@mnemonik/shared 7.131.1 → 7.132.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"secretPatterns.d.ts","sourceRoot":"","sources":["../src/secretPatterns.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAwCG;AAEH,eAAO,MAAM,4BAA4B,eAAe,CAAC;
|
|
1
|
+
{"version":3,"file":"secretPatterns.d.ts","sourceRoot":"","sources":["../src/secretPatterns.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAwCG;AAEH,eAAO,MAAM,4BAA4B,eAAe,CAAC;AASzD,eAAO,MAAM,eAAe,EAAE,aAAa,CAAC,MAAM,CAoDjD,CAAC;AA4HF;;;;;;;GAOG;AACH,wBAAgB,uBAAuB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAc5D;AAED,wBAAgB,YAAY,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAWjD"}
|
package/dist/secretPatterns.js
CHANGED
|
@@ -41,8 +41,14 @@
|
|
|
41
41
|
*/
|
|
42
42
|
export const SECRET_REDACTION_PLACEHOLDER = '[REDACTED]';
|
|
43
43
|
// Shared by the scanner daemon and server-side scrub paths.
|
|
44
|
+
//
|
|
45
|
+
// A value must hold a letter or a digit, in every pattern whose value is free
|
|
46
|
+
// text after a label (key=value, URL userinfo, Bearer): a run of punctuation is
|
|
47
|
+
// never a credential. Before this rule the key=value pattern ate prose about a
|
|
48
|
+
// flag: "--password=; repeated copies" in a stored checkpoint became
|
|
49
|
+
// "--[REDACTED] repeated copies" (2026-10-13), and so did "password: ***".
|
|
44
50
|
export const SECRET_PATTERNS = [
|
|
45
|
-
/(?:api[_-]?key|secret|token|password|credential|auth)\s*[:=]\s
|
|
51
|
+
/(?:api[_-]?key|secret|token|password|credential|auth)\s*[:=]\s*(?=\S*[A-Za-z0-9])\S+/gi,
|
|
46
52
|
// Stripe-shape: (sk|pk)_(live|test)_<24+ alphanumerics>. Catches modern
|
|
47
53
|
// Stripe keys whose body is split by an environment separator that
|
|
48
54
|
// breaks the contiguous-alphanum pattern below. Required `live|test`
|
|
@@ -78,12 +84,12 @@ export const SECRET_PATTERNS = [
|
|
|
78
84
|
// host and path survive for anyone reading the code. Userinfo may contain
|
|
79
85
|
// empty fields or additional `:` / `@` characters; greediness selects its
|
|
80
86
|
// final `@`, while `/`, `?`, and `#` keep paths and queries out of the match.
|
|
81
|
-
/\b[a-z][a-z0-9+.-]*:\/\/[^/\s?#]*@/gi,
|
|
87
|
+
/\b[a-z][a-z0-9+.-]*:\/\/(?=[^/\s?#]*[A-Za-z0-9][^/\s?#]*@)[^/\s?#]*@/gi,
|
|
82
88
|
// Authorization: Bearer <token>. The token class deliberately excludes
|
|
83
89
|
// `<` and `$`, so documentation placeholders (`Bearer <your-api-key>`,
|
|
84
90
|
// `Bearer $MNEMONIK_PROXY_TOKEN`) are left intact - redacting those would
|
|
85
91
|
// destroy the instruction without hiding a secret.
|
|
86
|
-
/Authorization\s*:\s*Bearer\s+[A-Za-z0-9._~+/-]+=*/gi,
|
|
92
|
+
/Authorization\s*:\s*Bearer\s+(?=[._~+/-]*[A-Za-z0-9])[A-Za-z0-9._~+/-]+=*/gi,
|
|
87
93
|
// sshpass -p <password> (also -p'<password>' and -p"<password>"): only the
|
|
88
94
|
// password word is consumed, so the command stays readable. A shell
|
|
89
95
|
// expansion (`$PASS`, `"$PASS"`), a `<placeholder>`, an earlier redaction
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"secretPatterns.js","sourceRoot":"","sources":["../src/secretPatterns.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAwCG;AAEH,MAAM,CAAC,MAAM,4BAA4B,GAAG,YAAY,CAAC;AAEzD,4DAA4D;AAC5D,MAAM,CAAC,MAAM,eAAe,GAA0B;IACpD,
|
|
1
|
+
{"version":3,"file":"secretPatterns.js","sourceRoot":"","sources":["../src/secretPatterns.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAwCG;AAEH,MAAM,CAAC,MAAM,4BAA4B,GAAG,YAAY,CAAC;AAEzD,4DAA4D;AAC5D,EAAE;AACF,8EAA8E;AAC9E,gFAAgF;AAChF,+EAA+E;AAC/E,qEAAqE;AACrE,2EAA2E;AAC3E,MAAM,CAAC,MAAM,eAAe,GAA0B;IACpD,wFAAwF;IACxF,wEAAwE;IACxE,mEAAmE;IACnE,qEAAqE;IACrE,kEAAkE;IAClE,2CAA2C;IAC3C,2CAA2C;IAC3C,gCAAgC;IAChC,sBAAsB;IACtB,0BAA0B;IAC1B,wEAAwE;IACxE,wEAAwE;IACxE,oEAAoE;IACpE,oEAAoE;IACpE,sEAAsE;IACtE,qHAAqH;IACrH,yDAAyD;IACzD,0EAA0E;IAC1E,mEAAmE;IACnE,uBAAuB;IACvB,uBAAuB;IACvB,2EAA2E;IAC3E,2EAA2E;IAC3E,oDAAoD;IACpD,yDAAyD;IACzD,yEAAyE;IACzE,oCAAoC;IACpC,mEAAmE;IACnE,mCAAmC;IACnC,4BAA4B;IAC5B,gCAAgC;IAChC,qCAAqC;IACrC,sEAAsE;IACtE,0EAA0E;IAC1E,0EAA0E;IAC1E,8EAA8E;IAC9E,wEAAwE;IACxE,uEAAuE;IACvE,uEAAuE;IACvE,0EAA0E;IAC1E,mDAAmD;IACnD,6EAA6E;IAC7E,2EAA2E;IAC3E,oEAAoE;IACpE,0EAA0E;IAC1E,yFAAyF;IACzF,6EAA6E;IAC7E,uEAAuE;IACvE,6EAA6E;IAC7E,qBAAqB;IACrB,kTAAkT;CACnT,CAAC;AAEF;;;;;;GAMG;AACH;;;;;;GAMG;AACH,MAAM,iBAAiB,GAAG,gEAAgE,CAAC;AAE3F;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;wEA0CwE;AAExE,MAAM,kBAAkB,GAAG,EAAE,CAAC;AAC9B,MAAM,yBAAyB,GAAG,GAAG,CAAC;AACtC,MAAM,8BAA8B,GAAG,EAAE,CAAC;AAC1C,MAAM,yBAAyB,GAAG,CAAC,CAAC;AAEpC;;;;;GAKG;AACH,4EAA4E;AAC5E,0EAA0E;AAC1E,MAAM,oBAAoB,GAAG,4CAA4C,CAAC;AAC1E,6EAA6E;AAC7E,MAAM,kBAAkB,GAAG,0BAA0B,CAAC;AACtD,+EAA+E;AAC/E,MAAM,wBAAwB,GAAG,kBAAkB,CAAC;AACpD,MAAM,iBAAiB,GAAG,gBAAgB,CAAC;AAC3C,MAAM,qBAAqB,GAAG,sCAAsC,CAAC;AAErE,SAAS,cAAc,CAAC,KAAa;IACnC,MAAM,MAAM,GAAG,IAAI,GAAG,EAAkB,CAAC;IACzC,KAAK,MAAM,EAAE,IAAI,KAAK;QAAE,MAAM,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IAClE,IAAI,IAAI,GAAG,CAAC,CAAC;IACb,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,MAAM,EAAE,EAAE,CAAC;QACpC,MAAM,CAAC,GAAG,KAAK,GAAG,KAAK,CAAC,MAAM,CAAC;QAC/B,IAAI,IAAI,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAC3B,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,eAAe,CAAC,KAAa;IACpC,IAAI,GAAG,GAAG,CAAC,CAAC;IACZ,IAAI,OAAO,GAAG,CAAC,CAAC;IAChB,KAAK,MAAM,EAAE,IAAI,KAAK,EAAE,CAAC;QACvB,IAAI,EAAE,IAAI,GAAG,IAAI,EAAE,IAAI,GAAG,EAAE,CAAC;YAC3B,OAAO,IAAI,CAAC,CAAC;YACb,IAAI,OAAO,GAAG,GAAG;gBAAE,GAAG,GAAG,OAAO,CAAC;QACnC,CAAC;aAAM,CAAC;YACN,OAAO,GAAG,CAAC,CAAC;QACd,CAAC;IACH,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,yEAAyE;AACzE,SAAS,mBAAmB,CAAC,KAAa;IACxC,IAAI,KAAK,CAAC,MAAM,GAAG,kBAAkB;QAAE,OAAO,KAAK,CAAC;IACpD,MAAM,QAAQ,GAAG,KAAK,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;IAC5C,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,IAAI,iBAAiB,CAAC,IAAI,CAAC,QAAQ,CAAC;QAAE,OAAO,KAAK,CAAC,CAAC,iBAAiB;IAC5F,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IACvF,IACE,qBAAqB,CAAC,IAAI,CAAC,KAAK,CAAC;QACjC,KAAK,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,MAAM,IAAI,8BAA8B,CAAC,EACjF,CAAC;QACD,OAAO,KAAK,CAAC,CAAC,wCAAwC;IACxD,CAAC;IACD,IAAI,eAAe,CAAC,KAAK,CAAC,GAAG,yBAAyB;QAAE,OAAO,KAAK,CAAC,CAAC,gBAAgB;IACtF,OAAO,cAAc,CAAC,KAAK,CAAC,IAAI,yBAAyB,CAAC;AAC5D,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,uBAAuB,CAAC,IAAY;IAClD,IAAI,CAAC,IAAI;QAAE,OAAO,IAAI,CAAC;IACvB,OAAO,IAAI,CAAC,OAAO,CAAC,oBAAoB,EAAE,CAAC,KAAK,EAAE,MAAc,EAAE,EAAE;QAClE,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,MAAM,GAAG,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC;QAC3D,IAAI,CAAC,kBAAkB,CAAC,IAAI,CAAC,MAAM,CAAC;YAAE,OAAO,KAAK,CAAC;QACnD,wEAAwE;QACxE,MAAM,eAAe,GAAG,MAAM;aAC3B,OAAO,CAAC,QAAQ,EAAE,EAAE,CAAC;aACrB,OAAO,EAAE;aACT,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;QAChB,IAAI,wBAAwB,CAAC,IAAI,CAAC,eAAe,CAAC;YAAE,OAAO,KAAK,CAAC;QACjE,IAAI,iBAAiB,CAAC,IAAI,CAAC,MAAM,GAAG,KAAK,CAAC;YAAE,OAAO,KAAK,CAAC;QACzD,OAAO,mBAAmB,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,4BAA4B,CAAC,CAAC,CAAC,KAAK,CAAC;IAC3E,CAAC,CAAC,CAAC;AACL,CAAC;AAED,MAAM,UAAU,YAAY,CAAC,IAAY;IACvC,IAAI,CAAC,IAAI;QAAE,OAAO,IAAI,CAAC;IACvB,IAAI,MAAM,GAAG,IAAI,CAAC;IAClB,KAAK,MAAM,OAAO,IAAI,eAAe,EAAE,CAAC;QACtC,MAAM,GAAG,MAAM,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC,KAAK,EAAE,EAAE,CACzC,iBAAiB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,4BAA4B,CACrE,CAAC;IACJ,CAAC;IACD,yEAAyE;IACzE,iEAAiE;IACjE,OAAO,uBAAuB,CAAC,MAAM,CAAC,CAAC;AACzC,CAAC"}
|
package/package.json
CHANGED
package/src/secretPatterns.ts
CHANGED
|
@@ -43,8 +43,14 @@
|
|
|
43
43
|
export const SECRET_REDACTION_PLACEHOLDER = '[REDACTED]';
|
|
44
44
|
|
|
45
45
|
// Shared by the scanner daemon and server-side scrub paths.
|
|
46
|
+
//
|
|
47
|
+
// A value must hold a letter or a digit, in every pattern whose value is free
|
|
48
|
+
// text after a label (key=value, URL userinfo, Bearer): a run of punctuation is
|
|
49
|
+
// never a credential. Before this rule the key=value pattern ate prose about a
|
|
50
|
+
// flag: "--password=; repeated copies" in a stored checkpoint became
|
|
51
|
+
// "--[REDACTED] repeated copies" (2026-10-13), and so did "password: ***".
|
|
46
52
|
export const SECRET_PATTERNS: ReadonlyArray<RegExp> = [
|
|
47
|
-
/(?:api[_-]?key|secret|token|password|credential|auth)\s*[:=]\s
|
|
53
|
+
/(?:api[_-]?key|secret|token|password|credential|auth)\s*[:=]\s*(?=\S*[A-Za-z0-9])\S+/gi,
|
|
48
54
|
// Stripe-shape: (sk|pk)_(live|test)_<24+ alphanumerics>. Catches modern
|
|
49
55
|
// Stripe keys whose body is split by an environment separator that
|
|
50
56
|
// breaks the contiguous-alphanum pattern below. Required `live|test`
|
|
@@ -80,12 +86,12 @@ export const SECRET_PATTERNS: ReadonlyArray<RegExp> = [
|
|
|
80
86
|
// host and path survive for anyone reading the code. Userinfo may contain
|
|
81
87
|
// empty fields or additional `:` / `@` characters; greediness selects its
|
|
82
88
|
// final `@`, while `/`, `?`, and `#` keep paths and queries out of the match.
|
|
83
|
-
/\b[a-z][a-z0-9+.-]*:\/\/[^/\s?#]*@/gi,
|
|
89
|
+
/\b[a-z][a-z0-9+.-]*:\/\/(?=[^/\s?#]*[A-Za-z0-9][^/\s?#]*@)[^/\s?#]*@/gi,
|
|
84
90
|
// Authorization: Bearer <token>. The token class deliberately excludes
|
|
85
91
|
// `<` and `$`, so documentation placeholders (`Bearer <your-api-key>`,
|
|
86
92
|
// `Bearer $MNEMONIK_PROXY_TOKEN`) are left intact - redacting those would
|
|
87
93
|
// destroy the instruction without hiding a secret.
|
|
88
|
-
/Authorization\s*:\s*Bearer\s+[A-Za-z0-9._~+/-]+=*/gi,
|
|
94
|
+
/Authorization\s*:\s*Bearer\s+(?=[._~+/-]*[A-Za-z0-9])[A-Za-z0-9._~+/-]+=*/gi,
|
|
89
95
|
// sshpass -p <password> (also -p'<password>' and -p"<password>"): only the
|
|
90
96
|
// password word is consumed, so the command stays readable. A shell
|
|
91
97
|
// expansion (`$PASS`, `"$PASS"`), a `<placeholder>`, an earlier redaction
|