@gmickel/gno 2.5.1 → 2.7.0

package/src/sessions/sanitize.ts

@@ -0,0 +1,222 @@
+/**
+ * Secret redaction applied before any session content is persisted.
+ *
+ * Detection is format-based (well-known credential shapes) plus
+ * owner-configured exact literals. Every pattern uses bounded, non-nested
+ * quantifiers so scanning stays linear in the input length; inputs are also
+ * bounded per turn by the caller. Redaction is best effort: it does not
+ * promise to find every secret or personal datum.
+ *
+ * A value detected anywhere in a thread is propagated: later exact
+ * occurrences of the same value in that thread are redacted too, even where
+ * the surrounding shape no longer matches.
+ *
+ * @module src/sessions/sanitize
+ */
+
+/** Bumped whenever a rule changes; stale archives are rescanned on import. */
+export const SESSION_REDACTION_VERSION = 1;
+
+/**
+ * Identity of the effective redaction policy: the rule version plus the
+ * owner's configured literals. Any change re-renders or rescans archives.
+ */
+export function redactionStamp(policy: RedactionPolicy = {}): string {
+  const literals = [...new Set(policy.literals ?? [])].sort();
+  const hasher = new Bun.CryptoHasher("sha256");
+  hasher.update(JSON.stringify(literals));
+  return `${SESSION_REDACTION_VERSION}:${hasher.digest("hex").slice(0, 16)}`;
+}
+
+const MAX_PROPAGATED_VALUES = 256;
+const MIN_PROPAGATED_LENGTH = 8;
+const PRIVATE_KEY_WINDOW = 16 * 1024;
+const PRIVATE_KEY_BEGIN = /-----BEGIN [A-Z0-9 ]{0,40}PRIVATE KEY-----/g;
+const PRIVATE_KEY_END = /-----END [A-Z0-9 ]{0,40}PRIVATE KEY-----/;
+
+interface Rule {
+  kind: string;
+  pattern: RegExp;
+  /** Capture group holding the secret; 0 means the whole match. */
+  group: number;
+}
+
+// Every quantifier is bounded; no quantified group contains another quantifier.
+const RULES: readonly Rule[] = [
+  { kind: "aws-key", pattern: /\b(?:AKIA|ASIA)[0-9A-Z]{16}\b/g, group: 0 },
+  {
+    kind: "github-token",
+    pattern:
+      /\b(?:gh[pousr]_[A-Za-z0-9]{30,255}|github_pat_[A-Za-z0-9_]{22,255})/g,
+    group: 0,
+  },
+  {
+    kind: "api-key",
+    pattern: /\bsk-(?:ant-|proj-|live-|test-)?[A-Za-z0-9_-]{20,512}/g,
+    group: 0,
+  },
+  {
+    kind: "stripe-key",
+    pattern: /\b(?:sk|rk|pk)_(?:live|test)_[A-Za-z0-9]{16,256}/g,
+    group: 0,
+  },
+  {
+    kind: "slack-token",
+    pattern: /\bxox[abposr]-[A-Za-z0-9-]{10,256}/g,
+    group: 0,
+  },
+  { kind: "google-key", pattern: /\bAIza[0-9A-Za-z_-]{35}/g, group: 0 },
+  {
+    kind: "jwt",
+    pattern:
+      /\beyJ[A-Za-z0-9_-]{8,4096}\.eyJ[A-Za-z0-9_-]{8,8192}\.[A-Za-z0-9_-]{8,4096}/g,
+    group: 0,
+  },
+  {
+    kind: "bearer",
+    pattern: /\b(?:Bearer|Token)[ \t]{1,8}([A-Za-z0-9._~+/=-]{16,4096})/g,
+    group: 1,
+  },
+  {
+    kind: "url-credentials",
+    pattern: /\b[a-z][a-z0-9+.-]{1,16}:\/\/[^\s:@/]{1,256}:([^\s@/]{1,256})@/gi,
+    group: 1,
+  },
+  {
+    kind: "assignment",
+    pattern:
+      /\b(?:password|passwd|pwd|secret|api[_-]?key|apikey|access[_-]?token|auth[_-]?token|refresh[_-]?token|client[_-]?secret|private[_-]?key|token)["']?[ \t]{0,4}[:=][ \t]{0,4}["']?([^\s"'`,;]{6,512})/gi,
+    group: 1,
+  },
+];
+
+const CONTROL_CHARS = new RegExp(
+  `[${String.fromCharCode(0)}-${String.fromCharCode(8)}${String.fromCharCode(11)}${String.fromCharCode(12)}${String.fromCharCode(14)}-${String.fromCharCode(31)}${String.fromCharCode(127)}]`,
+  "g"
+);
+
+const PLACEHOLDER_VALUES = new Set([
+  "redacted",
+  "changeme",
+  "password",
+  "example",
+  "xxxxxx",
+  "********",
+  "<redacted>",
+]);
+
+const marker = (kind: string): string => `[REDACTED:${kind}]`;
+
+export interface RedactionPolicy {
+  /** Owner-configured exact literals (e.g. a known internal hostname or key). */
+  literals?: readonly string[];
+}
+
+/**
+ * Per-thread sanitizer. Holds the values detected so far so later turns of
+ * the same thread redact them even out of their original shape.
+ */
+export class ThreadSanitizer {
+  private readonly literals: string[];
+  private readonly detected = new Set<string>();
+  redactions = 0;
+
+  constructor(policy: RedactionPolicy = {}) {
+    this.literals = [...new Set(policy.literals ?? [])]
+      .filter((value) => value.length >= 4)
+      .sort((left, right) => right.length - left.length);
+  }
+
+  /** Values detected so far (bounded); used for the propagation pass. */
+  get detectedValues(): readonly string[] {
+    return [...this.detected];
+  }
+
+  private remember(value: string): void {
+    if (
+      value.length >= MIN_PROPAGATED_LENGTH &&
+      this.detected.size < MAX_PROPAGATED_VALUES &&
+      !PLACEHOLDER_VALUES.has(value.toLowerCase())
+    ) {
+      this.detected.add(value);
+    }
+  }
+
+  private replaceLiteral(text: string, literal: string, kind: string): string {
+    if (!text.includes(literal)) return text;
+    const parts = text.split(literal);
+    this.redactions += parts.length - 1;
+    return parts.join(marker(kind));
+  }
+
+  private redactPrivateKeys(text: string): string {
+    if (!text.includes("PRIVATE KEY-----")) return text;
+    let output = "";
+    let cursor = 0;
+    PRIVATE_KEY_BEGIN.lastIndex = 0;
+    for (;;) {
+      const begin = PRIVATE_KEY_BEGIN.exec(text);
+      if (!begin) break;
+      const window = text.slice(begin.index, begin.index + PRIVATE_KEY_WINDOW);
+      const end = PRIVATE_KEY_END.exec(window);
+      // An unterminated block is redacted to the end of its window.
+      const stop = end
+        ? begin.index + end.index + end[0].length
+        : Math.min(text.length, begin.index + PRIVATE_KEY_WINDOW);
+      output += `${text.slice(cursor, begin.index)}${marker("private-key")}`;
+      this.redactions += 1;
+      cursor = stop;
+      PRIVATE_KEY_BEGIN.lastIndex = stop;
+    }
+    return output + text.slice(cursor);
+  }
+
+  /** Sanitize one field. Safe for titles, labels and metadata as well as bodies. */
+  sanitize(input: string): string {
+    let text = input.replace(CONTROL_CHARS, "");
+    text = this.redactPrivateKeys(text);
+    for (const rule of RULES) {
+      rule.pattern.lastIndex = 0;
+      text = text.replace(
+        rule.pattern,
+        (match: string, ...groups: unknown[]) => {
+          const secret =
+            rule.group === 0 ? match : (groups[rule.group - 1] as string);
+          if (!secret || PLACEHOLDER_VALUES.has(secret.toLowerCase())) {
+            return match;
+          }
+          if (secret.startsWith("[REDACTED:")) return match;
+          this.remember(secret);
+          this.redactions += 1;
+          return rule.group === 0
+            ? marker(rule.kind)
+            : match.replace(secret, marker(rule.kind));
+        }
+      );
+    }
+    for (const literal of this.literals) {
+      text = this.replaceLiteral(text, literal, "configured");
+    }
+    return this.propagate(text);
+  }
+
+  /**
+   * Redact exact occurrences of every value detected so far. Run over the
+   * whole thread after the first pass so earlier turns are covered too.
+   */
+  propagate(text: string): string {
+    let output = text;
+    for (const value of this.detected) {
+      output = this.replaceLiteral(output, value, "propagated");
+    }
+    return output;
+  }
+}
+
+/** Sanitize a single standalone value with a fresh per-call sanitizer. */
+export function sanitizeValue(
+  value: string,
+  policy: RedactionPolicy = {}
+): string {
+  return new ThreadSanitizer(policy).sanitize(value);
+}