@link-foundation/sensitive-data-sanitizer 0.21.1 → 0.21.2

package/CHANGELOG.md

@@ -1,5 +1,11 @@
 # Changelog
 
+## 0.21.2
+
+### Patch Changes
+
+- b5bc2e1: Preserve prose after an existing credential mask on repeated plaintext and encoded sanitization passes, while continuing to detect later credentials and exact known secrets.
+
 ## 0.21.1
 
 ### Patch Changes

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@link-foundation/sensitive-data-sanitizer",
-  "version": "0.21.1",
+  "version": "0.21.2",
   "description": "Offline sensitive-text sanitization with credential, multilingual personal-data and scanner union detection",
   "type": "module",
   "main": "src/index.js",

package/src/credential-spans.js

@@ -107,13 +107,25 @@ function narrowed(text, finding) {
   return parts ? parts.map((part) => ({ ...finding, ...part })) : [finding];
 }
 
+// A complete existing mask bounds context too: vendor rules no longer match
+// it on the next pass. Only strip sentence punctuation, never a glued suffix.
+function maskedPrefix(text, start, end) {
+  const token = /^[^\s]+/u.exec(text.slice(start, end))?.[0] ?? '';
+  let length = token.length;
+  while (length > 0 && /[.,;:!?]/.test(token[length - 1])) {
+    length--;
+  }
+  const value = token.slice(0, length);
+  return maskedValue(value) ? start + value.length : end;
+}
+
 // `token: ghp_… . Next sentence` — a context value that a vendor rule ends
 // earlier stops at that end when only punctuation or a space follows.
 function bounded(text, finding, findings) {
   if (!openEnded.has(finding.rule) || finding.category !== 'credential') {
     return finding;
   }
-  let end = finding.end;
+  let end = maskedPrefix(text, finding.start, finding.end);
   for (const other of findings) {
     if (
       other.category === 'credential' &&

package/src/credentials.js

@@ -56,7 +56,10 @@ export function templatedCredential(text, finding) {
   }
   // A template glued to literal characters (`<x>abc`, `[A]x9`) is not one.
   const after = text[finding.start + value.length] ?? '';
-  return !/[\w$%+/=.-]/.test(after) && templatedValue(value);
+  const sentenceEnd = /^[.,;:!?]+(?:\s|$)/.test(
+    text.slice(finding.start + value.length)
+  );
+  return (!/[\w$%+/=.-]/.test(after) || sentenceEnd) && templatedValue(value);
 }
 // Only variable references and the documented gh lookup are exempt. Arbitrary
 // shell commands and Actions expressions can contain literal credentials.