@mnemonik/shared 7.131.0 → 7.132.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
package/dist/secretPatterns.d.ts
CHANGED
|
@@ -20,7 +20,8 @@
|
|
|
20
20
|
* Slack (xox*), Google (AIza), Anthropic (sk-ant-), npm (npm_/npms_)
|
|
21
21
|
* 7. Credentials inside scheme://user:pass@host connection strings
|
|
22
22
|
* 8. Authorization: Bearer headers
|
|
23
|
-
* 9.
|
|
23
|
+
* 9. Command-line passwords given to sshpass
|
|
24
|
+
* 10. Standalone high-entropy tokens matching no known prefix
|
|
24
25
|
* (`redactHighEntropyTokens` - heavily guarded, see below)
|
|
25
26
|
*
|
|
26
27
|
* False-positive cost: a few legitimate strings get replaced with the
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"secretPatterns.d.ts","sourceRoot":"","sources":["../src/secretPatterns.ts"],"names":[],"mappings":"AAAA
|
|
1
|
+
{"version":3,"file":"secretPatterns.d.ts","sourceRoot":"","sources":["../src/secretPatterns.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAwCG;AAEH,eAAO,MAAM,4BAA4B,eAAe,CAAC;AASzD,eAAO,MAAM,eAAe,EAAE,aAAa,CAAC,MAAM,CAoDjD,CAAC;AA4HF;;;;;;;GAOG;AACH,wBAAgB,uBAAuB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAc5D;AAED,wBAAgB,YAAY,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAWjD"}
|
package/dist/secretPatterns.js
CHANGED
|
@@ -20,7 +20,8 @@
|
|
|
20
20
|
* Slack (xox*), Google (AIza), Anthropic (sk-ant-), npm (npm_/npms_)
|
|
21
21
|
* 7. Credentials inside scheme://user:pass@host connection strings
|
|
22
22
|
* 8. Authorization: Bearer headers
|
|
23
|
-
* 9.
|
|
23
|
+
* 9. Command-line passwords given to sshpass
|
|
24
|
+
* 10. Standalone high-entropy tokens matching no known prefix
|
|
24
25
|
* (`redactHighEntropyTokens` - heavily guarded, see below)
|
|
25
26
|
*
|
|
26
27
|
* False-positive cost: a few legitimate strings get replaced with the
|
|
@@ -40,8 +41,14 @@
|
|
|
40
41
|
*/
|
|
41
42
|
export const SECRET_REDACTION_PLACEHOLDER = '[REDACTED]';
|
|
42
43
|
// Shared by the scanner daemon and server-side scrub paths.
|
|
44
|
+
//
|
|
45
|
+
// A value must hold a letter or a digit, in every pattern whose value is free
|
|
46
|
+
// text after a label (key=value, URL userinfo, Bearer): a run of punctuation is
|
|
47
|
+
// never a credential. Before this rule the key=value pattern ate prose about a
|
|
48
|
+
// flag: "--password=; repeated copies" in a stored checkpoint became
|
|
49
|
+
// "--[REDACTED] repeated copies" (2026-10-13), and so did "password: ***".
|
|
43
50
|
export const SECRET_PATTERNS = [
|
|
44
|
-
/(?:api[_-]?key|secret|token|password|credential|auth)\s*[:=]\s
|
|
51
|
+
/(?:api[_-]?key|secret|token|password|credential|auth)\s*[:=]\s*(?=\S*[A-Za-z0-9])\S+/gi,
|
|
45
52
|
// Stripe-shape: (sk|pk)_(live|test)_<24+ alphanumerics>. Catches modern
|
|
46
53
|
// Stripe keys whose body is split by an environment separator that
|
|
47
54
|
// breaks the contiguous-alphanum pattern below. Required `live|test`
|
|
@@ -77,12 +84,21 @@ export const SECRET_PATTERNS = [
|
|
|
77
84
|
// host and path survive for anyone reading the code. Userinfo may contain
|
|
78
85
|
// empty fields or additional `:` / `@` characters; greediness selects its
|
|
79
86
|
// final `@`, while `/`, `?`, and `#` keep paths and queries out of the match.
|
|
80
|
-
/\b[a-z][a-z0-9+.-]*:\/\/[^/\s?#]*@/gi,
|
|
87
|
+
/\b[a-z][a-z0-9+.-]*:\/\/(?=[^/\s?#]*[A-Za-z0-9][^/\s?#]*@)[^/\s?#]*@/gi,
|
|
81
88
|
// Authorization: Bearer <token>. The token class deliberately excludes
|
|
82
89
|
// `<` and `$`, so documentation placeholders (`Bearer <your-api-key>`,
|
|
83
90
|
// `Bearer $MNEMONIK_PROXY_TOKEN`) are left intact - redacting those would
|
|
84
91
|
// destroy the instruction without hiding a secret.
|
|
85
|
-
/Authorization\s*:\s*Bearer\s+[A-Za-z0-9._~+/-]+=*/gi,
|
|
92
|
+
/Authorization\s*:\s*Bearer\s+(?=[._~+/-]*[A-Za-z0-9])[A-Za-z0-9._~+/-]+=*/gi,
|
|
93
|
+
// sshpass -p <password> (also -p'<password>' and -p"<password>"): only the
|
|
94
|
+
// password word is consumed, so the command stays readable. A shell
|
|
95
|
+
// expansion (`$PASS`, `"$PASS"`), a `<placeholder>`, an earlier redaction
|
|
96
|
+
// and quoted punctuation are left, and so is prose about the flag: a bare all-lower-case
|
|
97
|
+
// word counts only when the command sshpass runs (ssh, scp, ...) follows it.
|
|
98
|
+
// Eleven scanned chunks in production carried a root password this way
|
|
99
|
+
// (2026-10-12); the server's memory redactor (src/core/redactCredentials.ts)
|
|
100
|
+
// has the same rule.
|
|
101
|
+
/(?<=\bsshpass(?:[ \t]+-[a-oq-zA-Z]\S*)*[ \t]+-p[ \t]*)(?:'(?![$<]|\[REDACTED\])(?=[^'\n]*[A-Za-z0-9])[^'\n]+'|"(?![$<]|\[REDACTED\])(?=[^"\n]*[A-Za-z0-9])[^"\n]+"|(?![$<'"`(),[{\\]|\[REDACTED\]|[a-z]+[.,:;!?)]*(?![^\s'"`])(?![ \t]+(?:ssh|scp|sftp|rsync|ssh-copy-id|ansible[\w-]*)(?![\w-])))[^\s'"`;|&]+)/g,
|
|
86
102
|
];
|
|
87
103
|
/**
|
|
88
104
|
* Replace recognized secret shapes in `text` with the redaction
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"secretPatterns.js","sourceRoot":"","sources":["../src/secretPatterns.ts"],"names":[],"mappings":"AAAA
|
|
1
|
+
{"version":3,"file":"secretPatterns.js","sourceRoot":"","sources":["../src/secretPatterns.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAwCG;AAEH,MAAM,CAAC,MAAM,4BAA4B,GAAG,YAAY,CAAC;AAEzD,4DAA4D;AAC5D,EAAE;AACF,8EAA8E;AAC9E,gFAAgF;AAChF,+EAA+E;AAC/E,qEAAqE;AACrE,2EAA2E;AAC3E,MAAM,CAAC,MAAM,eAAe,GAA0B;IACpD,wFAAwF;IACxF,wEAAwE;IACxE,mEAAmE;IACnE,qEAAqE;IACrE,kEAAkE;IAClE,2CAA2C;IAC3C,2CAA2C;IAC3C,gCAAgC;IAChC,sBAAsB;IACtB,0BAA0B;IAC1B,wEAAwE;IACxE,wEAAwE;IACxE,oEAAoE;IACpE,oEAAoE;IACpE,sEAAsE;IACtE,qHAAqH;IACrH,yDAAyD;IACzD,0EAA0E;IAC1E,mEAAmE;IACnE,uBAAuB;IACvB,uBAAuB;IACvB,2EAA2E;IAC3E,2EAA2E;IAC3E,oDAAoD;IACpD,yDAAyD;IACzD,yEAAyE;IACzE,oCAAoC;IACpC,mEAAmE;IACnE,mCAAmC;IACnC,4BAA4B;IAC5B,gCAAgC;IAChC,qCAAqC;IACrC,sEAAsE;IACtE,0EAA0E;IAC1E,0EAA0E;IAC1E,8EAA8E;IAC9E,wEAAwE;IACxE,uEAAuE;IACvE,uEAAuE;IACvE,0EAA0E;IAC1E,mDAAmD;IACnD,6EAA6E;IAC7E,2EAA2E;IAC3E,oEAAoE;IACpE,0EAA0E;IAC1E,yFAAyF;IACzF,6EAA6E;IAC7E,uEAAuE;IACvE,6EAA6E;IAC7E,qBAAqB;IACrB,kTAAkT;CACnT,CAAC;AAEF;;;;;;GAMG;AACH;;;;;;GAMG;AACH,MAAM,iBAAiB,GAAG,gEAAgE,CAAC;AAE3F;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;wEA0CwE;AAExE,MAAM,kBAAkB,GAAG,EAAE,CAAC;AAC9B,MAAM,yBAAyB,GAAG,GAAG,CAAC;AACtC,MAAM,8BAA8B,GAAG,EAAE,CAAC;AAC1C,MAAM,yBAAyB,GAAG,CAAC,CAAC;AAEpC;;;;;GAKG;AACH,4EAA4E;AAC5E,0EAA0E;AAC1E,MAAM,oBAAoB,GAAG,4CAA4C,CAAC;AAC1E,6EAA6E;AAC7E,MAAM,kBAAkB,GAAG,0BAA0B,CAAC;AACtD,+EAA+E;AAC/E,MAAM,wBAAwB,GAAG,kBAAkB,CAAC;AACpD,MAAM,iBAAiB,GAAG,gBAAgB,CAAC;AAC3C,MAAM,qBAAqB,GAAG,sCAAsC,CAAC;AAErE,SAAS,cAAc,CAAC,KAAa;IACnC,MAAM,MAAM,GAAG,IAAI,GAAG,EAAkB,CAAC;IACzC,KAAK,MAAM,EAAE,IAAI,KAAK;QAAE,MAAM,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IAClE,IAAI,IAAI,GAAG,CAAC,CAAC;IACb,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,MAAM,EAAE,EAAE,CAAC;QACpC,MAAM,CAAC,GAAG,KAAK,GAAG,KAAK,CAAC,MAAM,CAAC;QAC/B,IAAI,IAAI,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAC3B,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,eAAe,CAAC,KAAa;IACpC,IAAI,GAAG,GAAG,CAAC,CAAC;IACZ,IAAI,OAAO,GAAG,CAAC,CAAC;IAChB,KAAK,MAAM,EAAE,IAAI,KAAK,EAAE,CAAC;QACvB,IAAI,EAAE,IAAI,GAAG,IAAI,EAAE,IAAI,GAAG,EAAE,CAAC;YAC3B,OAAO,IAAI,CAAC,CAAC;YACb,IAAI,OAAO,GAAG,GAAG;gBAAE,GAAG,GAAG,OAAO,CAAC;QACnC,CAAC;aAAM,CAAC;YACN,OAAO,GAAG,CAAC,CAAC;QACd,CAAC;IACH,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,yEAAyE;AACzE,SAAS,mBAAmB,CAAC,KAAa;IACxC,IAAI,KAAK,CAAC,MAAM,GAAG,kBAAkB;QAAE,OAAO,KAAK,CAAC;IACpD,MAAM,QAAQ,GAAG,KAAK,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;IAC5C,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,IAAI,iBAAiB,CAAC,IAAI,CAAC,QAAQ,CAAC;QAAE,OAAO,KAAK,CAAC,CAAC,iBAAiB;IAC5F,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IACvF,IACE,qBAAqB,CAAC,IAAI,CAAC,KAAK,CAAC;QACjC,KAAK,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,MAAM,IAAI,8BAA8B,CAAC,EACjF,CAAC;QACD,OAAO,KAAK,CAAC,CAAC,wCAAwC;IACxD,CAAC;IACD,IAAI,eAAe,CAAC,KAAK,CAAC,GAAG,yBAAyB;QAAE,OAAO,KAAK,CAAC,CAAC,gBAAgB;IACtF,OAAO,cAAc,CAAC,KAAK,CAAC,IAAI,yBAAyB,CAAC;AAC5D,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,uBAAuB,CAAC,IAAY;IAClD,IAAI,CAAC,IAAI;QAAE,OAAO,IAAI,CAAC;IACvB,OAAO,IAAI,CAAC,OAAO,CAAC,oBAAoB,EAAE,CAAC,KAAK,EAAE,MAAc,EAAE,EAAE;QAClE,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,MAAM,GAAG,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC;QAC3D,IAAI,CAAC,kBAAkB,CAAC,IAAI,CAAC,MAAM,CAAC;YAAE,OAAO,KAAK,CAAC;QACnD,wEAAwE;QACxE,MAAM,eAAe,GAAG,MAAM;aAC3B,OAAO,CAAC,QAAQ,EAAE,EAAE,CAAC;aACrB,OAAO,EAAE;aACT,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;QAChB,IAAI,wBAAwB,CAAC,IAAI,CAAC,eAAe,CAAC;YAAE,OAAO,KAAK,CAAC;QACjE,IAAI,iBAAiB,CAAC,IAAI,CAAC,MAAM,GAAG,KAAK,CAAC;YAAE,OAAO,KAAK,CAAC;QACzD,OAAO,mBAAmB,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,4BAA4B,CAAC,CAAC,CAAC,KAAK,CAAC;IAC3E,CAAC,CAAC,CAAC;AACL,CAAC;AAED,MAAM,UAAU,YAAY,CAAC,IAAY;IACvC,IAAI,CAAC,IAAI;QAAE,OAAO,IAAI,CAAC;IACvB,IAAI,MAAM,GAAG,IAAI,CAAC;IAClB,KAAK,MAAM,OAAO,IAAI,eAAe,EAAE,CAAC;QACtC,MAAM,GAAG,MAAM,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC,KAAK,EAAE,EAAE,CACzC,iBAAiB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,4BAA4B,CACrE,CAAC;IACJ,CAAC;IACD,yEAAyE;IACzE,iEAAiE;IACjE,OAAO,uBAAuB,CAAC,MAAM,CAAC,CAAC;AACzC,CAAC"}
|
package/package.json
CHANGED
package/src/secretPatterns.ts
CHANGED
|
@@ -20,7 +20,8 @@
|
|
|
20
20
|
* Slack (xox*), Google (AIza), Anthropic (sk-ant-), npm (npm_/npms_)
|
|
21
21
|
* 7. Credentials inside scheme://user:pass@host connection strings
|
|
22
22
|
* 8. Authorization: Bearer headers
|
|
23
|
-
* 9.
|
|
23
|
+
* 9. Command-line passwords given to sshpass
|
|
24
|
+
* 10. Standalone high-entropy tokens matching no known prefix
|
|
24
25
|
* (`redactHighEntropyTokens` - heavily guarded, see below)
|
|
25
26
|
*
|
|
26
27
|
* False-positive cost: a few legitimate strings get replaced with the
|
|
@@ -42,8 +43,14 @@
|
|
|
42
43
|
export const SECRET_REDACTION_PLACEHOLDER = '[REDACTED]';
|
|
43
44
|
|
|
44
45
|
// Shared by the scanner daemon and server-side scrub paths.
|
|
46
|
+
//
|
|
47
|
+
// A value must hold a letter or a digit, in every pattern whose value is free
|
|
48
|
+
// text after a label (key=value, URL userinfo, Bearer): a run of punctuation is
|
|
49
|
+
// never a credential. Before this rule the key=value pattern ate prose about a
|
|
50
|
+
// flag: "--password=; repeated copies" in a stored checkpoint became
|
|
51
|
+
// "--[REDACTED] repeated copies" (2026-10-13), and so did "password: ***".
|
|
45
52
|
export const SECRET_PATTERNS: ReadonlyArray<RegExp> = [
|
|
46
|
-
/(?:api[_-]?key|secret|token|password|credential|auth)\s*[:=]\s
|
|
53
|
+
/(?:api[_-]?key|secret|token|password|credential|auth)\s*[:=]\s*(?=\S*[A-Za-z0-9])\S+/gi,
|
|
47
54
|
// Stripe-shape: (sk|pk)_(live|test)_<24+ alphanumerics>. Catches modern
|
|
48
55
|
// Stripe keys whose body is split by an environment separator that
|
|
49
56
|
// breaks the contiguous-alphanum pattern below. Required `live|test`
|
|
@@ -79,12 +86,21 @@ export const SECRET_PATTERNS: ReadonlyArray<RegExp> = [
|
|
|
79
86
|
// host and path survive for anyone reading the code. Userinfo may contain
|
|
80
87
|
// empty fields or additional `:` / `@` characters; greediness selects its
|
|
81
88
|
// final `@`, while `/`, `?`, and `#` keep paths and queries out of the match.
|
|
82
|
-
/\b[a-z][a-z0-9+.-]*:\/\/[^/\s?#]*@/gi,
|
|
89
|
+
/\b[a-z][a-z0-9+.-]*:\/\/(?=[^/\s?#]*[A-Za-z0-9][^/\s?#]*@)[^/\s?#]*@/gi,
|
|
83
90
|
// Authorization: Bearer <token>. The token class deliberately excludes
|
|
84
91
|
// `<` and `$`, so documentation placeholders (`Bearer <your-api-key>`,
|
|
85
92
|
// `Bearer $MNEMONIK_PROXY_TOKEN`) are left intact - redacting those would
|
|
86
93
|
// destroy the instruction without hiding a secret.
|
|
87
|
-
/Authorization\s*:\s*Bearer\s+[A-Za-z0-9._~+/-]+=*/gi,
|
|
94
|
+
/Authorization\s*:\s*Bearer\s+(?=[._~+/-]*[A-Za-z0-9])[A-Za-z0-9._~+/-]+=*/gi,
|
|
95
|
+
// sshpass -p <password> (also -p'<password>' and -p"<password>"): only the
|
|
96
|
+
// password word is consumed, so the command stays readable. A shell
|
|
97
|
+
// expansion (`$PASS`, `"$PASS"`), a `<placeholder>`, an earlier redaction
|
|
98
|
+
// and quoted punctuation are left, and so is prose about the flag: a bare all-lower-case
|
|
99
|
+
// word counts only when the command sshpass runs (ssh, scp, ...) follows it.
|
|
100
|
+
// Eleven scanned chunks in production carried a root password this way
|
|
101
|
+
// (2026-10-12); the server's memory redactor (src/core/redactCredentials.ts)
|
|
102
|
+
// has the same rule.
|
|
103
|
+
/(?<=\bsshpass(?:[ \t]+-[a-oq-zA-Z]\S*)*[ \t]+-p[ \t]*)(?:'(?![$<]|\[REDACTED\])(?=[^'\n]*[A-Za-z0-9])[^'\n]+'|"(?![$<]|\[REDACTED\])(?=[^"\n]*[A-Za-z0-9])[^"\n]+"|(?![$<'"`(),[{\\]|\[REDACTED\]|[a-z]+[.,:;!?)]*(?![^\s'"`])(?![ \t]+(?:ssh|scp|sftp|rsync|ssh-copy-id|ansible[\w-]*)(?![\w-])))[^\s'"`;|&]+)/g,
|
|
88
104
|
];
|
|
89
105
|
|
|
90
106
|
/**
|