret-mask.util.d.ts","sourceRoot":"","sources":["../../../src/_collections/utils/secret-mask.util.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AAEH,MAAM,WAAW,uCAAuC;IACtD,2DAA2D;IAC3D,MAAM,EAAE,MAAM,CAAC;IACf,6DAA6D;IAC7D,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,kCAAkC;IACjD;;;OAGG;IACH,aAAa,EAAE,uCAAuC,CAAC;IAEvD;;;OAGG;IACH,iBAAiB,EAAE,MAAM,CAAC;IAE1B;;;OAGG;IACH,eAAe,EAAE,MAAM,CAAC;CACzB;AAED,eAAO,MAAM,iCAAiC,EAAE,kCAO/C,CAAC;AAEF,UAAU,uBAAuB;IAC/B,2DAA2D;IAC3D,IAAI,EAAE,MAAM,CAAC;IACb,uFAAuF;IACvF,KAAK,EAAE,MAAM,CAAC;IACd;;;OAGG;IACH,UAAU,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,kCAAkC,KAAK,MAAM,CAAC;IACvF;;;;OAIG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAsBD,eAAO,MAAM,oBAAoB,EAAE,uBAAuB,EAgEzD,CAAC;AAuBF;;;;;;GAMG;AACH,wBAAgB,gBAAgB,CAC9B,IAAI,EAAE,OAAO,EACb,QAAQ,GAAE,kCAAsE,GAC/E,MAAM,CAiCR;AAED;;;;GAIG;AACH,wBAAgB,oBAAoB,CAAC,CAAC,GAAG,OAAO,EAC9C,KAAK,EAAE,CAAC,EACR,QAAQ,GAAE,kCAAsE,GAC/E,CAAC,CAcH"}
|
|
@@ -59,10 +59,14 @@ const defaultRevealReplacement = (matched, kind, settings) => {
|
|
|
59
59
|
return `${head}...${tail} [redacted-${kind}]`;
|
|
60
60
|
};
|
|
61
61
|
exports.DyFM_SECRET_PATTERNS = [
|
|
62
|
-
// URL-embedded basic auth —
|
|
62
|
+
// URL-embedded basic auth — BARMELY scheme (`http(s)`, `mongodb`, `postgres`, `redis`,
|
|
63
|
+
// `amqp`, `mysql` stb.), nem csak http: a `mongodb://user:pass@host` connection-string a
|
|
64
|
+
// leggyakoribb DB-secret-leak vektor a CI-logokban. A `user:pass@` szerkezet kotelezo →
|
|
65
|
+
// nincs false-positive a sima URL-ekre (port `host:8080/` sem, mert nincs utana `@`).
|
|
66
|
+
// A sajat replace-pattern megorzi a scheme-et ($1) + host-ot.
|
|
63
67
|
{
|
|
64
68
|
kind: 'url-cred',
|
|
65
|
-
regex: /\b(
|
|
69
|
+
regex: /\b([a-z][a-z0-9+.-]*:\/\/)([^/\s:@]*):([^\s@]+)@/gi,
|
|
66
70
|
redactWith: (_m) => '$1[redacted-url-cred]@',
|
|
67
71
|
},
|
|
68
72
|
// GitHub PATs
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"secret-mask.util.js","sourceRoot":"","sources":["../../../src/_collections/utils/secret-mask.util.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;;;
|
|
1
|
+
{"version":3,"file":"secret-mask.util.js","sourceRoot":"","sources":["../../../src/_collections/utils/secret-mask.util.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;;;AA0KH,4CAoCC;AAOD,oDAiBC;AAzMY,QAAA,iCAAiC,GAAuC;IACnF,aAAa,EAAE;QACb,MAAM,EAAE,CAAC;QACT,MAAM,EAAE,CAAC;KACV;IACD,iBAAiB,EAAE,CAAC;IACpB,eAAe,EAAG,wFAAwF;CAC3G,CAAC;AAoBF,MAAM,wBAAwB,GAAG,CAC/B,OAAe,EACf,IAAY,EACZ,QAA4C,EACpC,EAAE;IACV,MAAM,CAAC,GAAW,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,QAAQ,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC;IAC7D,MAAM,CAAC,GAAW,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,QAAQ,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC;IAC7D,wEAAwE;IACxE,uDAAuD;IACvD,IAAI,OAAO,CAAC,MAAM,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;QAChC,OAAO,aAAa,IAAI,GAAG,CAAC;IAC9B,CAAC;IACD,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QACvB,OAAO,aAAa,IAAI,GAAG,CAAC;IAC9B,CAAC;IACD,MAAM,IAAI,GAAW,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IACzC,MAAM,IAAI,GAAW,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IACvD,OAAO,GAAG,IAAI,MAAM,IAAI,cAAc,IAAI,GAAG,CAAC;AAChD,CAAC,CAAC;AAEW,QAAA,oBAAoB,GAA8B;IAC7D,uFAAuF;IACvF,yFAAyF;IACzF,wFAAwF;IACxF,sFAAsF;IACtF,8DAA8D;IAC9D;QACE,IAAI,EAAS,UAAU;QACvB,KAAK,EAAQ,oDAAoD;QACjE,UAAU,EAAG,CAAC,EAAU,EAAU,EAAE,CAAC,wBAAwB;KAC9D;IACD,cAAc;IACd,EAAE,IAAI,EAAE,YAAY,EAAE,KAAK,EAAE,8BAA8B,EAAE;IAC7D,EAAE,IAAI,EAAE,iBAAiB,EAAE,KAAK,EAAE,mCAAmC,EAAE;IACvE,EAAE,IAAI,EAAE,cAAc,EAAE,KAAK,EAAE,2BAA2B,EAAE;IAC5D,EAAE,IAAI,EAAE,gBAAgB,EAAE,KAAK,EAAE,2BAA2B,EAAE;IAC9D,YAAY;IACZ,EAAE,IAAI,EAAE,WAAW,EAAE,KAAK,EAAE,2BAA2B,EAAE;IACzD,iBAAiB;IACjB,EAAE,IAAI,EAAE,YAAY,EAAE,KAAK,EAAE,mCAAmC,EAAE;IAClE,cAAc;IACd,EAAE,IAAI,EAAE,aAAa,EAAE,KAAK,EAAE,mCAAmC,EAAE;IACnE,uEAAuE;IACvE,EAAE,IAAI,EAAE,eAAe,EAAE,KAAK,EAAE,iCAAiC,EAAE;IACnE,8BAA8B;IAC9B,EAAE,IAAI,EAAE,YAAY,EAAE,KAAK,EAAE,0BAA0B,EAAE;IACzD,iBAAiB;IACjB,EAAE,IAAI,EAAE,gBAAgB,EAAE,KAAK,EAAE,6BAA6B,EAAE;IAChE,0CAA0C;IAC1C;QACE,IAAI,EAAQ,iBAAiB;QAC7B,KAAK,EAAO,6FAA6F;QACzG,UAAU,EAAE,CAAC,EAAU,EAAU,EAAE,CAAC,4BAA4B;KACjE;IACD,iHAAiH;IACjH;QACE,IAAI,EAAQ,cAAc;QAC1B,KAAK,EAAO,2CAA2C;QACvD,UAAU,EAAE,CAAC,OAAe,EAAE,QAA4C,EAAU,EAAE;YACpF,MAAM,UAAU,GAAW,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YACjD,MAAM,MAAM,GAAW,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,UAAU,GAAG,CAAC,CAAC,CAAC,CAAC,YAAY;YACrE,MAAM,KAAK,GAAW,OAAO,CAAC,KAAK,CAAC,UAAU,GAAG,CAAC,CAAC,CAAC;YACpD,OAAO,MAAM,GAAG,wBAAwB,CAAC,KAAK,EAAE,OAAO,EAAE,QAAQ,CAAC,CAAC;QACrE,CAAC;KACF;IACD,sBAAsB;IACtB,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,uEAAuE,EAAE;IAC/F,iBAAiB;IACjB,EAAE,IAAI,EAAE,gBAAgB,EAAE,KAAK,EAAE,uBAAuB,EAAE;IAC1D,gCAAgC;IAChC;QACE,IAAI,EAAQ,kBAAkB;QAC9B,KAAK,EAAO,wHAAwH;QACpI,UAAU,EAAE,CAAC,OAAe,EAAE,QAA4C,EAAU,EAAE;YACpF,+FAA+F;YAC/F,MAAM,CAAC,GAA4B,OAAO,CAAC,KAAK,CAAC,kHAAkH,CAAC,CAAC;YACrK,IAAI,CAAC,CAAC,EAAE,CAAC;gBAAC,OAAO,OAAO,CAAC;YAAC,CAAC;YAC3B,MAAM,OAAO,GAAW,CAAC,CAAC,CAAC,CAAC,CAAC;YAC7B,MAAM,KAAK,GAAW,CAAC,CAAC,CAAC,CAAC,CAAC;YAC3B,MAAM,GAAG,GAAW,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC;YACvD,MAAM,QAAQ,GAAW,wBAAwB,CAAC,KAAK,EAAE,WAAW,EAAE,QAAQ,CAAC,CAAC;YAChF,OAAO,GAAG,OAAO,GAAG,GAAG,GAAG,QAAQ,EAAE,CAAC;QACvC,CAAC;KACF;CACF,CAAC;AAEF;;;;GAIG;AACH,MAAM,sBAAsB,GAAG,CAC7B,QAA4C,EACV,EAAE;IACpC,MAAM,GAAG,GAAqC,EAAE,CAAC;IACjD,KAAK,MAAM,CAAC,GAAG,EAAE,GAAG,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;QACrD,IAAI,CAAC,GAAG,IAAI,GAAG,CAAC,MAAM,GAAG,QAAQ,CAAC,iBAAiB,EAAE,CAAC;YAAC,SAAS;QAAC,CAAC;QAClE,IAAI,CAAC,QAAQ,CAAC,eAAe,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;YAAC,SAAS;QAAC,CAAC;QACtD,IAAI,qBAAqB,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;YAAC,SAAS;QAAC,CAAC;QAClD,GAAG,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC,CAAC;IACrC,CAAC;IACD,yEAAyE;IACzE,gDAAgD;IAChD,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAU,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IAC5D,OAAO,GAAG,CAAC;AACb,CAAC,CAAC;AAEF;;;;;;GAMG;AACH,SAAgB,gBAAgB,CAC9B,IAAa,EACb,WAA+C,yCAAiC;IAEhF,IAAI,IAAI,KAAK,IAAI,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;QAAC,OAAO,EAAE,CAAC;IAAC,CAAC;IACvD,IAAI,GAAW,CAAC;IAChB,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE,CAAC;QAC7B,GAAG,GAAG,IAAI,CAAC;IACb,CAAC;SAAM,CAAC;QACN,IAAI,CAAC;YAAC,GAAG,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;QAAC,CAAC;QACnC,MAAM,CAAC;YAAC,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC;QAAC,CAAC;IAC/B,CAAC;IAED,6BAA6B;IAC7B,KAAK,MAAM,CAAC,IAAI,4BAAoB,EAAE,CAAC;QACrC,GAAG,GAAG,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC,OAAe,EAAE,GAAG,MAAgB,EAAU,EAAE;YAC1E,gEAAgE;YAChE,IAAI,CAAC,CAAC,UAAU,EAAE,CAAC;gBACjB,OAAO,CAAC,CAAC,UAAU,CAAC,OAAO,EAAE,QAAQ,CAAC;qBACnC,OAAO,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;qBAChC,OAAO,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;YACtC,CAAC;YACD,oCAAoC;YACpC,OAAO,wBAAwB,CAAC,OAAO,EAAE,CAAC,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;QAC7D,CAAC,CAAC,CAAC;IACL,CAAC;IAED,oCAAoC;IACpC,MAAM,UAAU,GAAqC,sBAAsB,CAAC,QAAQ,CAAC,CAAC;IACtF,KAAK,MAAM,EAAE,KAAK,EAAE,GAAG,EAAE,IAAI,UAAU,EAAE,CAAC;QACxC,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;YAAC,SAAS;QAAC,CAAC;QACvC,MAAM,QAAQ,GAAW,wBAAwB,CAAC,KAAK,EAAE,OAAO,GAAG,EAAE,EAAE,QAAQ,CAAC,CAAC;QACjF,GAAG,GAAG,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IACxC,CAAC;IAED,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;;GAIG;AACH,SAAgB,oBAAoB,CAClC,KAAQ,EACR,WAA+C,yCAAiC;IAEhF,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QAAC,OAAO,KAAK,CAAC;IAAC,CAAC;IAC5D,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC9B,OAAO,gBAAgB,CAAC,KAAK,EAAE,QAAQ,CAAiB,CAAC;IAC3D,CAAC;IACD,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAAC,OAAO,KAAK,CAAC;IAAC,CAAC;IAChD,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACzB,OAAQ,KAAmB,CAAC,GAAG,CAAC,CAAC,EAAW,EAAW,EAAE,CAAC,oBAAoB,CAAC,EAAE,EAAE,QAAQ,CAAC,CAAiB,CAAC;IAChH,CAAC;IACD,MAAM,GAAG,GAA4B,EAAE,CAAC;IACxC,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAgC,CAAC,EAAE,CAAC;QACtE,GAAG,CAAC,CAAC,CAAC,GAAG,oBAAoB,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC;IAC7C,CAAC;IACD,OAAO,GAAmB,CAAC;AAC7B,CAAC"}
|
package/package.json
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "@futdevpro/fsm-dynamo",
|
|
3
|
-
"version": "01.16.
|
|
3
|
+
"version": "01.16.28",
|
|
4
4
|
"description": "Full Stack Model Collection for Dynamic (NodeJS-Typescript) Framework called Dynamo, by Future Development Ltd.",
|
|
5
5
|
"DyBu_settings": {
|
|
6
6
|
"packageType": "full-stack-package",
|
|
@@ -0,0 +1,66 @@
|
|
|
1
|
+
import { DyFM_maskSecrets, DyFM_maskSecretsDeep } from './secret-mask.util';
|
|
2
|
+
|
|
3
|
+
/**
|
|
4
|
+
* Spec: `DyFM_SecretMask_Util` (FR-093) — secret/kulcs redaction.
|
|
5
|
+
* Fokusz: az `url-cred` pattern BARMELY scheme-et fogja (nem csak http), es a nem-secret
|
|
6
|
+
* tartalom (commit-SHA / verzio / sima URL) valtozatlan marad.
|
|
7
|
+
*/
|
|
8
|
+
describe('| DyFM_maskSecrets — url-cred (any scheme)', () => {
|
|
9
|
+
|
|
10
|
+
it('| masks http(s) basic-auth creds (keeps scheme + host)', () => {
|
|
11
|
+
expect(DyFM_maskSecrets('https://user:p4ssw0rd123@api.example.com'))
|
|
12
|
+
.toBe('https://[redacted-url-cred]@api.example.com');
|
|
13
|
+
});
|
|
14
|
+
|
|
15
|
+
it('| masks mongodb / postgres / redis connection-string creds', () => {
|
|
16
|
+
expect(DyFM_maskSecrets('mongodb://admin:supersecretpw@db:27017/app'))
|
|
17
|
+
.toBe('mongodb://[redacted-url-cred]@db:27017/app');
|
|
18
|
+
expect(DyFM_maskSecrets('postgres://u:pw123456@h/db')).toContain('postgres://[redacted-url-cred]@');
|
|
19
|
+
expect(DyFM_maskSecrets('redis://:authpass99@cache:6379')).toContain('redis://[redacted-url-cred]@');
|
|
20
|
+
expect(DyFM_maskSecrets('mongodb://admin:supersecretpw@db:27017/app')).not.toContain('supersecretpw');
|
|
21
|
+
});
|
|
22
|
+
|
|
23
|
+
it('| is case-insensitive on the scheme', () => {
|
|
24
|
+
expect(DyFM_maskSecrets('MONGODB://a:secretval1@h')).toContain('[redacted-url-cred]');
|
|
25
|
+
});
|
|
26
|
+
|
|
27
|
+
it('| does NOT touch credential-less URLs (port is not a false positive)', () => {
|
|
28
|
+
expect(DyFM_maskSecrets('https://example.com:8080/path')).toBe('https://example.com:8080/path');
|
|
29
|
+
expect(DyFM_maskSecrets('mongodb://db:27017/app')).toBe('mongodb://db:27017/app');
|
|
30
|
+
});
|
|
31
|
+
});
|
|
32
|
+
|
|
33
|
+
describe('| DyFM_maskSecrets — token patterns (regression)', () => {
|
|
34
|
+
|
|
35
|
+
it('| masks a github PAT', () => {
|
|
36
|
+
const out: string = DyFM_maskSecrets('token ghp_0123456789abcdef0123456789abcdef0123 here');
|
|
37
|
+
expect(out).toContain('[redacted-github-pat]');
|
|
38
|
+
expect(out).not.toContain('ghp_0123456789abcdef0123456789abcdef0123');
|
|
39
|
+
});
|
|
40
|
+
|
|
41
|
+
it('| masks an env-style secret assignment', () => {
|
|
42
|
+
expect(DyFM_maskSecrets('GITHUB_TOKEN=ghp_0123456789abcdef0123456789abcdef0123')).toContain('[redacted');
|
|
43
|
+
});
|
|
44
|
+
});
|
|
45
|
+
|
|
46
|
+
describe('| DyFM_maskSecrets — non-secrets are untouched', () => {
|
|
47
|
+
|
|
48
|
+
it('| leaves a commit SHA and a version untouched', () => {
|
|
49
|
+
expect(DyFM_maskSecrets('a1b2c3d4e5f6a1b2c3d4e5f6a1b2c3d4e5f6a1b2')).toBe('a1b2c3d4e5f6a1b2c3d4e5f6a1b2c3d4e5f6a1b2');
|
|
50
|
+
expect(DyFM_maskSecrets('v01.15.204')).toBe('v01.15.204');
|
|
51
|
+
});
|
|
52
|
+
});
|
|
53
|
+
|
|
54
|
+
describe('| DyFM_maskSecretsDeep', () => {
|
|
55
|
+
|
|
56
|
+
it('| masks string values recursively, leaves non-secret structure intact', () => {
|
|
57
|
+
const out = DyFM_maskSecretsDeep({
|
|
58
|
+
steps: { deploy: { errors: [{ text: 'mongodb://admin:supersecretpw@db:27017' }] } },
|
|
59
|
+
version: '01.15.204',
|
|
60
|
+
sha: 'a1b2c3d4e5f6a1b2c3d4e5f6a1b2c3d4e5f6a1b2',
|
|
61
|
+
});
|
|
62
|
+
expect(JSON.stringify(out)).not.toContain('supersecretpw');
|
|
63
|
+
expect(out.version).toBe('01.15.204');
|
|
64
|
+
expect(out.sha).toBe('a1b2c3d4e5f6a1b2c3d4e5f6a1b2c3d4e5f6a1b2');
|
|
65
|
+
});
|
|
66
|
+
});
|
|
@@ -106,10 +106,14 @@ const defaultRevealReplacement = (
|
|
|
106
106
|
};
|
|
107
107
|
|
|
108
108
|
export const DyFM_SECRET_PATTERNS: SecretPattern_Interface[] = [
|
|
109
|
-
// URL-embedded basic auth —
|
|
109
|
+
// URL-embedded basic auth — BARMELY scheme (`http(s)`, `mongodb`, `postgres`, `redis`,
|
|
110
|
+
// `amqp`, `mysql` stb.), nem csak http: a `mongodb://user:pass@host` connection-string a
|
|
111
|
+
// leggyakoribb DB-secret-leak vektor a CI-logokban. A `user:pass@` szerkezet kotelezo →
|
|
112
|
+
// nincs false-positive a sima URL-ekre (port `host:8080/` sem, mert nincs utana `@`).
|
|
113
|
+
// A sajat replace-pattern megorzi a scheme-et ($1) + host-ot.
|
|
110
114
|
{
|
|
111
115
|
kind: 'url-cred',
|
|
112
|
-
regex: /\b(
|
|
116
|
+
regex: /\b([a-z][a-z0-9+.-]*:\/\/)([^/\s:@]*):([^\s@]+)@/gi,
|
|
113
117
|
redactWith: (_m: string): string => '$1[redacted-url-cred]@',
|
|
114
118
|
},
|
|
115
119
|
// GitHub PATs
|