@link-foundation/sensitive-data-sanitizer 0.12.1 → 0.12.2

package/CHANGELOG.md

@@ -1,5 +1,11 @@
 # Changelog
 
+## 0.12.2
+
+### Patch Changes
+
+- 704c4b7: Preserve Authorization placeholders, matching brackets and control-byte boundaries. Bound repeated WASM input copies when scanning dense credentials by continuing with the existing RE2JS engine.
+
 ## 0.12.1
 
 ### Patch Changes

package/docs/API.md

@@ -334,4 +334,4 @@ permission values and literal credential references. `publicKnowledge: false`
 restores IP detection; explicit `knownSecrets` and `knownPersonal` retain
 priority. No shell command or workflow expression is executed.
 
-Authorization headers (including Proxy-Authorization) redact the scheme and one credential token. Whitespace, quotes, backslashes and commas end the value, preserving subsequent log text in shell and escaped JSON prompts. Known credential references remain exempt. The debug callback receives value-free `gitleaks-rule` events with rule ID, input length and elapsed milliseconds; tracing is off by default.
+Authorization headers (including Proxy-Authorization) redact the scheme and one credential token. Whitespace, C0 controls (including NUL), DEL, quotes, backslashes and commas end the value, preserving subsequent log text in shell and escaped JSON prompts. Matching brackets opened within a token are included in its redaction; unmatched closing brackets remain part of the surrounding log. Already-redacted tokens and known credential references remain exempt after an optional scheme, including `<token>` placeholders. The debug callback receives value-free `gitleaks-rule` events with rule ID, input length and elapsed milliseconds; tracing is off by default.

package/docs/COVERAGE.md

@@ -6,7 +6,7 @@ Coverage is a union of maintained detectors, explicit known values, context and
 
 The native provider supplements in `src/rules.js` cover GitHub, GitLab, OpenAI, Anthropic, AWS access IDs, Google API/OAuth, Slack, Stripe, SendGrid, Twilio, npm, PyPI, Telegram, Discord, Hugging Face, Shopify, Databricks, Square, Mailchimp, DigitalOcean, Vault, Grafana, Linear, Notion, Vercel, and JWT-shaped values. Prefix matches also protect selected truncated tokens; they do not validate a token with a provider.
 
-The default native engine bundles 221 text rules from Gitleaks 8.30.1 (222 upstream rules; the path-only PKCS12 rule is outside text detection), compiled unchanged with RE2/WASM or RE2JS for inputs above 4 MiB. The MIT license, commit and sync script are retained in `src/vendor/gitleaks`. Keyword prefilters and configured entropy thresholds run natively; upstream comment/path allowlists cannot suppress a sanitizer finding. Quoted hex/base64 entropy detection supplements those rules. The default asynchronous engine additionally uses the pinned Secretlint recommended scanners, excluding its comment-filter rule. Embedded disable directives in untrusted text cannot suppress findings. Optional Gitleaks and TruffleHog invoke their installed detector sets, and custom detectors can add formats. Service counts are not a measure of comparative recall.
+The default native engine bundles 221 text rules from Gitleaks 8.30.1 (222 upstream rules; the path-only PKCS12 rule is outside text detection), compiled unchanged with RE2/WASM or RE2JS for inputs above 4 MiB. Dense rule matches switch to RE2JS after at most eight WASM matches per view, bounding repeated whole-input copies without truncating secrets or changing anchors. The MIT license, commit and sync script are retained in `src/vendor/gitleaks`. Keyword prefilters and configured entropy thresholds run natively; upstream comment/path allowlists cannot suppress a sanitizer finding. Quoted hex/base64 entropy detection supplements those rules. The default asynchronous engine additionally uses the pinned Secretlint recommended scanners, excluding its comment-filter rule. Embedded disable directives in untrusted text cannot suppress findings. Optional Gitleaks and TruffleHog invoke their installed detector sets, and custom detectors can add formats. Service counts are not a measure of comparative recall.
 
 Context rules recognize credential labels with bounded key affixes, JSON and nested escaped JSON, YAML/env/INI assignments, shell flags, XML values, URL userinfo, authorization headers, cookies, webhook paths, and complete or truncated private-key PEM blocks. Low-entropy contextual values such as `password=1234` are protected. Generic token counters, booleans/null/language literals and ordinary Git hashes are excluded to retain useful logs. Supply literal known values for ambiguous credentials or unusual key names.
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@link-foundation/sensitive-data-sanitizer",
-  "version": "0.12.1",
+  "version": "0.12.2",
   "description": "Offline sensitive-text sanitization with credential, multilingual personal-data and scanner union detection",
   "type": "module",
   "main": "src/index.js",

package/src/context.js

@@ -163,13 +163,29 @@ export function authorizationRange(text, start) {
   if (reference) {
     return { start, end: start + reference[0].length };
   }
-  if (text.startsWith(REDACTED, start)) {
-    return undefined;
+  const scheme = /^[a-z][a-z0-9_-]*[ \t]+/i.exec(text.slice(start));
+  const tokenStart = start + (scheme?.[0].length ?? 0);
+  const brackets = [];
+  let end = tokenStart;
+  for (; end < text.length; end++) {
+    const char = text[end];
+    const code = text.charCodeAt(end);
+    if (code < 32 || code === 127 || /[\s"'\\,]/.test(char)) {
+      break;
+    }
+    if (char === '<' && end !== tokenStart && !brackets.length) {
+      break;
+    }
+    const closing = { '{': '}', '[': ']', '<': '>' }[char];
+    if (closing) {
+      brackets.push(closing);
+    } else if (/[}\]>]/.test(char) && char !== brackets.pop()) {
+      // An unmatched closer belongs to the enclosing log structure.
+      break;
+    }
   }
-  const match = /^(?:[a-z][a-z0-9_-]*[ \t]+)?[^\s"'\\,<>}\]]+/i.exec(
-    text.slice(start)
-  );
-  return match ? { start, end: start + match[0].length } : undefined;
+  const token = text.slice(tokenStart, end);
+  return !token || credentialPlaceholder(token) ? undefined : { start, end };
 }
 function quotedRange(text, start, opening, maxLength) {
   const depth = opening[1].length,

package/src/gitleaks.js

@@ -12,7 +12,7 @@ import { keywordMatcher } from './keywords.js';
 
 export const gitleaksRules = [...r0, ...r1, ...r2, ...r3, ...r4, ...r5];
 const compiled = new Map();
-const largePatterns = new Map();
+const linearPatterns = new Map();
 const keywordIndex = keywordMatcher(
   gitleaksRules.flatMap((r) =>
     (r.keywords ?? []).map((word) => word.toLowerCase())
@@ -119,17 +119,6 @@ function* boundedViews(text, prefix, id) {
 }
 
 function scanRule(text, base, rule, emit, large) {
-  // re2-wasm 1.0.2 returns codepoint indices despite its RegExp-like API.
-  // Convert once per view, and keep its search cursor in codepoints too.
-  let offsets;
-  if (!large && /[\uD800-\uDBFF]/.test(text)) {
-    offsets = [0];
-    let offset = 0;
-    for (const char of text) {
-      offset += char.length;
-      offsets.push(offset);
-    }
-  }
   for (const match of ruleMatches(text, rule, large)) {
     const secret = capturedSecret(rule, match);
     if (!secret) {
@@ -140,12 +129,8 @@ function scanRule(text, base, rule, emit, large) {
     const offset = match[0].indexOf(secret),
       last = match[0].lastIndexOf(secret);
     emit({
-      start: base + (offsets ? offsets[match.index] : match.index) + offset,
-      end:
-        base +
-        (offsets ? offsets[match.index] : match.index) +
-        last +
-        secret.length,
+      start: base + match.index + offset,
+      end: base + match.index + last + secret.length,
       type: 'SECRET',
       category: 'credential',
       rule: `gitleaks/${rule.id}`,
@@ -158,28 +143,57 @@ function* ruleMatches(text, rule, large) {
   if (large) {
     // re2-wasm has a fixed 16 MiB heap. RE2JS implements the same linear-time
     // syntax without copying the input into WASM. Its indices are UTF-16.
-    let linear = largePatterns.get(rule.id);
-    if (!linear) {
-      linear = RE2JS.compile(rule.regex);
-      largePatterns.set(rule.id, linear);
-    }
-    if (linear.test(text)) {
-      yield* linear.matchAll(text);
-    }
+    yield* linearMatches(text, rule);
     return;
   }
+  // re2-wasm 1.0.2 returns codepoint indices despite its RegExp-like API.
+  // Normalize matches here so switching engines never changes public offsets.
+  let offsets;
+  if (/[\uD800-\uDBFF]/.test(text)) {
+    offsets = [0];
+    let offset = 0;
+    for (const char of text) {
+      offset += char.length;
+      offsets.push(offset);
+    }
+  }
   let pattern = compiled.get(rule.id);
   if (!pattern) {
     pattern = new RE2(rule.regex, 'gu');
     compiled.set(rule.id, pattern);
   }
   pattern.lastIndex = 0;
-  let match;
-  while ((match = pattern.exec(text)) !== null) {
-    pattern.lastIndex =
-      match.index + Array.from(match[0]).length || pattern.lastIndex + 1;
+  for (let attempts = 0; attempts < 8; attempts++) {
+    const match = pattern.exec(text);
+    if (!match) {
+      return;
+    }
+    pattern.lastIndex = match.index + Math.max(1, Array.from(match[0]).length);
+    match.index = offsets ? offsets[match.index] : match.index;
     yield match;
   }
+  // Every exec recopies the whole view into WASM. Bound those copies even
+  // for dense inputs, then replay at most eight matches in the JS engine.
+  // Keep the original subject: slicing would change anchors and boundaries.
+  const resume = offsets ? offsets[pattern.lastIndex] : pattern.lastIndex;
+  if (resume !== undefined && resume <= text.length) {
+    yield* linearMatches(text, rule, resume);
+  }
+}
+
+function* linearMatches(text, rule, resume = 0) {
+  let linear = linearPatterns.get(rule.id);
+  if (!linear) {
+    linear = RE2JS.compile(rule.regex);
+    linearPatterns.set(rule.id, linear);
+  }
+  if (linear.test(text)) {
+    for (const match of linear.matchAll(text)) {
+      if (match.index >= resume) {
+        yield match;
+      }
+    }
+  }
 }
 
 function capturedSecret(rule, match) {