@link-foundation/sensitive-data-sanitizer 0.21.4 → 0.21.5

package/CHANGELOG.md

@@ -1,5 +1,11 @@
 # Changelog
 
+## 0.21.5
+
+### Patch Changes
+
+- e61a218: Preserve Authorization and Proxy-Authorization scheme words when overlapping credential heuristics match exactly the scheme before a separate payload. Continue masking payloads, bare credentials, and exact known secrets.
+
 ## 0.21.4
 
 ### Patch Changes

package/docs/API.md

@@ -579,7 +579,7 @@ permission values and literal credential references. `publicKnowledge: false`
 restores IP detection; explicit `knownSecrets` and `knownPersonal` retain
 priority. No shell command or workflow expression is executed.
 
-Authorization headers (including Proxy-Authorization) redact the scheme and one credential token. Whitespace, C0 controls (including NUL), DEL, quotes, backslashes and commas end the value, preserving subsequent log text in shell and escaped JSON prompts. Matching brackets opened within a token are included in its redaction; unmatched closing brackets remain part of the surrounding log. Already-redacted tokens and known credential references remain exempt after an optional scheme, including `<token>` placeholders. The debug callback receives value-free `gitleaks-rule` events with rule ID, input length and elapsed milliseconds; tracing is off by default.
+Authorization headers (including Proxy-Authorization) preserve the scheme and redact the credential payload. Overlapping heuristic findings that cover exactly a scheme followed by a separate nonempty payload are ignored, including Gitleaks generic API-key findings on `SharedAccessSignature`. Bare credentials without a scheme, payload findings and exact `knownSecrets` matches remain subject to redaction. Whitespace, C0 controls (including NUL), DEL, quotes, backslashes and commas end the value, preserving subsequent log text in shell and escaped JSON prompts. Matching brackets opened within a token are included in its redaction; unmatched closing brackets remain part of the surrounding log. Already-redacted tokens and known credential references remain exempt after an optional scheme, including `<token>` placeholders. The debug callback receives value-free `gitleaks-rule` events with rule ID, input length and elapsed milliseconds; tracing is off by default.
 
 ## Caller-declared sensitive fields
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@link-foundation/sensitive-data-sanitizer",
-  "version": "0.21.4",
+  "version": "0.21.5",
   "description": "Offline sensitive-text sanitization with credential, multilingual personal-data and scanner union detection",
   "type": "module",
   "main": "src/index.js",

package/src/context.js

@@ -198,8 +198,8 @@ export function authorizationRanges(text, start) {
   if (reference) {
     return [{ start, end: start + reference[0].length }];
   }
-  const scheme = /^[a-z][a-z0-9_-]*[ \t]+/i.exec(text.slice(start));
-  const tokenStart = start + (scheme?.[0].length ?? 0);
+  const scheme = authorizationScheme(text, start);
+  const tokenStart = scheme?.payloadStart ?? start;
   const params = scheme ? authParams(text, tokenStart) : undefined;
   if (params) {
     return params;
@@ -208,6 +208,25 @@ export function authorizationRanges(text, start) {
   const token = text.slice(tokenStart, end);
   return usableAuthorization(token) ? [{ start: tokenStart, end }] : [];
 }
+
+// A scheme is structural only when a separate, nonempty payload follows it.
+// Share this boundary with span refinement so overlapping vendor detections
+// cannot mask the scheme that the Authorization parser deliberately preserves.
+export function authorizationScheme(text, start) {
+  const opening = /^(\\*)(["'])/.exec(text.slice(start));
+  start += opening?.[0].length ?? 0;
+  const scheme = /^([a-z][a-z0-9_-]*)[ \t]+/i.exec(text.slice(start));
+  if (!scheme) {
+    return undefined;
+  }
+  const payloadStart = start + scheme[0].length;
+  const char = text[payloadStart];
+  return char &&
+    !authorizationDelimiter(char, text.charCodeAt(payloadStart)) &&
+    !/[}\]>]/.test(char)
+    ? { start, end: start + scheme[1].length, payloadStart }
+    : undefined;
+}
 function authorizationEnd(text, tokenStart) {
   const brackets = [];
   let end = tokenStart;

package/src/credential-spans.js

@@ -1,4 +1,5 @@
 import { maskedValue } from './credentials.js';
+import { authorizationScheme } from './context.js';
 
 // Credential findings cover the secret, not the readable context around it:
 // PEM markers, URL hosts and user names, cookie names and the rest of a
@@ -159,7 +160,22 @@ function pemMarkers(text, findings) {
 
 export function refineCredentialSpans(text, findings) {
   const markers = pemMarkers(text, findings);
+  const schemes = new Map();
+  for (const header of text.matchAll(
+    /(?<![\w-])(?:Proxy-)?Authorization(?:\\*["'])?[ \t]*:[ \t]*/gi
+  )) {
+    const scheme = authorizationScheme(text, header.index + header[0].length);
+    if (scheme) {
+      schemes.set(scheme.start, scheme.end);
+    }
+  }
   const narrow = findings
+    .filter(
+      (finding) =>
+        finding.category !== 'credential' ||
+        finding.rule === 'known-secret' ||
+        schemes.get(finding.start) !== finding.end
+    )
     .filter(
       (finding) =>
         finding.category === 'credential' ||