@link-foundation/sensitive-data-sanitizer 0.19.3 → 0.21.0

package/src/transforms.js

@@ -1,10 +1,11 @@
-import { realisticFake } from './fake.js';
+import { feature } from './features.js';
 import { createHmac } from 'node:crypto';
 import { failure, REDACTED } from './detection.js';
 import { encodedValue, encodeRun, decodedRuns } from './encoded.js';
-import { isIdentityType } from './identity.js';
+import { isIdentityType } from './identity-types.js';
 import { validatePlaceholder, placeholderReplacement } from './placeholders.js';
 import { projectText } from './projection.js';
+import { encryptValue } from './encrypt.js';
 
 const modes = new Set([
   'redact',
@@ -16,6 +17,7 @@ const modes = new Set([
   'date-shift',
   'bucket',
   'placeholder',
+  'encrypt',
 ]);
 export function validateTransforms(options) {
   if (
@@ -86,16 +88,10 @@ function validateTransform(transform) {
       Number.isSafeInteger(transform.days) &&
       Math.abs(transform.days) <= 365000,
     bucket: () => positiveInteger(transform.size),
-    mask: () =>
-      [transform.keepStart ?? 0, transform.keepEnd ?? 0].every(
-        (value) => Number.isSafeInteger(value) && value >= 0
-      ) &&
-      (transform.minLength === undefined ||
-        positiveInteger(transform.minLength)) &&
-      (transform.marker === undefined ||
-        (typeof transform.marker === 'string' &&
-          transform.marker.length > 0 &&
-          transform.marker.length <= 64)),
+    mask: () => validMask(transform),
+    encrypt: () =>
+      typeof transform.key === 'string' &&
+      Buffer.byteLength(transform.key) >= 16,
   };
   if (checks[transform.mode] && !checks[transform.mode]()) {
     throw failure('ERR_CONFIG');
@@ -141,16 +137,112 @@ function shiftedDate(value, days) {
     ? REDACTED
     : date.toISOString().slice(0, 10);
 }
+// Google charactersToIgnore/commonCharactersToIgnore and Presidio-style
+// character classes that a mask may leave visible.
+const maskClasses = {
+  digits: /\p{Nd}/u,
+  upper: /\p{Lu}/u,
+  lower: /\p{Ll}/u,
+  punctuation: /[\p{P}\p{S}]/u,
+  whitespace: /\s/u,
+};
+const maskTuning = ['char', 'ignore', 'ignoreClasses', 'count', 'fromEnd'];
+const unset = (value, test) => value === undefined || test(value);
+const maskChecks = [
+  (t) =>
+    [t.keepStart ?? 0, t.keepEnd ?? 0].every(
+      (value) => Number.isSafeInteger(value) && value >= 0
+    ),
+  (t) => unset(t.minLength, positiveInteger),
+  (t) =>
+    unset(
+      t.marker,
+      (marker) =>
+        !maskTuning.some((key) => t[key] !== undefined) &&
+        typeof marker === 'string' &&
+        marker.length > 0 &&
+        marker.length <= 64
+    ),
+  (t) =>
+    unset(
+      t.char,
+      (char) => typeof char === 'string' && Array.from(char).length === 1
+    ),
+  (t) =>
+    unset(
+      t.ignore,
+      (ignore) =>
+        typeof ignore === 'string' && ignore.length > 0 && ignore.length <= 256
+    ),
+  (t) =>
+    unset(
+      t.ignoreClasses,
+      (names) =>
+        Array.isArray(names) &&
+        names.every((name) => Object.hasOwn(maskClasses, name))
+    ),
+  (t) => unset(t.count, positiveInteger),
+  (t) => unset(t.fromEnd, (value) => typeof value === 'boolean'),
+];
+function validMask(transform) {
+  return maskChecks.every((check) => check(transform));
+}
+// Indexes of the characters a mask replaces, after ignored characters, the
+// direction and the count limit are applied.
+function maskPositions(chars, start, end, transform) {
+  const ignored = (char) =>
+    Boolean(transform.ignore?.includes(char)) ||
+    (transform.ignoreClasses ?? []).some((name) =>
+      maskClasses[name].test(char)
+    );
+  const positions = [];
+  for (let i = start; i < chars.length - end; i++) {
+    if (!ignored(chars[i])) {
+      positions.push(i);
+    }
+  }
+  if (transform.fromEnd) {
+    positions.reverse();
+  }
+  return transform.count === undefined
+    ? positions
+    : positions.slice(0, transform.count);
+}
 function masked(value, finding, transform) {
   const chars = Array.from(value),
     start = transform.keepStart ?? 0,
     end = transform.keepEnd ?? 0;
-  return chars.length <
-    (transform.minLength ?? (isIdentityType(finding.type) ? 5 : 0)) ||
+  if (
+    chars.length <
+      (transform.minLength ?? (isIdentityType(finding.type) ? 5 : 0)) ||
     start + end >= chars.length
-    ? REDACTED
-    : `${chars.slice(0, start).join('')}${transform.marker ?? '*'.repeat(chars.length - start - end)}${end ? chars.slice(-end).join('') : ''}`;
+  ) {
+    return REDACTED;
+  }
+  if (transform.marker !== undefined) {
+    return `${chars.slice(0, start).join('')}${transform.marker}${end ? chars.slice(-end).join('') : ''}`;
+  }
+  const positions = maskPositions(chars, start, end, transform);
+  if (!positions.length) {
+    return REDACTED;
+  }
+  for (const i of positions) {
+    chars[i] = transform.char ?? '*';
+  }
+  return chars.join('');
 }
+// Modes that apply to personal data only; credentials are always redacted.
+const personalModes = {
+  mask: masked,
+  encrypt: (value, finding, transform) =>
+    encryptValue(value, finding.type, transform.key),
+  pseudonym: (value, finding, transform) =>
+    `[PSEUDONYM_${keyed(value, finding.type, transform.key).toString('hex').slice(0, 24)}]`,
+  'format-preserving': (value, finding, transform) =>
+    formatPseudonym(value, finding.type, transform.key),
+  'date-shift': (value, finding, transform) =>
+    shiftedDate(value, transform.days),
+};
 function transformed(value, finding, transform, options) {
   if (typeof transform === 'function') {
     const result = transform(Object.freeze({ ...finding, value }));
@@ -170,22 +262,13 @@ function transformed(value, finding, transform, options) {
       : REDACTED;
   }
   if (transform.mode === 'fake') {
-    return realisticFake(value, finding, transform, options);
+    return feature('realisticFake')(value, finding, transform, options);
   }
   if (finding.category === 'credential') {
     return REDACTED;
   }
-  if (transform.mode === 'mask') {
-    return masked(value, finding, transform);
-  }
-  if (transform.mode === 'pseudonym') {
-    return `[PSEUDONYM_${keyed(value, finding.type, transform.key).toString('hex').slice(0, 24)}]`;
-  }
-  if (transform.mode === 'format-preserving') {
-    return formatPseudonym(value, finding.type, transform.key);
-  }
-  if (transform.mode === 'date-shift') {
-    return shiftedDate(value, transform.days);
+  if (Object.hasOwn(personalModes, transform.mode)) {
+    return personalModes[transform.mode](value, finding, transform);
   }
   const number = Number(value);
   if (!Number.isSafeInteger(number)) {
@@ -194,6 +277,32 @@ function transformed(value, finding, transform, options) {
   const lower = Math.floor(number / transform.size) * transform.size;
   return `${lower}–${lower + transform.size - 1}`;
 }
+function jsonValueText(raw) {
+  try {
+    const value = JSON.parse(raw);
+    return typeof value === 'string' && value ? value : raw;
+  } catch {
+    return raw;
+  }
+}
+// A whole JSON value becomes one JSON string. Placeholder mode types it by the
+// field it came from, so `{"age":34}` reads `{"age":"Age-1"}`.
+function jsonValueReplacement(text, finding, options) {
+  const transform =
+    options.transformations?.JSON_VALUE ?? options.transformation;
+  if (transform?.mode !== 'placeholder') {
+    return JSON.stringify(REDACTED);
+  }
+  const raw = text.slice(finding.start, finding.end);
+  return JSON.stringify(
+    placeholderReplacement(
+      jsonValueText(raw),
+      { ...finding, type: finding.valueType ?? 'SENSITIVE' },
+      transform,
+      options
+    )
+  );
+}
 export function renderReplacement(
   text,
   finding,
@@ -202,7 +311,7 @@ export function renderReplacement(
   jsonRanges
 ) {
   if (finding.type === 'JSON_VALUE') {
-    return JSON.stringify(REDACTED);
+    return jsonValueReplacement(text, finding, options);
   }
   const transform =
     options.transformations?.[finding.type] ??
@@ -217,11 +326,15 @@ export function renderReplacement(
       const sanitized = encodedSanitize(run.text).text;
       // Mapped escaped fragments can lose their detecting context on decode.
       // Redact the fragment if recursive scanning makes no progress.
-      return encodeRun(run, sanitized === run.text ? REDACTED : sanitized);
-    }
-    if (options.preserveEncoding) {
-      throw failure('ERR_ENCODING');
+      const encoded = encodeRun(
+        run,
+        sanitized === run.text ? REDACTED : sanitized
+      );
+      if (encoded !== undefined) {
+        return encoded;
+      }
     }
+    // Without a recognizable re-encoding, the encoded text itself is masked.
   }
   return renderValue(text, finding, transform, options, jsonRanges);
 }

package/src/vendor/betterleaks/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Zachary Rice
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/src/vendor/betterleaks/provenance.json

@@ -0,0 +1,11 @@
+{
+  "version": "v1.10.0",
+  "source": "https://raw.githubusercontent.com/betterleaks/betterleaks/v1.10.0/config/betterleaks.toml",
+  "sha256": "3489c5044d3a6e5abfd17a381e9de188b6f4fdee49f7f44bae89e2f8932464fa",
+  "rules": 203,
+  "files": 6,
+  "partialFilters": [
+    "box-api-access-token"
+  ],
+  "policy": "Only rule ids absent from the vendored Gitleaks set; original RE2 patterns; entropy and secret-only matchesAny/containsAny filters; no tokenRatio, nearby-line evidence, validation or skipReport components."
+}