@node9/policy-engine 1.5.0 → 1.27.0

package/dist/index.js

@@ -525,6 +525,42 @@ var DLP_PATTERNS = [
     regex: /\bAGE-SECRET-KEY-1[QPZRY9X8GF2TVDW0S3JNLH]{58}\b/,
     severity: "block",
     keywords: ["age-secret-key-"]
+  },
+  // ── Database connection strings ───────────────────────────────────────────
+  // Universal <scheme>://[user]:<password>@<host> shape. Covers the gap
+  // vendor-prefix patterns (AWS / GitHub / Stripe / …) leave open. Matches
+  // the whole URL so maskSecret produces `<scheme>...:****@...<host>` —
+  // the password value never appears in the redacted sample.
+  //
+  // Schemes covered: redis, rediss (TLS), postgres, postgresql,
+  // mongodb, mongodb+srv, mysql, mariadb, amqp, amqps, kafka,
+  // clickhouse, cassandra. HTTP(S) / FTP / SSH are intentionally
+  // excluded — they're not database URLs and adding them would
+  // create false positives on every basic-auth URL in the wild.
+  //
+  // Requires `:password@` (4+ char password) so user-only URLs like
+  // `redis://user@host` don't match. Stopwords ('your', '${', '<your',
+  // 'placeholder', 'changeme', etc.) keep doc/README scans clean.
+  {
+    name: "Database Connection String",
+    regex: /\b(redis|rediss|postgres|postgresql|mongodb|mongodb\+srv|mysql|mariadb|amqp|amqps|kafka|clickhouse|cassandra):\/\/[^:/\s@]*:[^@\s]{4,}@[^\s/]+/,
+    severity: "block",
+    keywords: [
+      "redis://",
+      "rediss://",
+      "postgres://",
+      "postgresql://",
+      "mongodb://",
+      "mongodb+srv://",
+      "mysql://",
+      "mariadb://",
+      "amqp://",
+      "amqps://",
+      "kafka://",
+      "clickhouse://",
+      "cassandra://"
+    ],
+    minEntropy: 3
   }
 ];
 var DLP_PATTERNS_GLOBAL = DLP_PATTERNS.map(
@@ -923,7 +959,7 @@ var SENSITIVE_PATH_RULES = [
   },
   {
     // Mirrors the JSON shield's `.env` pattern (project-jail.json's
-    // review-read-env-any-tool) so the AST FS-op path catches the
+    // block-read-env-any-tool) so the AST FS-op path catches the
     // same set the regex shield does — including Next.js / Vite's
     // `.env.<env>.local` double-suffix overrides which are commonly
     // gitignored AND commonly contain real secrets.
@@ -2435,7 +2471,7 @@ var project_jail_default = {
         {
           field: "command",
           op: "matches",
-          value: "(cat|less|head|tail|bat|more|open|print|nano|vim|vi|emacs|code|type)\\s+.*?\\.ssh[\\/\\\\]",
+          value: "(cat|less|head|tail|bat|more|open|print|nano|vim|vi|emacs|code|type|grep|egrep|fgrep|rg|ag|ack|awk|gawk|sed|cut|tr|jq|yq|od|xxd|hexdump|strings|sort|uniq|tac|nl|dd)\\s+.*?\\.ssh[\\/\\\\]",
           flags: "i"
         }
       ],
@@ -2449,7 +2485,7 @@ var project_jail_default = {
         {
           field: "command",
           op: "matches",
-          value: "(cat|less|head|tail|bat|more|open|print|nano|vim|vi|emacs|code|type)\\s+.*?\\.aws[\\/\\\\]",
+          value: "(cat|less|head|tail|bat|more|open|print|nano|vim|vi|emacs|code|type|grep|egrep|fgrep|rg|ag|ack|awk|gawk|sed|cut|tr|jq|yq|od|xxd|hexdump|strings|sort|uniq|tac|nl|dd)\\s+.*?\\.aws[\\/\\\\]",
           flags: "i"
         }
       ],
@@ -2463,7 +2499,7 @@ var project_jail_default = {
         {
           field: "command",
           op: "matches",
-          value: "(cat|less|head|tail|bat|more|open|print|nano|vim|vi|emacs|code|type)\\s+.*\\.env(\\.local|\\.production|\\.staging)?\\b",
+          value: "(cat|less|head|tail|bat|more|open|print|nano|vim|vi|emacs|code|type|grep|egrep|fgrep|rg|ag|ack|awk|gawk|sed|cut|tr|jq|yq|od|xxd|hexdump|strings|sort|uniq|tac|nl|dd)\\s+.*?\\.env(\\.(local|production|staging|development|production\\.local|staging\\.local|development\\.local))?(?=\\s|$|[;&|>)<])",
           flags: "i"
         }
       ],
@@ -2477,7 +2513,7 @@ var project_jail_default = {
         {
           field: "command",
           op: "matches",
-          value: "(cat|less|head|tail|bat|more|open|print|nano|vim|vi|emacs|code|type)\\s+.*(credentials\\.json|\\.netrc|\\.npmrc|\\.docker[\\/\\\\]config\\.json|gcloud[\\/\\\\]credentials)",
+          value: "(cat|less|head|tail|bat|more|open|print|nano|vim|vi|emacs|code|type|grep|egrep|fgrep|rg|ag|ack|awk|gawk|sed|cut|tr|jq|yq|od|xxd|hexdump|strings|sort|uniq|tac|nl|dd)\\s+.*(credentials\\.json|\\.netrc|\\.npmrc|\\.docker[\\/\\\\]config\\.json|gcloud[\\/\\\\]credentials)",
           flags: "i"
         }
       ],
@@ -2513,7 +2549,7 @@ var project_jail_default = {
       reason: "Reading AWS credentials is blocked by project-jail shield"
     },
     {
-      name: "shield:project-jail:review-read-env-any-tool",
+      name: "shield:project-jail:block-read-env-any-tool",
       tool: "*",
       conditions: [
         {
@@ -2523,8 +2559,8 @@ var project_jail_default = {
           flags: "i"
         }
       ],
-      verdict: "review",
-      reason: "Reading .env files requires approval (project-jail shield)"
+      verdict: "block",
+      reason: "Reading .env files is blocked by project-jail shield"
     },
     {
       name: "shield:project-jail:review-read-credentials-any-tool",

package/dist/index.mjs

@@ -426,6 +426,42 @@ var DLP_PATTERNS = [
     regex: /\bAGE-SECRET-KEY-1[QPZRY9X8GF2TVDW0S3JNLH]{58}\b/,
     severity: "block",
     keywords: ["age-secret-key-"]
+  },
+  // ── Database connection strings ───────────────────────────────────────────
+  // Universal <scheme>://[user]:<password>@<host> shape. Covers the gap
+  // vendor-prefix patterns (AWS / GitHub / Stripe / …) leave open. Matches
+  // the whole URL so maskSecret produces `<scheme>...:****@...<host>` —
+  // the password value never appears in the redacted sample.
+  //
+  // Schemes covered: redis, rediss (TLS), postgres, postgresql,
+  // mongodb, mongodb+srv, mysql, mariadb, amqp, amqps, kafka,
+  // clickhouse, cassandra. HTTP(S) / FTP / SSH are intentionally
+  // excluded — they're not database URLs and adding them would
+  // create false positives on every basic-auth URL in the wild.
+  //
+  // Requires `:password@` (4+ char password) so user-only URLs like
+  // `redis://user@host` don't match. Stopwords ('your', '${', '<your',
+  // 'placeholder', 'changeme', etc.) keep doc/README scans clean.
+  {
+    name: "Database Connection String",
+    regex: /\b(redis|rediss|postgres|postgresql|mongodb|mongodb\+srv|mysql|mariadb|amqp|amqps|kafka|clickhouse|cassandra):\/\/[^:/\s@]*:[^@\s]{4,}@[^\s/]+/,
+    severity: "block",
+    keywords: [
+      "redis://",
+      "rediss://",
+      "postgres://",
+      "postgresql://",
+      "mongodb://",
+      "mongodb+srv://",
+      "mysql://",
+      "mariadb://",
+      "amqp://",
+      "amqps://",
+      "kafka://",
+      "clickhouse://",
+      "cassandra://"
+    ],
+    minEntropy: 3
   }
 ];
 var DLP_PATTERNS_GLOBAL = DLP_PATTERNS.map(
@@ -824,7 +860,7 @@ var SENSITIVE_PATH_RULES = [
   },
   {
     // Mirrors the JSON shield's `.env` pattern (project-jail.json's
-    // review-read-env-any-tool) so the AST FS-op path catches the
+    // block-read-env-any-tool) so the AST FS-op path catches the
     // same set the regex shield does — including Next.js / Vite's
     // `.env.<env>.local` double-suffix overrides which are commonly
     // gitignored AND commonly contain real secrets.
@@ -2336,7 +2372,7 @@ var project_jail_default = {
         {
           field: "command",
           op: "matches",
-          value: "(cat|less|head|tail|bat|more|open|print|nano|vim|vi|emacs|code|type)\\s+.*?\\.ssh[\\/\\\\]",
+          value: "(cat|less|head|tail|bat|more|open|print|nano|vim|vi|emacs|code|type|grep|egrep|fgrep|rg|ag|ack|awk|gawk|sed|cut|tr|jq|yq|od|xxd|hexdump|strings|sort|uniq|tac|nl|dd)\\s+.*?\\.ssh[\\/\\\\]",
           flags: "i"
         }
       ],
@@ -2350,7 +2386,7 @@ var project_jail_default = {
         {
           field: "command",
           op: "matches",
-          value: "(cat|less|head|tail|bat|more|open|print|nano|vim|vi|emacs|code|type)\\s+.*?\\.aws[\\/\\\\]",
+          value: "(cat|less|head|tail|bat|more|open|print|nano|vim|vi|emacs|code|type|grep|egrep|fgrep|rg|ag|ack|awk|gawk|sed|cut|tr|jq|yq|od|xxd|hexdump|strings|sort|uniq|tac|nl|dd)\\s+.*?\\.aws[\\/\\\\]",
           flags: "i"
         }
       ],
@@ -2364,7 +2400,7 @@ var project_jail_default = {
         {
           field: "command",
           op: "matches",
-          value: "(cat|less|head|tail|bat|more|open|print|nano|vim|vi|emacs|code|type)\\s+.*\\.env(\\.local|\\.production|\\.staging)?\\b",
+          value: "(cat|less|head|tail|bat|more|open|print|nano|vim|vi|emacs|code|type|grep|egrep|fgrep|rg|ag|ack|awk|gawk|sed|cut|tr|jq|yq|od|xxd|hexdump|strings|sort|uniq|tac|nl|dd)\\s+.*?\\.env(\\.(local|production|staging|development|production\\.local|staging\\.local|development\\.local))?(?=\\s|$|[;&|>)<])",
           flags: "i"
         }
       ],
@@ -2378,7 +2414,7 @@ var project_jail_default = {
         {
           field: "command",
           op: "matches",
-          value: "(cat|less|head|tail|bat|more|open|print|nano|vim|vi|emacs|code|type)\\s+.*(credentials\\.json|\\.netrc|\\.npmrc|\\.docker[\\/\\\\]config\\.json|gcloud[\\/\\\\]credentials)",
+          value: "(cat|less|head|tail|bat|more|open|print|nano|vim|vi|emacs|code|type|grep|egrep|fgrep|rg|ag|ack|awk|gawk|sed|cut|tr|jq|yq|od|xxd|hexdump|strings|sort|uniq|tac|nl|dd)\\s+.*(credentials\\.json|\\.netrc|\\.npmrc|\\.docker[\\/\\\\]config\\.json|gcloud[\\/\\\\]credentials)",
           flags: "i"
         }
       ],
@@ -2414,7 +2450,7 @@ var project_jail_default = {
       reason: "Reading AWS credentials is blocked by project-jail shield"
     },
     {
-      name: "shield:project-jail:review-read-env-any-tool",
+      name: "shield:project-jail:block-read-env-any-tool",
       tool: "*",
       conditions: [
         {
@@ -2424,8 +2460,8 @@ var project_jail_default = {
           flags: "i"
         }
       ],
-      verdict: "review",
-      reason: "Reading .env files requires approval (project-jail shield)"
+      verdict: "block",
+      reason: "Reading .env files is blocked by project-jail shield"
     },
     {
       name: "shield:project-jail:review-read-credentials-any-tool",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@node9/policy-engine",
-  "version": "1.5.0",
+  "version": "1.27.0",
   "description": "Shared policy evaluation engine for node9 — DLP, smart rules, AST shell parsing, shields, loop detection. Pure functions, no I/O. Used by both node9-proxy and the node9 SaaS firewall.",
   "license": "Apache-2.0",
   "homepage": "https://node9.ai",