@link-foundation/sensitive-data-sanitizer 0.19.3 → 0.20.0

package/src/sarif.js

@@ -0,0 +1,127 @@
+// SARIF 2.1.0 export for code-scanning dashboards (GitHub, GitLab, Azure
+// DevOps), matching the reporting formats of Gitleaks/Betterleaks, TruffleHog,
+// detect-secrets and Kingfisher. Only metadata is emitted: rule, type,
+// category, confidence and location. Matched values are never included.
+const schema = 'https://json.schemastore.org/sarif-2.1.0.json';
+const levels = { credential: 'error', personal: 'warning' };
+
+function artifactUri(path) {
+  if (path === '-' || path === undefined) {
+    return 'stdin';
+  }
+  return encodeURI(String(path).replaceAll('\\', '/'));
+}
+
+function region(finding) {
+  const result = {
+    charOffset: finding.start,
+    charLength: finding.end - finding.start,
+  };
+  if (Number.isSafeInteger(finding.line)) {
+    result.startLine = finding.line;
+  }
+  if (Number.isSafeInteger(finding.column)) {
+    result.startColumn = finding.column;
+  }
+  return result;
+}
+
+function sarifResult(finding, uri, ruleIndex) {
+  return {
+    ruleId: finding.rule,
+    ruleIndex,
+    level: levels[finding.category] ?? 'note',
+    message: {
+      text: `${finding.type} ${finding.category === 'credential' ? 'credential' : 'personal data'} detected`,
+    },
+    locations: [
+      {
+        physicalLocation: {
+          artifactLocation: { uri },
+          region: region(finding),
+        },
+      },
+    ],
+    properties: {
+      type: finding.type,
+      category: finding.category,
+      confidence: finding.confidence,
+    },
+  };
+}
+
+/**
+ * Converts scan results to a SARIF 2.1.0 log. Accepts the CLI scan report
+ * (`{complete, results: [{path, findings}], skipped}`), an array of
+ * `{path, findings}` entries, or a findings array for one artifact. Values
+ * are never copied into the log; paths should already be sanitized.
+ */
+function entriesOf(report, path) {
+  if (!Array.isArray(report)) {
+    return report?.results ?? [];
+  }
+  return report.every((item) => Array.isArray(item?.findings))
+    ? report
+    : [{ path, findings: report }];
+}
+
+export function toSarif(report, { version, path = '-' } = {}) {
+  const entries = entriesOf(report, path);
+  const rules = [],
+    indexes = new Map(),
+    results = [];
+  for (const entry of entries) {
+    const uri = artifactUri(entry.path);
+    for (const finding of entry.findings) {
+      if (!indexes.has(finding.rule)) {
+        indexes.set(finding.rule, rules.length);
+        rules.push({
+          id: finding.rule,
+          name: finding.rule,
+          shortDescription: { text: `${finding.type} (${finding.category})` },
+          defaultConfiguration: {
+            level: levels[finding.category] ?? 'note',
+          },
+          properties: { tags: [finding.category, finding.type] },
+        });
+      }
+      results.push(sarifResult(finding, uri, indexes.get(finding.rule)));
+    }
+  }
+  const skipped = report?.skipped ?? [];
+  return {
+    $schema: schema,
+    version: '2.1.0',
+    runs: [
+      {
+        tool: {
+          driver: {
+            name: 'sensitive-data-sanitizer',
+            informationUri:
+              'https://github.com/link-foundation/sensitive-data-sanitizer',
+            ...(version ? { version } : {}),
+            rules,
+          },
+        },
+        invocations: [
+          {
+            executionSuccessful: report?.complete ?? true,
+            toolExecutionNotifications: skipped.map((item) => ({
+              level: 'warning',
+              message: { text: `Skipped: ${item.reason}` },
+              locations: [
+                {
+                  physicalLocation: {
+                    artifactLocation: { uri: artifactUri(item.path) },
+                  },
+                },
+              ],
+            })),
+          },
+        ],
+        columnKind: 'utf16CodeUnits',
+        results,
+      },
+    ],
+  };
+}

package/src/token-checksum.js

@@ -0,0 +1,49 @@
+// Offline structural check for prefixed tokens that end in a checksum.
+// GitHub (ghp_, gho_, ghu_, ghs_, ghr_) and npm (npm_) tokens append six
+// base62 characters: CRC32 (IEEE) of the characters after the first `_`.
+// A valid checksum raises confidence; an invalid one never removes a finding
+// because truncated or retyped tokens still need redaction.
+const BASE62 = '0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz';
+const CHECKSUM_TOKEN = /^(?:gh[opsur]|npm)_([A-Za-z0-9]{30})([A-Za-z0-9]{6})$/;
+
+let table;
+function crcTable() {
+  table ??= Array.from({ length: 256 }, (_, n) => {
+    let c = n;
+    for (let k = 0; k < 8; k++) {
+      c = c & 1 ? 0xedb88320 ^ (c >>> 1) : c >>> 1;
+    }
+    return c >>> 0;
+  });
+  return table;
+}
+
+export function crc32(text) {
+  let crc = 0xffffffff;
+  for (let i = 0; i < text.length; i++) {
+    crc = crcTable()[(crc ^ text.charCodeAt(i)) & 0xff] ^ (crc >>> 8);
+  }
+  return (crc ^ 0xffffffff) >>> 0;
+}
+
+export function base62(value, width = 6) {
+  let out = '';
+  for (let i = 0; i < width; i++) {
+    out = BASE62[value % 62] + out;
+    value = Math.floor(value / 62);
+  }
+  return out;
+}
+
+// Builds a checksum-valid token from a prefix (including `_`) and a
+// 30-character body, so tests and examples need no stored token literals.
+export function tokenWithChecksum(prefix, body) {
+  return `${prefix}${body}${base62(crc32(body))}`;
+}
+
+// true: checksum matches; false: format matches but checksum does not;
+// undefined: the value is not a checksummed token format.
+export function tokenChecksum(value) {
+  const match = CHECKSUM_TOKEN.exec(value);
+  return match ? base62(crc32(match[1])) === match[2] : undefined;
+}

package/src/transforms.js

@@ -5,6 +5,7 @@ import { encodedValue, encodeRun, decodedRuns } from './encoded.js';
 import { isIdentityType } from './identity.js';
 import { validatePlaceholder, placeholderReplacement } from './placeholders.js';
 import { projectText } from './projection.js';
+import { encryptValue } from './encrypt.js';
 
 const modes = new Set([
   'redact',
@@ -16,6 +17,7 @@ const modes = new Set([
   'date-shift',
   'bucket',
   'placeholder',
+  'encrypt',
 ]);
 export function validateTransforms(options) {
   if (
@@ -86,16 +88,10 @@ function validateTransform(transform) {
       Number.isSafeInteger(transform.days) &&
       Math.abs(transform.days) <= 365000,
     bucket: () => positiveInteger(transform.size),
-    mask: () =>
-      [transform.keepStart ?? 0, transform.keepEnd ?? 0].every(
-        (value) => Number.isSafeInteger(value) && value >= 0
-      ) &&
-      (transform.minLength === undefined ||
-        positiveInteger(transform.minLength)) &&
-      (transform.marker === undefined ||
-        (typeof transform.marker === 'string' &&
-          transform.marker.length > 0 &&
-          transform.marker.length <= 64)),
+    mask: () => validMask(transform),
+    encrypt: () =>
+      typeof transform.key === 'string' &&
+      Buffer.byteLength(transform.key) >= 16,
   };
   if (checks[transform.mode] && !checks[transform.mode]()) {
     throw failure('ERR_CONFIG');
@@ -141,16 +137,112 @@ function shiftedDate(value, days) {
     ? REDACTED
     : date.toISOString().slice(0, 10);
 }
+// Google charactersToIgnore/commonCharactersToIgnore and Presidio-style
+// character classes that a mask may leave visible.
+const maskClasses = {
+  digits: /\p{Nd}/u,
+  upper: /\p{Lu}/u,
+  lower: /\p{Ll}/u,
+  punctuation: /[\p{P}\p{S}]/u,
+  whitespace: /\s/u,
+};
+const maskTuning = ['char', 'ignore', 'ignoreClasses', 'count', 'fromEnd'];
+const unset = (value, test) => value === undefined || test(value);
+const maskChecks = [
+  (t) =>
+    [t.keepStart ?? 0, t.keepEnd ?? 0].every(
+      (value) => Number.isSafeInteger(value) && value >= 0
+    ),
+  (t) => unset(t.minLength, positiveInteger),
+  (t) =>
+    unset(
+      t.marker,
+      (marker) =>
+        !maskTuning.some((key) => t[key] !== undefined) &&
+        typeof marker === 'string' &&
+        marker.length > 0 &&
+        marker.length <= 64
+    ),
+  (t) =>
+    unset(
+      t.char,
+      (char) => typeof char === 'string' && Array.from(char).length === 1
+    ),
+  (t) =>
+    unset(
+      t.ignore,
+      (ignore) =>
+        typeof ignore === 'string' && ignore.length > 0 && ignore.length <= 256
+    ),
+  (t) =>
+    unset(
+      t.ignoreClasses,
+      (names) =>
+        Array.isArray(names) &&
+        names.every((name) => Object.hasOwn(maskClasses, name))
+    ),
+  (t) => unset(t.count, positiveInteger),
+  (t) => unset(t.fromEnd, (value) => typeof value === 'boolean'),
+];
+function validMask(transform) {
+  return maskChecks.every((check) => check(transform));
+}
+// Indexes of the characters a mask replaces, after ignored characters, the
+// direction and the count limit are applied.
+function maskPositions(chars, start, end, transform) {
+  const ignored = (char) =>
+    Boolean(transform.ignore?.includes(char)) ||
+    (transform.ignoreClasses ?? []).some((name) =>
+      maskClasses[name].test(char)
+    );
+  const positions = [];
+  for (let i = start; i < chars.length - end; i++) {
+    if (!ignored(chars[i])) {
+      positions.push(i);
+    }
+  }
+  if (transform.fromEnd) {
+    positions.reverse();
+  }
+  return transform.count === undefined
+    ? positions
+    : positions.slice(0, transform.count);
+}
 function masked(value, finding, transform) {
   const chars = Array.from(value),
     start = transform.keepStart ?? 0,
     end = transform.keepEnd ?? 0;
-  return chars.length <
-    (transform.minLength ?? (isIdentityType(finding.type) ? 5 : 0)) ||
+  if (
+    chars.length <
+      (transform.minLength ?? (isIdentityType(finding.type) ? 5 : 0)) ||
     start + end >= chars.length
-    ? REDACTED
-    : `${chars.slice(0, start).join('')}${transform.marker ?? '*'.repeat(chars.length - start - end)}${end ? chars.slice(-end).join('') : ''}`;
+  ) {
+    return REDACTED;
+  }
+  if (transform.marker !== undefined) {
+    return `${chars.slice(0, start).join('')}${transform.marker}${end ? chars.slice(-end).join('') : ''}`;
+  }
+  const positions = maskPositions(chars, start, end, transform);
+  if (!positions.length) {
+    return REDACTED;
+  }
+  for (const i of positions) {
+    chars[i] = transform.char ?? '*';
+  }
+  return chars.join('');
 }
+// Modes that apply to personal data only; credentials are always redacted.
+const personalModes = {
+  mask: masked,
+  encrypt: (value, finding, transform) =>
+    encryptValue(value, finding.type, transform.key),
+  pseudonym: (value, finding, transform) =>
+    `[PSEUDONYM_${keyed(value, finding.type, transform.key).toString('hex').slice(0, 24)}]`,
+  'format-preserving': (value, finding, transform) =>
+    formatPseudonym(value, finding.type, transform.key),
+  'date-shift': (value, finding, transform) =>
+    shiftedDate(value, transform.days),
+};
 function transformed(value, finding, transform, options) {
   if (typeof transform === 'function') {
     const result = transform(Object.freeze({ ...finding, value }));
@@ -175,17 +267,8 @@ function transformed(value, finding, transform, options) {
   if (finding.category === 'credential') {
     return REDACTED;
   }
-  if (transform.mode === 'mask') {
-    return masked(value, finding, transform);
-  }
-  if (transform.mode === 'pseudonym') {
-    return `[PSEUDONYM_${keyed(value, finding.type, transform.key).toString('hex').slice(0, 24)}]`;
-  }
-  if (transform.mode === 'format-preserving') {
-    return formatPseudonym(value, finding.type, transform.key);
-  }
-  if (transform.mode === 'date-shift') {
-    return shiftedDate(value, transform.days);
+  if (Object.hasOwn(personalModes, transform.mode)) {
+    return personalModes[transform.mode](value, finding, transform);
   }
   const number = Number(value);
   if (!Number.isSafeInteger(number)) {

package/src/vendor/betterleaks/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Zachary Rice
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/src/vendor/betterleaks/provenance.json

@@ -0,0 +1,11 @@
+{
+  "version": "v1.10.0",
+  "source": "https://raw.githubusercontent.com/betterleaks/betterleaks/v1.10.0/config/betterleaks.toml",
+  "sha256": "3489c5044d3a6e5abfd17a381e9de188b6f4fdee49f7f44bae89e2f8932464fa",
+  "rules": 203,
+  "files": 6,
+  "partialFilters": [
+    "box-api-access-token"
+  ],
+  "policy": "Only rule ids absent from the vendored Gitleaks set; original RE2 patterns; entropy and secret-only matchesAny/containsAny filters; no tokenRatio, nearby-line evidence, validation or skipReport components."
+}