@microsoft/teamsfx-core 2.0.10-alpha.fa1ce1fbb.0 → 2.0.10-alpha.fe2e47f9c.0

package/build/common/secretmasker/feature.js

@@ -0,0 +1,389 @@
+"use strict";
+// Copyright (c) Microsoft Corporation.
+// Licensed under the MIT license.
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.extractFeatures = exports.tokenize = exports.CredKeywordsEquals = exports.CredKeywordsEndsWith = exports.combinations2 = exports.combinations1 = void 0;
+const dict_1 = require("./dict");
+function combinations1(keys) {
+    const expandedKeys = [];
+    keys.forEach((key) => {
+        if (key.endsWith("password")) {
+            expandedKeys.push(key.substring(0, key.length - 4));
+        }
+        expandedKeys.push(key);
+    });
+    keys = expandedKeys;
+    let results = [];
+    results = results.concat(keys);
+    keys.forEach((key) => {
+        if (key.includes("_")) {
+            const key1 = key.split("_").join("");
+            const key2 = key.split("_").join("-");
+            results.push(key1);
+            results.push(key2);
+        }
+    });
+    return Array.from(new Set(results)).sort();
+}
+exports.combinations1 = combinations1;
+function combinations2(keys) {
+    let results = [];
+    results = results.concat(keys);
+    keys.forEach((key) => {
+        results.push("-" + key);
+        results.push("--" + key);
+    });
+    return Array.from(new Set(results)).sort();
+}
+exports.combinations2 = combinations2;
+exports.CredKeywordsEndsWith = combinations1([
+    "access_key",
+    "access_token",
+    "account_key",
+    "aci_token",
+    "ad_password",
+    "admin_key",
+    "admin_password",
+    "admin_token",
+    "api_key",
+    "api_key_id",
+    "api_secret",
+    "api_token",
+    "app_key",
+    "app_secret",
+    "application_token",
+    "auth_code",
+    "auth_header",
+    "auth_key",
+    "auth_password",
+    "auth_secret",
+    "auth_token",
+    "authenti",
+    "authorization",
+    "aws_access_key_id",
+    "aws_key",
+    "aws_secret_access_key",
+    "azure_cr",
+    "azure_secret",
+    "backup_key",
+    "bank_account_key",
+    "basic_auth",
+    "bearer_token",
+    "billing_key",
+    "cert_id",
+    "card_key",
+    "cert_password",
+    "certificate",
+    "client_certificate",
+    "client_id",
+    "client_key",
+    "client_secret",
+    "cloud_key",
+    "connection_secret",
+    "connection_string",
+    "consumer_id",
+    "consumer_key",
+    "consumer_secret",
+    "cookie_secret",
+    "credential",
+    "crypt_key",
+    "customer_key",
+    "data_encryption_key",
+    "db_password",
+    "db_secret",
+    "db_user",
+    "decryption_key",
+    "device_key",
+    "digital_signature",
+    "disk_encryption_key",
+    "docker_token",
+    "dropbox_token",
+    "encryption_cert",
+    "encryption_key",
+    "encryption_password",
+    "encryption_password_key",
+    "encryption_secret",
+    "env_key",
+    "firewall_password",
+    "ftp_password",
+    "ftp_user",
+    "gcp_credentials",
+    "gcp_key",
+    "gcp_private_key",
+    "git_token",
+    "gitlab_token",
+    "gpg_key",
+    "hash_key",
+    "hipaa_key",
+    "hmac_key",
+    "http_password",
+    "iam_access_key",
+    "id_token",
+    "install_key",
+    "integration_key",
+    "ipsec_key",
+    "jira_token",
+    "kerberos_key",
+    "key",
+    "keystore_password",
+    "kms_key",
+    "kube_config",
+    "kubernetes_token",
+    "ldap_bind_password",
+    "ldap_password",
+    "ldap_secret",
+    "license_key",
+    "login_key",
+    "mac_key",
+    "machine_key",
+    "management_certificate",
+    "master_key",
+    "merchant_key",
+    "mfa_key",
+    "mysql_password",
+    "oauth_id",
+    "oauth_secret",
+    "oauth_token",
+    "oracle_wallet_password",
+    "otp_key",
+    "passphrase",
+    "password",
+    "paypal_secret",
+    "pci_key",
+    "pem_key",
+    "pfx_password",
+    "pg_password",
+    "pgp_key",
+    "pre_shared_key",
+    "preshared_key",
+    "private_cert",
+    "private_encryption_key",
+    "private_key",
+    "private_key_password",
+    "private_password",
+    "private_ssh_key",
+    "private_token",
+    "proxy_password",
+    "rds_password",
+    "recovery_cert",
+    "recovery_key",
+    "recovery_password",
+    "redis_password",
+    "registry_key",
+    "registry_password",
+    "repo_token",
+    "rsa_private_key",
+    "s3_key",
+    "salt_key",
+    "saml_key",
+    "sas_key",
+    "sas_token",
+    "secret",
+    "secret_access_key",
+    "secret_id",
+    "secret_key_base",
+    "secure_string",
+    "security_key",
+    "security_token",
+    "sensitive_data_key",
+    "server_key",
+    "service_account",
+    "session_key",
+    "session_secret",
+    "session_token",
+    "sftp_password",
+    "shared_access_key",
+    "sign_in_key",
+    "sign_key",
+    "signing_cert",
+    "signing_key",
+    "signing_secret",
+    "slack_token",
+    "smtp_password",
+    "smtp_secret",
+    "social_security_key",
+    "ssh_cert",
+    "ssh_key",
+    "ssl_certificate",
+    "ssl_key",
+    "storage_account_key",
+    "storage_key",
+    "subscription_key",
+    "tfa_key",
+    "third_party_key",
+    "tls_key",
+    "tls_secret",
+    "token",
+    "token_key",
+    "token_secret",
+    "tpm_key",
+    "travis_token",
+    "trust_password",
+    "truststore_password",
+    "trust_store_password",
+    "two_factor_auth",
+    "two_factor_key",
+    "upload_token",
+    "user_key",
+    "user_pass",
+    "user_secret",
+    "username_password",
+    "validation_key",
+    "vault_cert",
+    "vault_password",
+    "vault_token",
+    "vcenter_password",
+    "vcs_token",
+    "vpn_key",
+    "vpn_password",
+    "web_auth_secret",
+    "webauthn_secret",
+    "webhook_secret",
+    "wifi_password",
+    "windows_password",
+    "windows_secret",
+    "wpa_password",
+    "x-functions-key",
+    "x509c",
+    "yubikey_password",
+]);
+exports.CredKeywordsEquals = combinations2([
+    "p",
+    "auth",
+    "bearer",
+    "code",
+    "creds",
+    "dapi",
+    "encrypt",
+    "jwt",
+    "pat",
+    "pin",
+    "pw",
+    "pwd",
+    "sas",
+    "sig",
+    "sign_in",
+]);
+// console.log(JSON.stringify(CredKeywordsEndsWith, null, 2));
+function extractCharFeatures(token) {
+    let alphabetNum = 0;
+    let numberNum = 0;
+    let upperCaseNum = 0;
+    let lowerCaseNum = 0;
+    let specialCharNum = 0;
+    const frequency = {};
+    for (const char of token) {
+        if (char >= "0" && char <= "9") {
+            numberNum++;
+        }
+        else if ((char >= "a" && char <= "z") || (char >= "A" && char <= "Z")) {
+            if (char >= "a" && char <= "z") {
+                lowerCaseNum++;
+            }
+            else {
+                upperCaseNum++;
+            }
+            alphabetNum++;
+        }
+        else {
+            specialCharNum++;
+        }
+        frequency[char] = (frequency[char] || 0) + 1;
+    }
+    const length = token.length;
+    const entropy = -Object.values(frequency).reduce((acc, freq) => {
+        const p = freq / length;
+        return acc + p * Math.log2(p);
+    }, 0);
+    const specialCharRatio = specialCharNum / token.length;
+    const charDiversity = Object.keys(frequency).length / token.length;
+    let charCatDiversity = 0;
+    if (alphabetNum > 0)
+        charCatDiversity++;
+    if (numberNum > 0)
+        charCatDiversity++;
+    if (specialCharNum > 0)
+        charCatDiversity++;
+    if (upperCaseNum > 0)
+        charCatDiversity++;
+    if (lowerCaseNum > 0)
+        charCatDiversity++;
+    return {
+        specialCharRatio,
+        charDiversity,
+        charCatDiversity,
+        entropy,
+    };
+}
+// Helper function to check if a token contains common secret-related keywords
+function containsSecretKeywords(token) {
+    if (exports.CredKeywordsEndsWith.some((keyword) => token.toLowerCase().endsWith(keyword)))
+        return 1;
+    if (exports.CredKeywordsEquals.some((keyword) => token.toLowerCase() === keyword))
+        return 1;
+    return 0;
+}
+function tokenize(input) {
+    // Regular expression to match JSON-specific delimiters and whitespace
+    const tokens = input.split(/(\s+|[{}[\],:"=;])/).filter((t) => t.length > 0); // Retain and filter out empty tokens
+    // Map the tokens into an array of Token objects
+    return tokens.map((t) => {
+        if (/\s+/.test(t) || /[{}[\],:"=;]/.test(t)) {
+            return {
+                type: "splitter",
+                token: t,
+            };
+        }
+        else {
+            return {
+                type: "feature",
+                token: t,
+            };
+        }
+    });
+}
+exports.tokenize = tokenize;
+function extractFeatures(text) {
+    const allTokens = tokenize(text);
+    const featureTokens = allTokens.filter((t) => t.type === "feature");
+    for (let i = 0; i < featureTokens.length; i++) {
+        const tokenObj = featureTokens[i];
+        let token = tokenObj.token;
+        if (token.endsWith("<secret>")) {
+            token = token.slice(0, -8);
+            tokenObj.label = 1;
+        }
+        else {
+            tokenObj.label = 0;
+        }
+        // check if the previous token contains secret keyword
+        let preIndicator = 0;
+        if (i - 2 >= 0) {
+            const preToken = featureTokens[i - 1].token;
+            const prePreToken = featureTokens[i - 2].token;
+            if (containsSecretKeywords(preToken) === 1 || containsSecretKeywords(prePreToken) === 1) {
+                preIndicator = 1;
+            }
+        }
+        else if (i - 1 >= 0) {
+            const preToken = featureTokens[i - 1].token;
+            if (containsSecretKeywords(preToken) === 1) {
+                preIndicator = 1;
+            }
+        }
+        const dictMatchRes = dict_1.dictMatcher.match(token);
+        const isDictWord = dictMatchRes === "exact" || dictMatchRes === "contains" ? 1 : 0;
+        const { specialCharRatio, charDiversity, entropy, charCatDiversity } = extractCharFeatures(token);
+        tokenObj.vector = [
+            entropy,
+            specialCharRatio ? 1 : 0,
+            charDiversity,
+            charCatDiversity,
+            isDictWord,
+            preIndicator, //5
+        ];
+    }
+    return allTokens;
+}
+exports.extractFeatures = extractFeatures;
+//# sourceMappingURL=feature.js.map

package/build/common/secretmasker/feature.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"feature.js","sourceRoot":"","sources":["../../../src/common/secretmasker/feature.ts"],"names":[],"mappings":";AAAA,uCAAuC;AACvC,kCAAkC;;;AAElC,iCAAqC;AAErC,SAAgB,aAAa,CAAC,IAAc;IAC1C,MAAM,YAAY,GAAa,EAAE,CAAC;IAClC,IAAI,CAAC,OAAO,CAAC,CAAC,GAAG,EAAE,EAAE;QACnB,IAAI,GAAG,CAAC,QAAQ,CAAC,UAAU,CAAC,EAAE;YAC5B,YAAY,CAAC,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,EAAE,GAAG,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC;SACrD;QACD,YAAY,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACzB,CAAC,CAAC,CAAC;IAEH,IAAI,GAAG,YAAY,CAAC;IAEpB,IAAI,OAAO,GAAa,EAAE,CAAC;IAC3B,OAAO,GAAG,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IAE/B,IAAI,CAAC,OAAO,CAAC,CAAC,GAAG,EAAE,EAAE;QACnB,IAAI,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE;YACrB,MAAM,IAAI,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;YACrC,MAAM,IAAI,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YACtC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACnB,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;SACpB;IACH,CAAC,CAAC,CAAC;IACH,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;AAC7C,CAAC;AAvBD,sCAuBC;AAED,SAAgB,aAAa,CAAC,IAAc;IAC1C,IAAI,OAAO,GAAa,EAAE,CAAC;IAC3B,OAAO,GAAG,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IAC/B,IAAI,CAAC,OAAO,CAAC,CAAC,GAAG,EAAE,EAAE;QACnB,OAAO,CAAC,IAAI,CAAC,GAAG,GAAG,GAAG,CAAC,CAAC;QACxB,OAAO,CAAC,IAAI,CAAC,IAAI,GAAG,GAAG,CAAC,CAAC;IAC3B,CAAC,CAAC,CAAC;IACH,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;AAC7C,CAAC;AARD,sCAQC;AAEY,QAAA,oBAAoB,GAAa,aAAa,CAAC;IAC1D,YAAY;IACZ,cAAc;IACd,aAAa;IACb,WAAW;IACX,aAAa;IACb,WAAW;IACX,gBAAgB;IAChB,aAAa;IACb,SAAS;IACT,YAAY;IACZ,YAAY;IACZ,WAAW;IACX,SAAS;IACT,YAAY;IACZ,mBAAmB;IACnB,WAAW;IACX,aAAa;IACb,UAAU;IACV,eAAe;IACf,aAAa;IACb,YAAY;IACZ,UAAU;IACV,eAAe;IACf,mBAAmB;IACnB,SAAS;IACT,uBAAuB;IACvB,UAAU;IACV,cAAc;IACd,YAAY;IACZ,kBAAkB;IAClB,YAAY;IACZ,cAAc;IACd,aAAa;IACb,SAAS;IACT,UAAU;IACV,eAAe;IACf,aAAa;IACb,oBAAoB;IACpB,WAAW;IACX,YAAY;IACZ,eAAe;IACf,WAAW;IACX,mBAAmB;IACnB,mBAAmB;IACnB,aAAa;IACb,cAAc;IACd,iBAAiB;IACjB,eAAe;IACf,YAAY;IACZ,WAAW;IACX,cAAc;IACd,qBAAqB;IACrB,aAAa;IACb,WAAW;IACX,SAAS;IACT,gBAAgB;IAChB,YAAY;IACZ,mBAAmB;IACnB,qBAAqB;IACrB,cAAc;IACd,eAAe;IACf,iBAAiB;IACjB,gBAAgB;IAChB,qBAAqB;IACrB,yBAAyB;IACzB,mBAAmB;IACnB,SAAS;IACT,mBAAmB;IACnB,cAAc;IACd,UAAU;IACV,iBAAiB;IACjB,SAAS;IACT,iBAAiB;IACjB,WAAW;IACX,cAAc;IACd,SAAS;IACT,UAAU;IACV,WAAW;IACX,UAAU;IACV,eAAe;IACf,gBAAgB;IAChB,UAAU;IACV,aAAa;IACb,iBAAiB;IACjB,WAAW;IACX,YAAY;IACZ,cAAc;IACd,KAAK;IACL,mBAAmB;IACnB,SAAS;IACT,aAAa;IACb,kBAAkB;IAClB,oBAAoB;IACpB,eAAe;IACf,aAAa;IACb,aAAa;IACb,WAAW;IACX,SAAS;IACT,aAAa;IACb,wBAAwB;IACxB,YAAY;IACZ,cAAc;IACd,SAAS;IACT,gBAAgB;IAChB,UAAU;IACV,cAAc;IACd,aAAa;IACb,wBAAwB;IACxB,SAAS;IACT,YAAY;IACZ,UAAU;IACV,eAAe;IACf,SAAS;IACT,SAAS;IACT,cAAc;IACd,aAAa;IACb,SAAS;IACT,gBAAgB;IAChB,eAAe;IACf,cAAc;IACd,wBAAwB;IACxB,aAAa;IACb,sBAAsB;IACtB,kBAAkB;IAClB,iBAAiB;IACjB,eAAe;IACf,gBAAgB;IAChB,cAAc;IACd,eAAe;IACf,cAAc;IACd,mBAAmB;IACnB,gBAAgB;IAChB,cAAc;IACd,mBAAmB;IACnB,YAAY;IACZ,iBAAiB;IACjB,QAAQ;IACR,UAAU;IACV,UAAU;IACV,SAAS;IACT,WAAW;IACX,QAAQ;IACR,mBAAmB;IACnB,WAAW;IACX,iBAAiB;IACjB,eAAe;IACf,cAAc;IACd,gBAAgB;IAChB,oBAAoB;IACpB,YAAY;IACZ,iBAAiB;IACjB,aAAa;IACb,gBAAgB;IAChB,eAAe;IACf,eAAe;IACf,mBAAmB;IACnB,aAAa;IACb,UAAU;IACV,cAAc;IACd,aAAa;IACb,gBAAgB;IAChB,aAAa;IACb,eAAe;IACf,aAAa;IACb,qBAAqB;IACrB,UAAU;IACV,SAAS;IACT,iBAAiB;IACjB,SAAS;IACT,qBAAqB;IACrB,aAAa;IACb,kBAAkB;IAClB,SAAS;IACT,iBAAiB;IACjB,SAAS;IACT,YAAY;IACZ,OAAO;IACP,WAAW;IACX,cAAc;IACd,SAAS;IACT,cAAc;IACd,gBAAgB;IAChB,qBAAqB;IACrB,sBAAsB;IACtB,iBAAiB;IACjB,gBAAgB;IAChB,cAAc;IACd,UAAU;IACV,WAAW;IACX,aAAa;IACb,mBAAmB;IACnB,gBAAgB;IAChB,YAAY;IACZ,gBAAgB;IAChB,aAAa;IACb,kBAAkB;IAClB,WAAW;IACX,SAAS;IACT,cAAc;IACd,iBAAiB;IACjB,iBAAiB;IACjB,gBAAgB;IAChB,eAAe;IACf,kBAAkB;IAClB,gBAAgB;IAChB,cAAc;IACd,iBAAiB;IACjB,OAAO;IACP,kBAAkB;CACnB,CAAC,CAAC;AAEU,QAAA,kBAAkB,GAAa,aAAa,CAAC;IACxD,GAAG;IACH,MAAM;IACN,QAAQ;IACR,MAAM;IACN,OAAO;IACP,MAAM;IACN,SAAS;IACT,KAAK;IACL,KAAK;IACL,KAAK;IACL,IAAI;IACJ,KAAK;IACL,KAAK;IACL,KAAK;IACL,SAAS;CACV,CAAC,CAAC;AAEH,8DAA8D;AAE9D,SAAS,mBAAmB,CAAC,KAAa;IACxC,IAAI,WAAW,GAAG,CAAC,CAAC;IACpB,IAAI,SAAS,GAAG,CAAC,CAAC;IAClB,IAAI,YAAY,GAAG,CAAC,CAAC;IACrB,IAAI,YAAY,GAAG,CAAC,CAAC;IACrB,IAAI,cAAc,GAAG,CAAC,CAAC;IACvB,MAAM,SAAS,GAA2B,EAAE,CAAC;IAC7C,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE;QACxB,IAAI,IAAI,IAAI,GAAG,IAAI,IAAI,IAAI,GAAG,EAAE;YAC9B,SAAS,EAAE,CAAC;SACb;aAAM,IAAI,CAAC,IAAI,IAAI,GAAG,IAAI,IAAI,IAAI,GAAG,CAAC,IAAI,CAAC,IAAI,IAAI,GAAG,IAAI,IAAI,IAAI,GAAG,CAAC,EAAE;YACvE,IAAI,IAAI,IAAI,GAAG,IAAI,IAAI,IAAI,GAAG,EAAE;gBAC9B,YAAY,EAAE,CAAC;aAChB;iBAAM;gBACL,YAAY,EAAE,CAAC;aAChB;YACD,WAAW,EAAE,CAAC;SACf;aAAM;YACL,cAAc,EAAE,CAAC;SAClB;QACD,SAAS,CAAC,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC;KAC9C;IACD,MAAM,MAAM,GAAG,KAAK,CAAC,MAAM,CAAC;IAC5B,MAAM,OAAO,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,IAAI,EAAE,EAAE;QAC7D,MAAM,CAAC,GAAG,IAAI,GAAG,MAAM,CAAC;QACxB,OAAO,GAAG,GAAG,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAChC,CAAC,EAAE,CAAC,CAAC,CAAC;IACN,MAAM,gBAAgB,GAAG,cAAc,GAAG,KAAK,CAAC,MAAM,CAAC;IACvD,MAAM,aAAa,GAAG,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,MAAM,GAAG,KAAK,CAAC,MAAM,CAAC;IACnE,IAAI,gBAAgB,GAAG,CAAC,CAAC;IACzB,IAAI,WAAW,GAAG,CAAC;QAAE,gBAAgB,EAAE,CAAC;IACxC,IAAI,SAAS,GAAG,CAAC;QAAE,gBAAgB,EAAE,CAAC;IACtC,IAAI,cAAc,GAAG,CAAC;QAAE,gBAAgB,EAAE,CAAC;IAC3C,IAAI,YAAY,GAAG,CAAC;QAAE,gBAAgB,EAAE,CAAC;IACzC,IAAI,YAAY,GAAG,CAAC;QAAE,gBAAgB,EAAE,CAAC;IACzC,OAAO;QACL,gBAAgB;QAChB,aAAa;QACb,gBAAgB;QAChB,OAAO;KACR,CAAC;AACJ,CAAC;AAED,8EAA8E;AAC9E,SAAS,sBAAsB,CAAC,KAAa;IAC3C,IAAI,4BAAoB,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;QAAE,OAAO,CAAC,CAAC;IAC5F,IAAI,0BAAkB,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,KAAK,CAAC,WAAW,EAAE,KAAK,OAAO,CAAC;QAAE,OAAO,CAAC,CAAC;IACpF,OAAO,CAAC,CAAC;AACX,CAAC;AAiBD,SAAgB,QAAQ,CAAC,KAAa;IACpC,sEAAsE;IACtE,MAAM,MAAM,GAAa,KAAK,CAAC,KAAK,CAAC,oBAAoB,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,qCAAqC;IAE7H,gDAAgD;IAChD,OAAO,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE;QACtB,IAAI,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,cAAc,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE;YAC3C,OAAO;gBACL,IAAI,EAAE,UAAU;gBAChB,KAAK,EAAE,CAAC;aACT,CAAC;SACH;aAAM;YACL,OAAO;gBACL,IAAI,EAAE,SAAS;gBACf,KAAK,EAAE,CAAC;aACT,CAAC;SACH;IACH,CAAC,CAAC,CAAC;AACL,CAAC;AAlBD,4BAkBC;AAED,SAAgB,eAAe,CAAC,IAAY;IAC1C,MAAM,SAAS,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC;IACjC,MAAM,aAAa,GAAG,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC;IACpE,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,aAAa,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE;QAC7C,MAAM,QAAQ,GAAG,aAAa,CAAC,CAAC,CAAiB,CAAC;QAClD,IAAI,KAAK,GAAG,QAAQ,CAAC,KAAK,CAAC;QAE3B,IAAI,KAAK,CAAC,QAAQ,CAAC,UAAU,CAAC,EAAE;YAC9B,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;YAC3B,QAAQ,CAAC,KAAK,GAAG,CAAC,CAAC;SACpB;aAAM;YACL,QAAQ,CAAC,KAAK,GAAG,CAAC,CAAC;SACpB;QAED,sDAAsD;QACtD,IAAI,YAAY,GAAG,CAAC,CAAC;QAErB,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE;YACd,MAAM,QAAQ,GAAG,aAAa,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC;YAC5C,MAAM,WAAW,GAAG,aAAa,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC;YAC/C,IAAI,sBAAsB,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,sBAAsB,CAAC,WAAW,CAAC,KAAK,CAAC,EAAE;gBACvF,YAAY,GAAG,CAAC,CAAC;aAClB;SACF;aAAM,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE;YACrB,MAAM,QAAQ,GAAG,aAAa,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC;YAC5C,IAAI,sBAAsB,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE;gBAC1C,YAAY,GAAG,CAAC,CAAC;aAClB;SACF;QAED,MAAM,YAAY,GAAG,kBAAW,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QAC9C,MAAM,UAAU,GAAG,YAAY,KAAK,OAAO,IAAI,YAAY,KAAK,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QACnF,MAAM,EAAE,gBAAgB,EAAE,aAAa,EAAE,OAAO,EAAE,gBAAgB,EAAE,GAClE,mBAAmB,CAAC,KAAK,CAAC,CAAC;QAC7B,QAAQ,CAAC,MAAM,GAAG;YAChB,OAAO;YACP,gBAAgB,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;YACxB,aAAa;YACb,gBAAgB;YAChB,UAAU;YACV,YAAY,EAAE,GAAG;SAClB,CAAC;KACH;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AA5CD,0CA4CC"}

package/build/common/secretmasker/masker.d.ts

@@ -0,0 +1,12 @@
+interface SVMModel {
+    coef_: number[][];
+    intercept_: number[];
+}
+declare class SecretMasker {
+    model: SVMModel;
+    predict(features: number[]): number;
+    maskSecret(text: string, replace?: string): string;
+}
+export declare const secretMasker: SecretMasker;
+export {};
+//# sourceMappingURL=masker.d.ts.map

package/build/common/secretmasker/masker.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"masker.d.ts","sourceRoot":"","sources":["../../../src/common/secretmasker/masker.ts"],"names":[],"mappings":"AAYA,UAAU,QAAQ;IAChB,KAAK,EAAE,MAAM,EAAE,EAAE,CAAC;IAClB,UAAU,EAAE,MAAM,EAAE,CAAC;CACtB;AAED,cAAM,YAAY;IAChB,KAAK,EAAE,QAAQ,CAQb;IAEF,OAAO,CAAC,QAAQ,EAAE,MAAM,EAAE,GAAG,MAAM;IAWnC,UAAU,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,SAAQ,GAAG,MAAM;CAalD;AAED,eAAO,MAAM,YAAY,cAAqB,CAAC"}

package/build/common/secretmasker/masker.js

@@ -0,0 +1,54 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.secretMasker = void 0;
+// Copyright (c) Microsoft Corporation.
+// Licensed under the MIT license.
+const feature_1 = require("./feature");
+const WHITE_LIST = [
+    "user-file-path",
+    "publish-app,",
+    "X-Correlation-ID",
+    "innerError",
+    "client-request-id",
+];
+class SecretMasker {
+    constructor() {
+        this.model = {
+            coef_: [
+                [
+                    1.1407116640136614, -1.207072387304919, -0.42671866671203285, 1.760054415121175, 0.0,
+                    1.776337354749609,
+                ],
+            ],
+            intercept_: [-9.96020839830461],
+        };
+    }
+    predict(features) {
+        const { coef_, intercept_ } = this.model;
+        // Calculate the dot product between the features and the coefficients
+        let decisionValue = intercept_[0]; // Start with the intercept
+        for (let i = 0; i < coef_[0].length; i++) {
+            decisionValue += coef_[0][i] * features[i];
+        }
+        // console.log("decisionValue", decisionValue);
+        // If the decision function value is positive, classify as 1 (secret), otherwise 0 (non-secret)
+        return decisionValue > 0 ? 1 : 0;
+    }
+    maskSecret(text, replace = "***") {
+        const tokens = (0, feature_1.extractFeatures)(text);
+        for (const token of tokens) {
+            if (token.type === "splitter")
+                continue;
+            if (WHITE_LIST.includes(token.token))
+                continue;
+            const prediction = this.predict(token.vector);
+            token.label = prediction;
+            if (prediction === 1) {
+                token.token = replace;
+            }
+        }
+        return tokens.map((o) => o.token).join("");
+    }
+}
+exports.secretMasker = new SecretMasker();
+//# sourceMappingURL=masker.js.map

package/build/common/secretmasker/masker.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"masker.js","sourceRoot":"","sources":["../../../src/common/secretmasker/masker.ts"],"names":[],"mappings":";;;AAAA,uCAAuC;AACvC,kCAAkC;AAClC,uCAA4C;AAE5C,MAAM,UAAU,GAAG;IACjB,gBAAgB;IAChB,cAAc;IACd,kBAAkB;IAClB,YAAY;IACZ,mBAAmB;CACpB,CAAC;AAOF,MAAM,YAAY;IAAlB;QACE,UAAK,GAAa;YAChB,KAAK,EAAE;gBACL;oBACE,kBAAkB,EAAE,CAAC,iBAAiB,EAAE,CAAC,mBAAmB,EAAE,iBAAiB,EAAE,GAAG;oBACpF,iBAAiB;iBAClB;aACF;YACD,UAAU,EAAE,CAAC,CAAC,gBAAgB,CAAC;SAChC,CAAC;IA0BJ,CAAC;IAxBC,OAAO,CAAC,QAAkB;QACxB,MAAM,EAAE,KAAK,EAAE,UAAU,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC;QACzC,sEAAsE;QACtE,IAAI,aAAa,GAAG,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,2BAA2B;QAC9D,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE;YACxC,aAAa,IAAI,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,QAAQ,CAAC,CAAC,CAAC,CAAC;SAC5C;QACD,+CAA+C;QAC/C,+FAA+F;QAC/F,OAAO,aAAa,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACnC,CAAC;IACD,UAAU,CAAC,IAAY,EAAE,OAAO,GAAG,KAAK;QACtC,MAAM,MAAM,GAAG,IAAA,yBAAe,EAAC,IAAI,CAAC,CAAC;QACrC,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE;YAC1B,IAAI,KAAK,CAAC,IAAI,KAAK,UAAU;gBAAE,SAAS;YACxC,IAAI,UAAU,CAAC,QAAQ,CAAC,KAAK,CAAC,KAAK,CAAC;gBAAE,SAAS;YAC/C,MAAM,UAAU,GAAG,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,MAAO,CAAC,CAAC;YAC/C,KAAK,CAAC,KAAK,GAAG,UAAU,CAAC;YACzB,IAAI,UAAU,KAAK,CAAC,EAAE;gBACpB,KAAK,CAAC,KAAK,GAAG,OAAO,CAAC;aACvB;SACF;QACD,OAAO,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAC7C,CAAC;CACF;AAEY,QAAA,YAAY,GAAG,IAAI,YAAY,EAAE,CAAC"}

package/build/common/stringUtils.d.ts

@@ -1,12 +1,10 @@
 export interface MaskSecretOptions {
     threshold?: number;
     whiteList?: string[];
+    replace?: string;
 }
-export declare function maskSecret(inputText?: string, option?: {
-    threshold: number;
-    whiteList: string[];
-}): string;
-export declare function maskSecretValues(stdout: string, replace?: string): string;
+export declare function maskSecret(inputText?: string, option?: MaskSecretOptions): string;
+export declare function maskSecretFromEnv(stdout: string, replace?: string): string;
 export declare function convertToAlphanumericOnly(appName: string): string;
 export declare function getResourceGroupNameFromResourceId(resourceId: string): string;
 export declare function parseFromResourceId(pattern: RegExp, resourceId: string): string;

package/build/common/stringUtils.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"stringUtils.d.ts","sourceRoot":"","sources":["../../src/common/stringUtils.ts"],"names":[],"mappings":"AAuFA,MAAM,WAAW,iBAAiB;IAChC,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,EAAE,CAAC;CACtB;AAED,wBAAgB,UAAU,CACxB,SAAS,CAAC,EAAE,MAAM,EAClB,MAAM;;;CAAoD,GACzD,MAAM,CAyBR;AAUD,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,SAAQ,GAAG,MAAM,CAUxE;AAED,wBAAgB,yBAAyB,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAEjE;AAcD,wBAAgB,kCAAkC,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM,CAM7E;AAED,wBAAgB,mBAAmB,CAAC,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,MAAM,CAG/E;AAED,wBAAgB,OAAO,IAAI,MAAM,CAEhC;AAED,wBAAgB,YAAY,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAEpD;AAED,wBAAgB,yBAAyB,IAAI,MAAM,CAElD;AAED,wBAAgB,yBAAyB,IAAI,MAAM,CAElD;AAED,wBAAgB,cAAc,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAQrD"}
+{"version":3,"file":"stringUtils.d.ts","sourceRoot":"","sources":["../../src/common/stringUtils.ts"],"names":[],"mappings":"AAaA,MAAM,WAAW,iBAAiB;IAChC,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,EAAE,CAAC;IACrB,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,wBAAgB,UAAU,CAAC,SAAS,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,iBAAiB,GAAG,MAAM,CAMjF;AAED,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,SAAiB,GAAG,MAAM,CAUlF;AAED,wBAAgB,yBAAyB,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAEjE;AAcD,wBAAgB,kCAAkC,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM,CAM7E;AAED,wBAAgB,mBAAmB,CAAC,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,MAAM,CAG/E;AAED,wBAAgB,OAAO,IAAI,MAAM,CAEhC;AAED,wBAAgB,YAAY,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAEpD;AAED,wBAAgB,yBAAyB,IAAI,MAAM,CAElD;AAED,wBAAgB,yBAAyB,IAAI,MAAM,CAElD;AAED,wBAAgB,cAAc,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAQrD"}

package/build/common/stringUtils.js

@@ -2,129 +2,37 @@
 // Copyright (c) Microsoft Corporation.
 // Licensed under the MIT license.
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.isValidHttpUrl = exports.loadingDefaultPlaceholder = exports.loadingOptionsPlaceholder = exports.getHashedEnv = exports.getUuid = exports.parseFromResourceId = exports.getResourceGroupNameFromResourceId = exports.convertToAlphanumericOnly = exports.maskSecretValues = exports.maskSecret = void 0;
+exports.isValidHttpUrl = exports.loadingDefaultPlaceholder = exports.loadingOptionsPlaceholder = exports.getHashedEnv = exports.getUuid = exports.parseFromResourceId = exports.getResourceGroupNameFromResourceId = exports.convertToAlphanumericOnly = exports.maskSecretFromEnv = exports.maskSecret = void 0;
 const tslib_1 = require("tslib");
 const crypto = tslib_1.__importStar(require("crypto"));
 const Handlebars = tslib_1.__importStar(require("handlebars"));
 const url_1 = require("url");
 const uuid = tslib_1.__importStar(require("uuid"));
-const error_1 = require("../error");
+const common_1 = require("../error/common");
 const localizeUtils_1 = require("./localizeUtils");
-const MIN_ENTROPY = 4;
+const masker_1 = require("./secretmasker/masker");
 const SECRET_REPLACE = "<REDACTED:secret>";
-const USER_REPLACE = "<REDACTED:user>";
-const WHITE_LIST = [
-    "user-file-path",
-    "publish-app,",
-    "X-Correlation-ID",
-    "innerError",
-    "client-request-id",
-];
-function getProbMap(str) {
-    const probMap = new Map();
-    for (const char of str) {
-        probMap.set(char, (probMap.get(char) || 0) + 1);
-    }
-    for (const [char, freq] of probMap.entries()) {
-        const prob = freq / str.length;
-        probMap.set(char, prob);
-    }
-    return probMap;
-}
-// Measure the entropy of a string in bits per symbol.
-function shannonEntropy(str, probMap) {
-    let sum = 0;
-    for (const char of str) {
-        const prob = probMap.get(char) || 0;
-        const delta = (prob * Math.log(prob)) / Math.log(2);
-        sum += delta;
-    }
-    return -sum;
-}
-class Token {
-    constructor(value, splitter) {
-        this.value = value;
-        this.splitter = splitter;
-    }
-}
-function tokenize(text) {
-    const splitterString = " '`\n\t\r\",:{}";
-    const splitterChars = new Set();
-    for (const char of splitterString) {
-        splitterChars.add(char);
-    }
-    const tokens = [];
-    let currentToken = "";
-    for (const char of text) {
-        if (splitterChars.has(char)) {
-            if (currentToken.length > 0) {
-                tokens.push(new Token(currentToken, false));
-                currentToken = "";
-            }
-            tokens.push(new Token(char, true));
-        }
-        else {
-            currentToken += char;
-        }
-    }
-    if (currentToken.length > 0) {
-        tokens.push(new Token(currentToken, false));
-    }
-    return tokens;
-}
-function computeShannonEntropy(token) {
-    if (!token.splitter) {
-        const probMap = getProbMap(token.value);
-        token.entropy = shannonEntropy(token.value, probMap);
-    }
-}
-function maskSecret(inputText, option = { threshold: MIN_ENTROPY, whiteList: WHITE_LIST }) {
+function maskSecret(inputText, option) {
     if (!inputText)
         return "";
-    // mask by secret pattern
-    inputText = maskByPattern(inputText);
-    // mask by .env.xxx.user
-    inputText = maskSecretValues(inputText, SECRET_REPLACE);
-    // mask by entropy
-    let output = "";
-    const tokens = tokenize(inputText);
-    tokens.forEach((token) => {
-        var _a;
-        computeShannonEntropy(token);
-        if (((_a = option.whiteList) === null || _a === void 0 ? void 0 : _a.includes(token.value)) ||
-            token.splitter ||
-            (token.entropy || 0) <= option.threshold) {
-            output += token.value;
-        }
-        else {
-            output += SECRET_REPLACE;
-        }
-    });
-    // for (const token of tokens) {
-    //   console.log(token);
-    // }
+    const replace = (option === null || option === void 0 ? void 0 : option.replace) || SECRET_REPLACE;
+    let output = maskSecretFromEnv(inputText);
+    output = masker_1.secretMasker.maskSecret(output, replace);
     return output;
 }
 exports.maskSecret = maskSecret;
-function maskByPattern(command) {
-    const regexU = /(-u|--username|--user) (\S+)/;
-    const regexP = /(-p|--password|--pwd) (\S+)/;
-    let output = command.replace(regexU, `$1 ${USER_REPLACE}`);
-    output = output.replace(regexP, `$1 ${SECRET_REPLACE}`);
-    return output;
-}
-function maskSecretValues(stdout, replace = "***") {
+function maskSecretFromEnv(stdout, replace = SECRET_REPLACE) {
     for (const key of Object.keys(process.env)) {
         if (key.startsWith("SECRET_")) {
             const value = process.env[key];
             if (value) {
-                stdout = stdout.replace(value, replace);
+                stdout = stdout.replace(new RegExp(value, "g"), replace);
             }
         }
     }
     return stdout;
 }
-exports.maskSecretValues = maskSecretValues;
+exports.maskSecretFromEnv = maskSecretFromEnv;
 function convertToAlphanumericOnly(appName) {
     return appName.replace(/[^\da-zA-Z]/g, "");
 }
@@ -143,7 +51,7 @@ Handlebars.registerHelper("equals", (value, target) => {
 function getResourceGroupNameFromResourceId(resourceId) {
     const result = parseFromResourceId(/\/resourceGroups\/([^\/]*)\//i, resourceId);
     if (!result) {
-        throw new error_1.FailedToParseResourceIdError("resource group name", resourceId);
+        throw new common_1.FailedToParseResourceIdError("resource group name", resourceId);
     }
     return result;
 }
@@ -162,11 +70,11 @@ function getHashedEnv(envName) {
 }
 exports.getHashedEnv = getHashedEnv;
 function loadingOptionsPlaceholder() {
-    return localizeUtils_1.getLocalizedString("ui.select.LoadingOptionsPlaceholder");
+    return (0, localizeUtils_1.getLocalizedString)("ui.select.LoadingOptionsPlaceholder");
 }
 exports.loadingOptionsPlaceholder = loadingOptionsPlaceholder;
 function loadingDefaultPlaceholder() {
-    return localizeUtils_1.getLocalizedString("ui.select.LoadingDefaultPlaceholder");
+    return (0, localizeUtils_1.getLocalizedString)("ui.select.LoadingDefaultPlaceholder");
 }
 exports.loadingDefaultPlaceholder = loadingDefaultPlaceholder;
 function isValidHttpUrl(input) {