@link-foundation/sensitive-data-sanitizer 0.19.3 → 0.21.0

package/src/context.js

@@ -2,7 +2,9 @@ import { labels } from './rules.js';
 import { escapePattern, REDACTED } from './detection.js';
 import { credentialPlaceholder, referencePrefix } from './credentials.js';
 import { servicePath } from './public.js';
+import { cookieValues } from './credential-spans.js';
 import { plausiblePerson } from './names.js';
+import { htmlTag } from './html-tags.js';
 
 // Bounded vocabularies are explicit so the short PASS/PW forms do not match
 // unrelated words such as passport. Verb forms cover the supported locales.
@@ -50,14 +52,34 @@ const label = labels.credential
   .filter((word) => !['auth', 'authorization'].includes(word))
   .map(escapePattern)
   .join('|');
-const key = `(?:[\\p{L}\\p{N}]+[_.-])*(?:auth|authorization|PGPASSWORD|${label}|pass|pw)(?:[_.-][\\p{L}\\p{N}]+)*`;
+// Glued service prefixes (`dbpass`, `rootpassword`, `bindpw`, `tlspassword`)
+// are fixed so that ordinary words ending in "pass" stay prose.
+const glued =
+  '(?:db|user|root|admin|smtp|mail|ftp|sftp|ssh|redis|ldap|bind|proxy|tls|ssl|keystore|truststore|store|master|sys|app|login|account|acct|wifi|wpa)(?:password|passwd|pass|pwd|pw|secret|token)';
+// Plural credential names (`--access-tokens`, `API_KEYS`) hold credentials;
+// other plurals (`--max-tokens`, `tokens: 1234`) are accounting.
+const plural =
+  '(?:access|refresh|auth|session|api|bearer|client)[_.-]?(?:tokens|keys|secrets)';
+const key = `(?:[\\p{L}\\p{N}]+[_.-])*(?:auth|authorization|PGPASSWORD|${glued}|${plural}|${label}|pass|pw)(?:[_.-][\\p{L}\\p{N}]+)*`;
+// Ruby/Perl/PHP hash rockets (`'password' => 'x'`, `:token => "x"`) take a
+// quoted literal; an arrow function (`token => token.trim()`) does not.
+const rocket = `=>(?=[ \\t]*\\\\*["'])`;
 // A qualifier such as "for staging" stays on one logical line: it never
 // crosses an escaped line break, an escape sequence or an enclosing quote.
 // Verbs are whole words, so "request" does not end in the verb "est".
 const credentialPrefix = new RegExp(
-  `(?<![\\p{L}\\p{N}_])(?:\\\\*["'])?(${key})(?![\\p{L}\\p{N}_])(?:\\\\*["'])?(?:[ \\t]+(?:от|для|к|for|de|du|del)[ \\t]+[^:=\\r\\n"\\\\]{1,64})?[ \\t]*([:=：]|(?<![\\p{L}\\p{N}_])(?:${verbs})(?![\\p{L}\\p{N}_]))[ \\t]*`,
+  `(?<![\\p{L}\\p{N}_])(?:\\\\*["'])?(${key})(?![\\p{L}\\p{N}_])(?:\\\\*["'])?(?:[ \\t]+(?:от|для|к|for|de|du|del)[ \\t]+[^:=\\r\\n"\\\\]{1,64})?[ \\t]*(${rocket}|[:=：]|(?<![\\p{L}\\p{N}_])(?:${verbs})(?![\\p{L}\\p{N}_]))[ \\t]*`,
   'giu'
 );
+// camelCase and PascalCase keys (`clientSecret`, `secretKey`, `dbPassword`,
+// `ApiSecret`) are case-sensitive: the credential word starts a new word, so
+// `tokenType`, `secretName` and `maxTokens` stay configuration metadata.
+const camelKey =
+  '[\\p{L}][\\p{Ll}\\p{N}]*(?:\\p{Lu}[\\p{Ll}\\p{N}]*)*?(?:Secret|Password|Passwd|Passphrase|Pass|Pwd|Token|Credentials?|(?:Api|Private|Access|Secret|Signing|Encryption|Master|Client|App|Subscription|Account|Storage)Key)(?:Key|Value)?|(?:[Ss]ecret|[Pp]assword|[Pp]asswd|[Tt]oken|[Pp]rivate|[Aa]ccess|[Ss]igning|[Ee]ncryption)(?:Key|Value|Secret|Token)';
+const camelPrefix = new RegExp(
+  `(?<![\\p{L}\\p{N}_$])(?:\\\\*["'])?(${camelKey})(?![\\p{L}\\p{N}_])(?:\\\\*["'])?[ \\t]*(${rocket}|[:=])[ \\t]*`,
+  'gu'
+);
 // Bare generic labels are common English nouns. After a verb they need a
 // value that looks generated; "the token is valid" is prose, not a secret.
 function generatedWord(text, range) {
@@ -107,8 +129,20 @@ function emitValue(text, start, end, emit, details, keyName = '') {
   emit({ start, end, ...details });
 }
 
+// `HIVE_MIND_ROUTER_AUTH_GUARD=0`, `GIT_AUTH_TRANSPORT=1`, `AUTH_MODE=2`:
+// a number or a boolean under a configuration name is a setting. Credential
+// names (`AUTH_TOKEN=123456`, `AUTH_PASSWORD=1`) do not end in one of these.
+const configurationSuffix =
+  /[_.-](?:guard|transport|mode|method|type|kind|flow|strategy|scheme|protocol|port|level|state|status|enabled?|disabled?|required|strict|debug|verbose|timeout|ttl|interval|retries|retry|attempts|count|limit|max|min|size|length|version|flag)$/i;
+const configurationValue =
+  /^(?:[+-]?\d{1,9}(?:\.\d+)?|true|false|yes|no|on|off|enabled|disabled|none)$/i;
+export function configurationSetting(keyName, value) {
+  return configurationSuffix.test(keyName) && configurationValue.test(value);
+}
+
 function credentialMetadata(keyName, value) {
   return (
+    configurationSetting(keyName, value) ||
     (/(?:^|[_.-])auth[_.-](?:mode|method|type)$/i.test(keyName) &&
       /^(?:chatgpt|oauth2?|apikey|api_key|bearer|basic|none)$/i.test(value)) ||
     (keyName === 'id-token' && /^(?:write|read|none)$/.test(value)) ||
@@ -154,15 +188,27 @@ export function valueRange(text, start, mode = 'token', maxLength = Infinity) {
 }
 // Header credentials occupy a scheme and one token even inside shell/JSON
 // strings. A closing quote or escape belongs to the surrounding log record.
-export function authorizationRange(text, start) {
+// The scheme (`token`, `Bearer`, `Digest`) stays readable; only the
+// credential is returned. Auth-param lists (`Digest username="a", nonce=…`,
+// AWS SigV4) return each secret parameter value.
+export function authorizationRanges(text, start) {
   const opening = /^(\\*)(["'])/.exec(text.slice(start));
   start += opening?.[0].length ?? 0;
   const reference = referencePrefix(text.slice(start, start + 512));
   if (reference) {
-    return { start, end: start + reference[0].length };
+    return [{ start, end: start + reference[0].length }];
   }
   const scheme = /^[a-z][a-z0-9_-]*[ \t]+/i.exec(text.slice(start));
   const tokenStart = start + (scheme?.[0].length ?? 0);
+  const params = scheme ? authParams(text, tokenStart) : undefined;
+  if (params) {
+    return params;
+  }
+  const end = authorizationEnd(text, tokenStart);
+  const token = text.slice(tokenStart, end);
+  return usableAuthorization(token) ? [{ start: tokenStart, end }] : [];
+}
+function authorizationEnd(text, tokenStart) {
   const brackets = [];
   let end = tokenStart;
   for (; end < text.length; end++) {
@@ -182,8 +228,69 @@ export function authorizationRange(text, start) {
       break;
     }
   }
-  const token = text.slice(tokenStart, end);
-  return usableAuthorization(token) ? { start, end } : undefined;
+  return end;
+}
+
+// RFC 7616/7235 parameters that name the request, not a secret.
+const publicAuthParam =
+  /^(?:username|realm|uri|qop|algorithm|nc|charset|userhash|domain|stale|SignedHeaders|oauth_signature_method|oauth_version|oauth_timestamp|oauth_callback|keyId|headers|created|expires)$/i;
+const authParam = /^([A-Za-z][\w-]*)[ \t]*=[ \t]*/;
+function authParams(text, start) {
+  const ranges = [];
+  let cursor = start,
+    count = 0,
+    quoted = false;
+  for (;;) {
+    const name = authParam.exec(text.slice(cursor, cursor + 128));
+    if (!name) {
+      break;
+    }
+    const valueStart = cursor + name[0].length;
+    const value = authParamValue(text, valueStart);
+    if (!value) {
+      break;
+    }
+    count++;
+    quoted ||= value.quoted;
+    if (!publicAuthParam.test(name[1]) && value.end > value.start) {
+      ranges.push({ start: value.start, end: value.end });
+    }
+    const separator = /^[ \t]*,[ \t]*/.exec(
+      text.slice(value.after, value.after + 64)
+    );
+    if (!separator) {
+      break;
+    }
+    cursor = value.after + separator[0].length;
+  }
+  // `Basic dXNlcg==` is one token68 credential, not a parameter list.
+  return count > 1 || (count === 1 && quoted) ? ranges : undefined;
+}
+function authParamValue(text, start) {
+  const quote = /^(\\*)"/.exec(text.slice(start, start + 64));
+  if (quote) {
+    // Parameter values are short; a quote further away is not their end.
+    const window = text.slice(start, start + 4096);
+    const offset = window.indexOf(quote[0], quote[0].length);
+    const close = start + offset;
+    if (offset < 0 || /[\r\n]/.test(window.slice(0, offset))) {
+      return undefined;
+    }
+    const after = close + quote[0].length;
+    // A quoted value ends the header or continues the list.
+    if (
+      !/^(?:[ \t]*(?:,|$|[\r\n])|\\*["'\r\n])/.test(
+        text.slice(after, after + 64)
+      )
+    ) {
+      return undefined;
+    }
+    return { start: start + quote[0].length, end: close, after, quoted: true };
+  }
+  const token = /^[^\s,"'\\]{1,4096}/.exec(text.slice(start, start + 4096));
+  return token
+    ? { start, end: start + token[0].length, after: start + token[0].length }
+    : undefined;
 }
 function usableAuthorization(token) {
   return Boolean(token) && !credentialPlaceholder(token);
@@ -262,6 +369,25 @@ function operationalLocationPath(value) {
     servicePath(value) || /^(?:\.?\.?\/)?[\w.-]+(?:\/[\w.-]+)+\/?$/.test(value)
   );
 }
+// Types with a fixed value shape decide on the value alone; `undefined` leaves
+// the decision to the general checks.
+function shapedValueAllowed(value, type) {
+  if (type === 'PHONE') {
+    return (
+      /^\+?[\d () .-]{7,40}$/.test(value) &&
+      /\d{3}/.test(value.replace(/\D/g, ''))
+    );
+  }
+  if (type === 'EMAIL') {
+    return /^[^\s@]+@[^\s@]+\.[\p{L}]{2,63}$/u.test(value);
+  }
+  // A URL holds no whitespace, so prose under a `url` key is left to the
+  // detectors of what the prose contains.
+  if (type === 'URL' && /\s/u.test(value)) {
+    return false;
+  }
+  return undefined;
+}
 // Shared by native labels and the vendor catalogs. Code expressions and
 // line escapes are not personal field values, even when a key is familiar.
 export function personalValueAllowed(text, range, type, labelStart) {
@@ -275,14 +401,9 @@ export function personalValueAllowed(text, range, type, labelStart) {
   ) {
     return false;
   }
-  if (type === 'PHONE') {
-    return (
-      /^\+?[\d () .-]{7,40}$/.test(value) &&
-      /\d{3}/.test(value.replace(/\D/g, ''))
-    );
-  }
-  if (type === 'EMAIL') {
-    return /^[^\s@]+@[^\s@]+\.[\p{L}]{2,63}$/u.test(value);
+  const shaped = shapedValueAllowed(value, type);
+  if (shaped !== undefined) {
+    return shaped;
   }
   if (/^(?:\\[nrt]|[\r\n])/.test(value)) {
     return false;
@@ -359,36 +480,103 @@ function sourceReference(label, tail) {
   );
 }
 
+// A camelCase key is usually source code; an unquoted member chain, call or
+// type annotation after it (`config.clientSecret`, `apiToken: string;`) is
+// a reference, not the secret itself.
+function codeValue(text, start) {
+  return /^(?:[A-Za-z_$][\w$]*(?:\??\.[A-Za-z_$][\w$]*)+(?:\([^()\r\n]*\))?|[A-Za-z_$][\w$]*\([^()\r\n]*\)|(?:string|number|boolean|any|unknown|str|bytes|String|SecretStr|Optional\[str\])(?![\w$]))[ \t]*(?:[,;)}\]]|\r?\n|$)/u.test(
+    text.slice(start, start + 256)
+  );
+}
+
+// Picks how far a credential value runs: to the end of a query parameter, a
+// token, a line or a prose word.
+function credentialMode(text, match) {
+  const prefix = text.slice(Math.max(0, match.index - 512), match.index);
+  if (
+    /(?:https?:\/\/[^\s]*[?&]|^[?&])[^\s]*$/i.test(prefix) ||
+    /[?&]$/.test(prefix)
+  ) {
+    return 'query';
+  }
+  if (/^=>?$/.test(match[2]) || /["']\s*[:：]/.test(match[0])) {
+    return 'token';
+  }
+  return /[:：]/.test(match[2]) ? 'line' : 'prose';
+}
+
+// `token: <script>alert(1)</script>`: markup is the value. A bare
+// `<placeholder>` that ends the value stays a placeholder.
+const angleEnd = {
+  line: /[\r\n"]|\\+[nrt"']/,
+  token: /[\s,;}\]"']|\\+[nrt"']/,
+};
+// Formatting tags around a value (`token=<em>…</em>`) are dropped from the
+// detection view instead.
+const formattingTag = new RegExp(`^${htmlTag}`, 'i');
+function angleValue(text, start, mode) {
+  const tail = text.slice(start, start + 4096);
+  if (text[start] !== '<' || !angleEnd[mode] || formattingTag.test(tail)) {
+    return undefined;
+  }
+  const placeholder = /^<[^<>\r\n]{1,64}>/.exec(tail)?.[0];
+  if (
+    placeholder &&
+    credentialPlaceholder(placeholder) &&
+    angleEnd[mode].test(tail[placeholder.length] ?? '\n')
+  ) {
+    return { start, end: start + placeholder.length };
+  }
+  const stop = tail.search(angleEnd[mode]);
+  return { start, end: start + (stop < 0 ? tail.length : stop) };
+}
+
+function credentialRange(text, match, camel) {
+  const start = match.index + match[0].length;
+  if (
+    sourceReference(match[1], text.slice(start)) ||
+    (camel && codeValue(text, start))
+  ) {
+    return undefined;
+  }
+  if (/^(?:proxy-)?authorization$/i.test(match[1])) {
+    return authorizationRanges(text, start);
+  }
+  const mode = credentialMode(text, match);
+  const range = angleValue(text, start, mode) ?? valueRange(text, start, mode);
+  const value = range && mode === 'prose' ? generatedWord(text, range) : range;
+  if (value && /^(?:set-)?cookie$/i.test(match[1])) {
+    return cookieValues(text, value.start, value.end);
+  }
+  return [value].filter(Boolean);
+}
+
+// `<password>…</password>`, `<clientSecret attr="1">…</clientSecret>`:
+// attributes in the opening tag stay readable.
+const element = (name) =>
+  `<(${name})(?:[ \\t\\r\\n]+[^<>]{0,512})?>([^<]+)</\\1[ \\t]*>`;
+const xmlElement = new RegExp(element(key), 'giu');
+const camelElement = new RegExp(element(camelKey), 'gu');
+
 function detectCredentials(text, emit) {
   const details = { category: 'credential', type: 'SECRET', rule: 'context' };
-  for (const match of text.matchAll(credentialPrefix)) {
-    const start = match.index + match[0].length;
-    const prefix = text.slice(Math.max(0, match.index - 512), match.index);
-    const query =
-      /(?:https?:\/\/[^\s]*[?&]|^[?&])[^\s]*$/i.test(prefix) ||
-      /[?&]$/.test(prefix);
-    const mode = query
-      ? 'query'
-      : match[2] === '=' || /["']\s*[:：]/.test(match[0])
-        ? 'token'
-        : /[:：]/.test(match[2])
-          ? 'line'
-          : 'prose';
-    let range = /^(?:proxy-)?authorization$/i.test(match[1])
-      ? authorizationRange(text, start)
-      : valueRange(text, start, mode);
-    if (range && mode === 'prose') {
-      range = generatedWord(text, range);
-    }
-    if (sourceReference(match[1], text.slice(start))) {
+  const matches = [
+    ...[...text.matchAll(credentialPrefix)].map((match) => [match, false]),
+    ...[...text.matchAll(camelPrefix)].map((match) => [match, true]),
+  ];
+  for (const [match, camel] of matches) {
+    // `https://x-access-token:…@host` is URL user info (`url-userinfo`).
+    if (/:\/\/$/.test(text.slice(Math.max(0, match.index - 3), match.index))) {
       continue;
     }
-    if (range) {
-      emitValue(text, range.start, range.end, emit, details, match[1]);
+    for (const value of credentialRange(text, match, camel) ?? []) {
+      emitValue(text, value.start, value.end, emit, details, match[1]);
     }
   }
-  const xml = new RegExp(`<(${key})[ \\t]*>([^<]+)</\\1[ \\t]*>`, 'giu');
-  for (const match of text.matchAll(xml)) {
+  for (const match of [
+    ...text.matchAll(xmlElement),
+    ...text.matchAll(camelElement),
+  ]) {
     const start = match.index + match[0].indexOf('>') + 1;
     emitValue(text, start, start + match[2].length, emit, details, match[1]);
   }
@@ -417,12 +605,19 @@ const personalPrefixes = Object.entries(labels)
     ];
   });
 
+// "passport number is 912803456": the number word and a following linking
+// verb belong to the label, never to the identity value.
+const identitySuffix = new RegExp(
+  `^(?:(?:number|no\\.?|номер)[ \\t]*(?:[:=：]|(?:${verbs})(?![\\p{L}\\p{N}_]))?[ \\t]*|[№#][ \\t]*)`,
+  'iu'
+);
+
 function detectPersonalLabels(text, emit) {
   for (const [type, prefix] of personalPrefixes) {
     for (const match of text.matchAll(prefix)) {
       const identity = type === 'ID';
       const suffix = identity
-        ? (/^(?:(?:number|no\.?|номер)[ \t]*[:=：]?[ \t]*|[№#][ \t]*)/iu.exec(
+        ? (identitySuffix.exec(
             text.slice(match.index + match[0].length)
           )?.[0] ?? '')
         : '';
@@ -488,7 +683,7 @@ function detectCommandPasswords(text, emit) {
     }
     if (/(?:^|[\s/])curl(?:\s|$)/.test(command)) {
       for (const match of command.matchAll(
-        /(?:^|\s)(?:-u|--user)(?:[ \t]+|=)/g
+        /(?:^|\s)(?:-u|--user|-U|--proxy-user)(?:[ \t]+|=)/g
       )) {
         const range = valueRange(
           text,
@@ -502,10 +697,62 @@ function detectCommandPasswords(text, emit) {
   }
 }
 
+// Kubernetes/compose environment entries name the secret in one field and
+// carry it in the next: `{"name":"DB_PASSWORD","value":"hunter2"}` or
+// `- name: DB_PASSWORD` followed by `value: hunter2`.
+const namedValue = new RegExp(
+  `(["']?)name\\1[ \\t]*:[ \\t]*(["']?)(${key})\\2[ \\t]*,?[ \\t]*(?:\\r?\\n[ \\t]*)?(["']?)value\\4[ \\t]*:[ \\t]*`,
+  'giu'
+);
+// `smtp.login(user, "hunter2")`, `ftp.login('anna', 'pw')`: a literal second
+// argument of a login call is the password.
+const loginCall =
+  /(?<![\p{L}\p{N}_])(?:login|log_in|logIn|signin|sign_in|signIn|authenticate|auth_login|bind_s|simple_bind_s|connect_with_password)[ \t]*\([ \t]*[^,()\r\n]{1,64},[ \t]*(["'])([^"'\\\r\n]{4,128})\1[ \t]*[,)]/gu;
+// Modular crypt and Argon2 password hashes (`$2y$10$…`, `$apr1$…`, `$6$…`)
+// from htpasswd, shadow files and user tables crack offline.
+const passwordHash =
+  /(?<![\p{L}\p{N}_$])\$(?:2[abxy]?\$\d{2}\$[./A-Za-z0-9]{53}|apr1\$[./A-Za-z0-9]{1,8}\$[./A-Za-z0-9]{22}|1\$[./A-Za-z0-9]{1,8}\$[./A-Za-z0-9]{22}|[56]\$(?:rounds=\d{1,9}\$)?[./A-Za-z0-9]{1,16}\$[./A-Za-z0-9]{43,86}|y\$[./A-Za-z0-9]+\$[./A-Za-z0-9]{1,64}\$[./A-Za-z0-9]{43}|argon2(?:id|i|d)\$v=\d+\$m=\d+,t=\d+,p=\d+\$[A-Za-z0-9+/]{11,}\$[A-Za-z0-9+/]{16,})(?![./A-Za-z0-9$])/gu;
+function detectCredentialForms(text, emit) {
+  const details = { category: 'credential', type: 'SECRET' };
+  if (/name/i.test(text)) {
+    for (const match of text.matchAll(namedValue)) {
+      const range = valueRange(text, match.index + match[0].length);
+      if (range) {
+        emitValue(
+          text,
+          range.start,
+          range.end,
+          emit,
+          { ...details, rule: 'named-value' },
+          match[3]
+        );
+      }
+    }
+  }
+  for (const match of text.matchAll(loginCall)) {
+    const start = match.index + match[0].lastIndexOf(match[2]);
+    emitValue(text, start, start + match[2].length, emit, {
+      ...details,
+      rule: 'login-call',
+      confidence: 0.85,
+    });
+  }
+  if (text.includes('$')) {
+    for (const match of text.matchAll(passwordHash)) {
+      emitValue(text, match.index, match.index + match[0].length, emit, {
+        ...details,
+        rule: 'password-hash',
+        confidence: 0.95,
+      });
+    }
+  }
+}
+
 export function detectContext(text, emit, credentialsOnly = false) {
   if (credentialHint.test(text)) {
     detectCredentials(text, emit);
   }
+  detectCredentialForms(text, emit);
   if (!credentialsOnly) {
     detectPersonalLabels(text, emit);
   }

package/src/credential-spans.js

@@ -0,0 +1,180 @@
+import { maskedValue } from './credentials.js';
+
+// Credential findings cover the secret, not the readable context around it:
+// PEM markers, URL hosts and user names, cookie names and the rest of a
+// sentence stay visible, so a masked log still shows what was masked.
+
+// Context rules that read "to the end of the value" without knowing the
+// value's format. A structured vendor token that starts the same value
+// bounds them.
+const openEnded = new Set([
+  'context',
+  'cookie',
+  'named-value',
+  'cli-password',
+  'quoted-entropy',
+  'entropy',
+  'gitleaks/generic-api-key',
+  'betterleaks/generic-api-key',
+]);
+const notBounding = new Set([...openEnded, 'known-secret', 'authorization']);
+const lineBreak = '(?:\\r?\\n|\\\\+[nr])';
+const pemMarker = new RegExp(
+  `-----(BEGIN|END) [A-Z0-9 _-]{0,100}-----(?:[ \\t]*${lineBreak})?`,
+  'g'
+);
+
+// Body spans of every BEGIN/END block inside [start, end). Text between two
+// blocks never belongs to a key; an unterminated block runs to `end`.
+export function pemBodies(text, start, end) {
+  const segment = text.slice(start, end);
+  if (!/^(?:\\*["'])?-----BEGIN /.test(segment)) {
+    return undefined;
+  }
+  const bodies = [];
+  let open;
+  for (const marker of segment.matchAll(pemMarker)) {
+    if (marker[1] === 'BEGIN') {
+      open = marker.index + marker[0].length;
+    } else if (open !== undefined) {
+      bodies.push(trimmed(text, start + open, start + marker.index));
+      open = undefined;
+    }
+  }
+  if (open !== undefined) {
+    bodies.push(trimmed(text, start + open, end));
+  }
+  return bodies.filter((body) => body.end > body.start);
+}
+function trimmed(text, start, end) {
+  const body = text.slice(start, end);
+  const lead = /^(?:\s|\\+[nrt])+/.exec(body)?.[0].length ?? 0;
+  const tail = /(?:\s|\\+[nrt])+$/.exec(body.slice(lead))?.[0].length ?? 0;
+  return { start: start + lead, end: end - tail };
+}
+
+// `scheme://user:password@host`: only the password is the credential.
+const userinfo = /^[a-z][a-z0-9+.-]*:\/\/([^\s/@:]+):([^\s/@]+)@/i;
+// A URL secret keeps its scheme, host and fixed path words
+// (`https://hooks.slack.com/services/`), so a reader still sees which
+// endpoint it was.
+const serviceUser =
+  /^(?:x-access-token|x-oauth-basic|x-token-auth|oauth2?|git|gitlab-ci-token|token|pat|apikey|api)$/i;
+const endpoint = /^(?:https?:\/\/)?[a-z0-9-]+(?:\.[a-z0-9-]+)+\//i;
+const pathWord = /^(?:[a-z]{2,20}(?:\d{1,2})?\/)+/i;
+
+function urlSecret(text, finding) {
+  const value = text.slice(finding.start, finding.end);
+  // `url-userinfo` already covers only `user:password`.
+  const own = finding.rule === 'url-userinfo';
+  const credentials = own
+    ? /^([^:]+):(.+)$/s.exec(value)
+    : userinfo.exec(value);
+  if (credentials) {
+    const end = finding.start + credentials[0].length - (own ? 0 : 1);
+    const start = end - credentials[2].length;
+    const user = start - 1 - credentials[1].length;
+    return [
+      { start, end },
+      // Outside credentialsOnly the user name is still personal data.
+      ...(serviceUser.test(credentials[1]) || maskedValue(credentials[1])
+        ? []
+        : [
+            {
+              start: user,
+              end: user + credentials[1].length,
+              type: 'USERNAME',
+              category: 'personal',
+            },
+          ]),
+    ];
+  }
+  const host = endpoint.exec(value);
+  if (!host || finding.rule === 'url-userinfo') {
+    return undefined;
+  }
+  const words = pathWord.exec(value.slice(host[0].length))?.[0] ?? '';
+  const start = finding.start + host[0].length + words.length;
+  return finding.end - start >= 8 ? [{ start, end: finding.end }] : undefined;
+}
+
+function narrowed(text, finding) {
+  if (finding.category !== 'credential') {
+    return [finding];
+  }
+  const parts =
+    pemBodies(text, finding.start, finding.end) ?? urlSecret(text, finding);
+  return parts ? parts.map((part) => ({ ...finding, ...part })) : [finding];
+}
+
+// `token: ghp_… . Next sentence` — a context value that a vendor rule ends
+// earlier stops at that end when only punctuation or a space follows.
+function bounded(text, finding, findings) {
+  if (!openEnded.has(finding.rule) || finding.category !== 'credential') {
+    return finding;
+  }
+  let end = finding.end;
+  for (const other of findings) {
+    if (
+      other.category === 'credential' &&
+      !notBounding.has(other.rule) &&
+      other.start === finding.start &&
+      other.end < end &&
+      other.end > other.start &&
+      /^[.,;:!?]*(?:\s|$)/.test(text.slice(other.end, finding.end))
+    ) {
+      end = other.end;
+    }
+  }
+  return end === finding.end ? finding : { ...finding, end };
+}
+
+// PEM armor (`-----BEGIN RSA PRIVATE KEY-----`) stays readable, and its
+// upper-case words are not a person or an organization.
+function pemMarkers(text, findings) {
+  const markers = [];
+  for (const finding of findings) {
+    const segment = text.slice(finding.start, finding.end);
+    if (finding.category === 'credential' && /-----BEGIN /.test(segment)) {
+      for (const marker of segment.matchAll(pemMarker)) {
+        const start = finding.start + marker.index;
+        markers.push({ start, end: start + marker[0].length });
+      }
+    }
+  }
+  return markers;
+}
+
+export function refineCredentialSpans(text, findings) {
+  const markers = pemMarkers(text, findings);
+  const narrow = findings
+    .filter(
+      (finding) =>
+        finding.category === 'credential' ||
+        !markers.some(
+          (marker) => finding.start < marker.end && marker.start < finding.end
+        )
+    )
+    .flatMap((finding) => narrowed(text, finding));
+  return narrow.map((finding) => bounded(text, finding, narrow));
+}
+
+// `Cookie: a=1; b=2` and `Set-Cookie: id=…; Path=/; HttpOnly`: each cookie
+// value is a credential; names, separators and attributes stay readable.
+const cookieAttribute =
+  /^(?:path|domain|expires|max-age|samesite|secure|httponly|priority|partitioned|version|comment)$/i;
+export function cookieValues(text, start, end) {
+  const values = [];
+  for (const pair of text.slice(start, end).matchAll(/[^;]+/g)) {
+    const part = /^[ \t]*(?:([^=\s]+)[ \t]*=[ \t]*)?(.*?)[ \t]*$/s.exec(
+      pair[0]
+    );
+    const [, name, value] = part;
+    if (!value || cookieAttribute.test(name ?? value)) {
+      continue;
+    }
+    const valueEnd = start + pair.index + pair[0].replace(/[ \t]+$/, '').length;
+    values.push({ start: valueEnd - value.length, end: valueEnd });
+  }
+  return values;
+}

package/src/credentials-entry.d.ts

@@ -0,0 +1,23 @@
+/**
+ * Credentials-only entry point. It has the same API as the main entry for the
+ * functions it exports, always runs with `credentialsOnly: true`, and rejects
+ * `credentialsOnly: false` and `mode: 'fake'` with `ERR_CONFIG`.
+ */
+export type * from './index.js';
+export {
+  inspect,
+  sanitize,
+  redact,
+  createSanitizer,
+  createSyncSanitizer,
+  REDACTED,
+  entropy,
+  builtInRules,
+  tokenChecksum,
+  tokenWithChecksum,
+  knownSecretsFromEnv,
+  knownSecretsFromGitHubAuth,
+  knownSecretsFromGitHubConfig,
+  reservedPlaceholderTypes,
+  isPlaceholderToken,
+} from './index.js';