@link-foundation/sensitive-data-sanitizer 0.0.0-stage → 0.11.31

package/src/eslint-plugin.js

@@ -0,0 +1,193 @@
+function resolveVariable(context, node) {
+  for (
+    let scope = context.sourceCode.getScope(node);
+    scope;
+    scope = scope.upper
+  ) {
+    if (scope.set.has(node.name)) {
+      return scope.set.get(node.name);
+    }
+  }
+  return undefined;
+}
+/** Optional static publication guard; runtime verification remains required. */
+function name(node) {
+  return node?.name ?? node?.property?.name ?? node?.property?.value;
+}
+function literal(node) {
+  return node?.type === 'Literal' ? node.value : undefined;
+}
+function publicationCommand(text) {
+  return (
+    typeof text === 'string' &&
+    /\bgh\s+(?:pr|issue|gist|release)\s+(?:create|edit|comment|review)\b/.test(
+      text
+    ) &&
+    /--(?:body|title|notes|comment)(?:-file)?\b|\s-[bt]\b/.test(text)
+  );
+}
+const rule = {
+  meta: {
+    type: 'problem',
+    docs: {
+      description:
+        'Require sanitization before generated data crosses an outbound boundary.',
+    },
+    schema: [
+      {
+        type: 'object',
+        properties: {
+          sinks: { type: 'array', items: { type: 'string' } },
+          sanitizers: { type: 'array', items: { type: 'string' } },
+        },
+        additionalProperties: false,
+      },
+    ],
+    messages: {
+      unsafe: 'Sanitize generated outbound data before publication.',
+    },
+  },
+  create(context) {
+    const settings = context.options[0] ?? {};
+    const sinks = new Set(
+      settings.sinks ?? [
+        'publish',
+        'send',
+        'captureException',
+        'captureMessage',
+      ]
+    );
+    const sanitizers = new Set(
+      settings.sanitizers ?? [
+        'sanitize',
+        'sanitizePayload',
+        'sanitizeForPublication',
+      ]
+    );
+    const safeVariables = new Set(),
+      arrays = new Map();
+    function safeCall(node) {
+      return (
+        sanitizers.has(name(node.callee)) ||
+        (name(node.callee) === 'stringify' && node.arguments.every(safe))
+      );
+    }
+    function safe(node) {
+      if (!node) {
+        return false;
+      }
+      if (node.type === 'Literal') {
+        return true;
+      }
+      if (node.type === 'Identifier') {
+        const variable = resolveVariable(context, node);
+        return safeVariables.has(variable);
+      }
+      if (['AwaitExpression', 'ChainExpression'].includes(node.type)) {
+        return safe(node.argument ?? node.expression);
+      }
+      if (node.type === 'MemberExpression') {
+        return safe(node.object);
+      }
+      if (node.type === 'CallExpression') {
+        return safeCall(node);
+      }
+      if (node.type === 'TemplateLiteral') {
+        return node.expressions.every(safe);
+      }
+      if (node.type === 'BinaryExpression') {
+        return safe(node.left) && safe(node.right);
+      }
+      if (node.type === 'ArrayExpression') {
+        return node.elements.every(safe);
+      }
+      if (node.type === 'ObjectExpression') {
+        return node.properties.every((p) => safe(p.value ?? p.argument));
+      }
+      return false;
+    }
+    function checkGh(node) {
+      if (literal(node.arguments[0]) !== 'gh') {
+        return;
+      }
+      const expression = node.arguments[1];
+      const argv =
+        expression?.type === 'ArrayExpression'
+          ? expression
+          : arrays.get(
+              expression?.type === 'Identifier'
+                ? resolveVariable(context, expression)
+                : undefined
+            );
+      if (
+        !argv ||
+        !['pr', 'issue', 'gist', 'release'].includes(
+          literal(argv.elements[0])
+        ) ||
+        !['create', 'edit', 'comment', 'review'].includes(
+          literal(argv.elements[1])
+        )
+      ) {
+        return;
+      }
+      for (let i = 2; i < argv.elements.length - 1; i++) {
+        if (
+          /^(?:--body(?:-file)?|--title|--notes(?:-file)?|--comment|-b|-t)$/.test(
+            literal(argv.elements[i])
+          ) &&
+          !safe(argv.elements[i + 1])
+        ) {
+          context.report({ node, messageId: 'unsafe' });
+          return;
+        }
+      }
+    }
+    return {
+      'VariableDeclarator:exit'(node) {
+        if (node.id.type !== 'Identifier') {
+          return;
+        }
+        const variable = context.sourceCode.getDeclaredVariables(node)[0];
+        if (node.parent.kind === 'const' && safe(node.init)) {
+          safeVariables.add(variable);
+        }
+        if (
+          node.parent.kind === 'const' &&
+          node.init?.type === 'ArrayExpression'
+        ) {
+          arrays.set(variable, node.init);
+        }
+      },
+      'CallExpression:exit'(node) {
+        checkGh(node);
+        if (
+          sinks.has(name(node.callee)) &&
+          node.arguments.some((arg) => !safe(arg))
+        ) {
+          context.report({ node, messageId: 'unsafe' });
+        }
+        const command = node.arguments[0];
+        if (
+          command?.type === 'TemplateLiteral' &&
+          publicationCommand(
+            command.quasis.map((q) => q.value.raw).join('${x}')
+          ) &&
+          !command.expressions.every(safe)
+        ) {
+          context.report({ node, messageId: 'unsafe' });
+        }
+      },
+      TaggedTemplateExpression(node) {
+        if (
+          publicationCommand(
+            node.quasi.quasis.map((q) => q.value.raw).join('${x}')
+          ) &&
+          !node.quasi.expressions.every(safe)
+        ) {
+          context.report({ node, messageId: 'unsafe' });
+        }
+      },
+    };
+  },
+};
+export default { rules: { 'require-sanitized-output': rule } };

package/src/external.js

@@ -0,0 +1,169 @@
+import { spawn } from 'node:child_process';
+import { mkdtemp, writeFile, rm } from 'node:fs/promises';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+import { fromGitleaks, fromTrufflehog, fromPresidio } from './adapters.js';
+import { readTextFile } from './files.js';
+import { failure } from './detection.js';
+
+function run(
+  command,
+  args,
+  input,
+  { timeoutMs = 30000, maxOutputBytes = 10 * 1024 * 1024 } = {}
+) {
+  if (
+    typeof command !== 'string' ||
+    !command ||
+    !Array.isArray(args) ||
+    args.some((a) => typeof a !== 'string') ||
+    !Number.isSafeInteger(timeoutMs) ||
+    timeoutMs <= 0 ||
+    !Number.isSafeInteger(maxOutputBytes) ||
+    maxOutputBytes <= 0
+  ) {
+    throw failure('ERR_CONFIG');
+  }
+  return new Promise((resolve, reject) => {
+    const child = spawn(command, args, {
+      stdio: ['pipe', 'pipe', 'pipe'],
+      shell: false,
+      windowsHide: true,
+    });
+    const chunks = [];
+    let size = 0,
+      failed = false;
+    const timer = setTimeout(() => {
+      failed = true;
+      child.kill('SIGKILL');
+    }, timeoutMs);
+    child.stdout.on('data', (chunk) => {
+      size += chunk.length;
+      if (size > maxOutputBytes) {
+        failed = true;
+        child.kill('SIGKILL');
+      } else {
+        chunks.push(chunk);
+      }
+    });
+    child.stderr.on('data', () => {}); // Scanner diagnostics can contain credentials.
+    child.stdin.on('error', () => {
+      failed = true;
+    });
+    child.on('error', () => {
+      failed = true;
+    });
+    child.on('close', (code) => {
+      clearTimeout(timer);
+      if (failed || code !== 0) {
+        reject(failure('ERR_ENGINE'));
+      } else {
+        resolve(Buffer.concat(chunks).toString('utf8'));
+      }
+    });
+    child.stdin.end(input);
+  });
+}
+
+export function createGitleaksDetector({
+  command = 'gitleaks',
+  timeoutMs,
+  maxOutputBytes,
+} = {}) {
+  return {
+    id: 'gitleaks',
+    async detect(text) {
+      const directory = await mkdtemp(join(tmpdir(), 'sanitizer-gitleaks-'));
+      const report = join(directory, 'report.json');
+      try {
+        await run(
+          command,
+          [
+            'stdin',
+            '--no-banner',
+            '--log-level',
+            'error',
+            '--ignore-gitleaks-allow',
+            '--exit-code',
+            '0',
+            '--report-format',
+            'json',
+            '--report-path',
+            report,
+          ],
+          text,
+          { timeoutMs, maxOutputBytes }
+        );
+        const json = await readTextFile(
+          report,
+          maxOutputBytes ?? 10 * 1024 * 1024
+        );
+        return fromGitleaks(text, JSON.parse(json));
+      } catch {
+        throw failure('ERR_ENGINE');
+      } finally {
+        await rm(directory, { recursive: true, force: true });
+      }
+    },
+  };
+}
+
+export function createTrufflehogDetector({
+  command = 'trufflehog',
+  timeoutMs,
+  maxOutputBytes,
+} = {}) {
+  return {
+    id: 'trufflehog',
+    async detect(text) {
+      const directory = await mkdtemp(join(tmpdir(), 'sanitizer-trufflehog-'));
+      const input = join(directory, 'input.txt');
+      try {
+        await writeFile(input, text, { mode: 0o600 });
+        const output = await run(
+          command,
+          ['filesystem', input, '--json', '--no-verification', '--no-update'],
+          undefined,
+          { timeoutMs, maxOutputBytes }
+        );
+        const report = output
+          .split('\n')
+          .filter((line) => line.trim())
+          .map((line) => JSON.parse(line));
+        return fromTrufflehog(text, report);
+      } catch {
+        throw failure('ERR_ENGINE');
+      } finally {
+        await rm(directory, { recursive: true, force: true });
+      }
+    },
+  };
+}
+
+// A local Presidio bridge accepts text on stdin and emits its AnalyzerResult
+// list as JSON. Model installation and language choice belong to the caller.
+export function createPresidioDetector({
+  command = 'python3',
+  args,
+  timeoutMs,
+  maxOutputBytes,
+} = {}) {
+  if (!Array.isArray(args)) {
+    throw failure('ERR_CONFIG');
+  }
+  return {
+    id: 'presidio',
+    async detect(text) {
+      try {
+        return fromPresidio(
+          text,
+          JSON.parse(
+            await run(command, args, text, { timeoutMs, maxOutputBytes })
+          )
+        );
+      } catch {
+        throw failure('ERR_ENGINE');
+      }
+    },
+  };
+}

package/src/fake-names.js

@@ -0,0 +1,222 @@
+import { createHmac } from 'node:crypto';
+import {
+  Faker,
+  en,
+  es,
+  fr,
+  de,
+  pt_BR,
+  ru,
+  ja,
+  zh_CN,
+  zh_TW,
+  ko,
+  ar,
+  he,
+  tr,
+  id_ID,
+  vi,
+  th,
+} from '@faker-js/faker';
+import { firstNames } from './names.js';
+
+const hi = {
+  person: {
+    first_name: {
+      female: ['प्रिया', 'पूजा', 'नेहा', 'मीरा'],
+      male: ['अर्जुन', 'अमित', 'विजय', 'राहुल'],
+    },
+    last_name: { generic: ['शर्मा', 'गुप्ता', 'वर्मा', 'सिंह'] },
+  },
+};
+const locales = {
+  en,
+  es,
+  fr,
+  de,
+  pt: pt_BR,
+  ru,
+  ruLatn: ru,
+  ja,
+  zh: zh_CN,
+  'zh-Hant': zh_TW,
+  ko,
+  ar,
+  he,
+  hi,
+  tr,
+  id: id_ID,
+  vi,
+  th,
+};
+const transliteration = Object.fromEntries(
+  Array.from('абвгдеёжзийклмнопрстуфхцчшщъыьэюя').map((letter, i) => [
+    letter,
+    [
+      'a',
+      'b',
+      'v',
+      'g',
+      'd',
+      'e',
+      'e',
+      'zh',
+      'z',
+      'i',
+      'y',
+      'k',
+      'l',
+      'm',
+      'n',
+      'o',
+      'p',
+      'r',
+      's',
+      't',
+      'u',
+      'f',
+      'kh',
+      'ts',
+      'ch',
+      'sh',
+      'shch',
+      '',
+      'y',
+      '',
+      'e',
+      'yu',
+      'ya',
+    ][i],
+  ])
+);
+export function latinName(value) {
+  return value
+    .toLowerCase()
+    .normalize('NFD')
+    .replace(/\p{M}/gu, '')
+    .replace(/[а-яё]/g, (c) => transliteration[c]);
+}
+const given = new Map();
+for (const [locale, list] of Object.entries(firstNames)) {
+  for (const name of list.split(' ')) {
+    given.set(latinName(name), locale);
+  }
+}
+const surnames = new Map(),
+  female = new Set();
+for (const [locale, data] of Object.entries(locales)) {
+  for (const name of data.person?.first_name?.female ?? []) {
+    female.add(latinName(name));
+  }
+  for (const names of Object.values(data.person?.last_name ?? {})) {
+    for (const name of names) {
+      if (!surnames.has(latinName(name))) {
+        surnames.set(latinName(name), locale);
+      }
+    }
+  }
+}
+const femaleNames =
+  /^(?:marina|anna|mariya|maria|elena|olga|natalya|irina|svetlana|tatyana|ekaterina|anastasia|yulia|mary|jane|alice|emma|sarah|jessica|patricia|jennifer|linda|elizabeth|barbara|susan|olivia)$/;
+function scriptLocale(value) {
+  for (const [script, locale] of [
+    ['Cyrillic', 'ru'],
+    ['Arabic', 'ar'],
+    ['Hebrew', 'he'],
+    ['Devanagari', 'hi'],
+    ['Thai', 'th'],
+    ['Hangul', 'ko'],
+    ['Hiragana', 'ja'],
+    ['Katakana', 'ja'],
+    ['Han', 'zh'],
+  ]) {
+    if (new RegExp(`\\p{Script=${script}}`, 'u').test(value)) {
+      return locale;
+    }
+  }
+  return undefined;
+}
+export function fakeName(value, key) {
+  return value.replace(/[\p{L}\p{M}]+/gu, (word) => {
+    for (const locale of ['ja', 'zh', 'ko']) {
+      const family = firstNames[locale]
+        .split(' ')
+        .find((name) => word.startsWith(name) && word.length > name.length);
+      if (family) {
+        return (
+          fakeWord(family, key, 'lastName', locale) +
+          fakeWord(word.slice(family.length), key, 'firstName', locale)
+        );
+      }
+    }
+    return fakeWord(word, key);
+  });
+}
+function wordProfile(word, forcedRole, forcedLocale) {
+  const canonical = latinName(word);
+  const patronymic = /(?:vich|vna|ichna|ogly|kyzy)$/.test(canonical);
+  const slavic = /(?:ova|eva|ov|ev|in|ina|enko|sky|ski|skaya)$/.test(canonical);
+  const locale =
+    forcedLocale ??
+    scriptLocale(word) ??
+    given.get(canonical) ??
+    (slavic || patronymic ? 'ru' : (surnames.get(canonical) ?? 'en'));
+  const sex =
+    femaleNames.test(canonical) ||
+    female.has(canonical) ||
+    /(?:ova|eva|ina|skaya|vna|ichna|kyzy)$/.test(canonical)
+      ? 'female'
+      : 'male';
+  const role =
+    forcedRole ??
+    (patronymic
+      ? 'middleName'
+      : given.has(canonical) &&
+          !['jaLatn', 'zhLatn', 'vi', 'ja', 'zh', 'ko'].includes(
+            given.get(canonical)
+          )
+        ? 'firstName'
+        : 'lastName');
+  return { canonical, locale, sex, role };
+}
+function fakeWord(word, key, forcedRole, forcedLocale) {
+  const { canonical, locale, sex, role } = wordProfile(
+    word,
+    forcedRole,
+    forcedLocale
+  );
+  const faker = new Faker({ locale: [locales[locale] ?? en, en] });
+  faker.seed(
+    createHmac('sha256', key)
+      .update(`name\0${canonical}\0${role}`)
+      .digest()
+      .readUInt32BE(0)
+  );
+  let replacement;
+  for (let attempt = 0; attempt < 100; attempt++) {
+    replacement = faker.person[role](sex).replace(/[ -].*$/, '');
+    if (
+      latinName(replacement) !== canonical &&
+      (!/^\p{Script=Han}+$/u.test(word) ||
+        /^\p{Script=Han}+$/u.test(replacement))
+    ) {
+      break;
+    }
+  }
+  if (!scriptLocale(word) && /\p{Script=Cyrillic}/u.test(replacement)) {
+    replacement = latinName(replacement);
+  }
+  if (latinName(replacement) === canonical) {
+    replacement = faker.person[role](sex).replace(/[ -].*$/, '');
+    if (!scriptLocale(word)) {
+      replacement = latinName(replacement);
+    }
+  }
+  if (word === word.toUpperCase()) {
+    return replacement.toUpperCase();
+  }
+  if (word === word.toLowerCase()) {
+    return replacement.toLowerCase();
+  }
+  return replacement[0].toUpperCase() + replacement.slice(1).toLowerCase();
+}