@node9/proxy 1.12.6 → 1.12.8

package/dist/index.mjs

@@ -965,6 +965,17 @@ var ASSIGNMENT_CONTEXT_RE = /\b(?:password|passwd|secret|token|api[_-]?key|auth(
 function isAssignmentContext(text) {
   return ASSIGNMENT_CONTEXT_RE.test(text);
 }
+function shannonEntropy(s) {
+  if (s.length === 0) return 0;
+  const freq = /* @__PURE__ */ new Map();
+  for (const ch of s) freq.set(ch, (freq.get(ch) ?? 0) + 1);
+  let h = 0;
+  for (const count of freq.values()) {
+    const p = count / s.length;
+    h -= p * Math.log2(p);
+  }
+  return h;
+}
 var DLP_STOPWORDS = [
   "example",
   "placeholder",
@@ -987,7 +998,9 @@ var DLP_STOPWORDS = [
   "%{",
   "<your",
   "test_key",
-  "test_token"
+  "test_token",
+  "your",
+  "here"
 ];
 var DLP_PATTERNS = [
   // ── AWS ───────────────────────────────────────────────────────────────────
@@ -1038,7 +1051,8 @@ var DLP_PATTERNS = [
     name: "OpenAI API Key",
     regex: /\bsk-[a-zA-Z0-9_-]{20,}\b/,
     severity: "block",
-    keywords: ["sk-"]
+    keywords: ["sk-"],
+    minEntropy: 3.5
   },
   // ── Stripe ────────────────────────────────────────────────────────────────
   {
@@ -1109,7 +1123,13 @@ var DLP_PATTERNS = [
     keywords: ["hvb."]
   },
   // ── Hugging Face ──────────────────────────────────────────────────────────
-  { name: "HuggingFace Token", regex: /\bhf_[A-Za-z]{34}\b/, severity: "block", keywords: ["hf_"] },
+  {
+    name: "HuggingFace Token",
+    regex: /\bhf_[A-Za-z]{34}\b/,
+    severity: "block",
+    keywords: ["hf_"],
+    minEntropy: 3
+  },
   // ── Postman ───────────────────────────────────────────────────────────────
   {
     name: "Postman API Token",
@@ -1261,7 +1281,8 @@ var DLP_PATTERNS = [
     name: "PyPI Upload Token",
     regex: /\bpypi-[A-Za-z0-9_-]{50,}\b/,
     severity: "block",
-    keywords: ["pypi-"]
+    keywords: ["pypi-"],
+    minEntropy: 3
   },
   // ── Bearer Token ─────────────────────────────────────────────────────────
   // contextBoost: promoted to block when assigned (e.g. AUTH_TOKEN=Bearer eyJ...)
@@ -1270,7 +1291,99 @@ var DLP_PATTERNS = [
     regex: /Bearer\s+[a-zA-Z0-9\-._~+/]{20,}=*/i,
     severity: "review",
     keywords: ["bearer"],
-    contextBoost: true
+    contextBoost: true,
+    minEntropy: 3
+  },
+  // ── Resend ────────────────────────────────────────────────────────────────
+  {
+    name: "Resend API Key",
+    regex: /\bre_[a-zA-Z0-9]{24}\b/,
+    severity: "block",
+    keywords: ["re_"]
+  },
+  // ── Telegram ──────────────────────────────────────────────────────────────
+  {
+    name: "Telegram Bot Token",
+    regex: /\b[0-9]{7,10}:AA[a-zA-Z0-9_-]{33}\b/,
+    severity: "block",
+    keywords: [":aa"]
+  },
+  // ── Mapbox ────────────────────────────────────────────────────────────────
+  {
+    name: "Mapbox Access Token",
+    regex: /\bpk\.eyJ1[a-zA-Z0-9._-]{20,}\b/,
+    severity: "block",
+    keywords: ["pk.eyj1"]
+  },
+  // ── Notion ────────────────────────────────────────────────────────────────
+  {
+    name: "Notion Integration Token",
+    regex: /\bsecret_[a-zA-Z0-9]{43}\b/,
+    severity: "block",
+    keywords: ["secret_"]
+  },
+  // ── Square ────────────────────────────────────────────────────────────────
+  {
+    name: "Square Access Token",
+    regex: /\bsq0atp-[0-9A-Za-z_-]{22}\b/,
+    severity: "block",
+    keywords: ["sq0atp-"]
+  },
+  {
+    name: "Square OAuth Secret",
+    regex: /\bsq0csp-[0-9A-Za-z_-]{43}\b/,
+    severity: "block",
+    keywords: ["sq0csp-"]
+  },
+  // ── Typeform ──────────────────────────────────────────────────────────────
+  {
+    name: "Typeform Token",
+    regex: /\btfp_[a-zA-Z0-9_]{59}\b/,
+    severity: "block",
+    keywords: ["tfp_"]
+  },
+  // ── Cloudinary ────────────────────────────────────────────────────────────
+  {
+    name: "Cloudinary URL",
+    regex: /\bcloudinary:\/\/[0-9]+:[a-zA-Z0-9_-]+@[a-zA-Z0-9_-]+/,
+    severity: "block",
+    keywords: ["cloudinary://"]
+  },
+  // ── Airtable ──────────────────────────────────────────────────────────────
+  // New PAT format: pat + 14 alphanum + . + 64 alphanum
+  {
+    name: "Airtable PAT",
+    regex: /\bpat[a-zA-Z0-9]{14}\.[a-zA-Z0-9]{64}\b/,
+    severity: "block",
+    keywords: ["pat"]
+  },
+  // ── RubyGems ──────────────────────────────────────────────────────────────
+  {
+    name: "RubyGems API Key",
+    regex: /\brubygems_[a-f0-9]{48}\b/,
+    severity: "block",
+    keywords: ["rubygems_"]
+  },
+  // ── Shippo ────────────────────────────────────────────────────────────────
+  {
+    name: "Shippo Token",
+    regex: /\bshippo_(?:live|test)_[a-f0-9]{40}\b/,
+    severity: "block",
+    keywords: ["shippo_"]
+  },
+  // ── Plaid ─────────────────────────────────────────────────────────────────
+  {
+    name: "Plaid Access Token",
+    regex: /\baccess-(?:sandbox|development|production)-[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}\b/,
+    severity: "block",
+    keywords: ["access-sandbox", "access-development", "access-production"]
+  },
+  // ── Age ───────────────────────────────────────────────────────────────────
+  {
+    name: "Age Identity Key",
+    regex: /\bAGE-SECRET-KEY-1[QPZRY9X8GF2TVDW0S3JNLH]{58}\b/,
+    severity: "block",
+    keywords: ["age-secret-key-"]
   }
 ];
 var SENSITIVE_PATH_PATTERNS = [
@@ -1367,8 +1480,9 @@ function scanArgs(args, depth = 0, fieldPath = "args") {
         continue;
       }
       if (pattern.regex.test(text)) {
-        const matchedValue = (text.match(pattern.regex)?.[0] ?? "").toLowerCase();
-        if (DLP_STOPWORDS.some((sw) => matchedValue.includes(sw))) continue;
+        const raw = text.match(pattern.regex)?.[0] ?? "";
+        if (DLP_STOPWORDS.some((sw) => raw.toLowerCase().includes(sw))) continue;
+        if (pattern.minEntropy !== void 0 && shannonEntropy(raw) < pattern.minEntropy) continue;
         const severity = pattern.contextBoost && assignmentCtx ? "block" : pattern.severity;
         return {
           patternName: pattern.name,

package/node_modules/mvdan-sh/LICENSE

@@ -0,0 +1,27 @@
+Copyright (c) 2016, Daniel Martí. All rights reserved.
+
+Redistribution and use in source and binary forms, with or without
+modification, are permitted provided that the following conditions are
+met:
+
+   * Redistributions of source code must retain the above copyright
+notice, this list of conditions and the following disclaimer.
+   * Redistributions in binary form must reproduce the above
+copyright notice, this list of conditions and the following disclaimer
+in the documentation and/or other materials provided with the
+distribution.
+   * Neither the name of the copyright holder nor the names of its
+contributors may be used to endorse or promote products derived from
+this software without specific prior written permission.
+
+THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+"AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+(INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.

package/node_modules/mvdan-sh/README.md

@@ -0,0 +1,84 @@
+## mvdan-sh
+
+This package is a JavaScript version of a shell package written in Go, available
+at https://github.com/mvdan/sh.
+
+It is transpiled from Go to JS using https://github.com/gopherjs/gopherjs.
+
+### Sample usage
+
+```
+const sh = require('mvdan-sh')
+const syntax = sh.syntax
+
+var parser = syntax.NewParser()
+var printer = syntax.NewPrinter()
+
+var src = "echo 'foo'"
+var f = parser.Parse(src, "src.sh")
+
+// print out the syntax tree
+syntax.DebugPrint(f)
+console.log()
+
+// replace all single quoted string values
+syntax.Walk(f, function(node) {
+        if (syntax.NodeType(node) == "SglQuoted") {
+                node.Value = "bar"
+        }
+        return true
+})
+
+// print the code back out
+console.log(printer.Print(f)) // echo 'bar'
+```
+
+You can find more samples in
+[testmain.js](https://github.com/mvdan/sh/blob/master/_js/testmain.js).
+
+### Available APIs
+
+The APIs listed below are wrapped to be usable in JavaScript. Follow the links
+to read their documentation.
+
+* [syntax.NewParser](https://pkg.go.dev/mvdan.cc/sh/v3/syntax#NewParser)
+  - [Parser.Parse](https://pkg.go.dev/mvdan.cc/sh/v3/syntax#Parser.Parse)
+  - [Parser.Interactive](https://pkg.go.dev/mvdan.cc/sh/v3/syntax#Parser.Interactive)
+  - [Parser.Incomplete](https://pkg.go.dev/mvdan.cc/sh/v3/syntax#Parser.Incomplete)
+* [syntax.DebugPrint](https://pkg.go.dev/mvdan.cc/sh/v3/syntax#DebugPrint)
+* [syntax.Walk](https://pkg.go.dev/mvdan.cc/sh/v3/syntax#Walk)
+* [syntax.NewPrinter](https://pkg.go.dev/mvdan.cc/sh/v3/syntax#NewPrinter)
+  - [Printer.Print](https://pkg.go.dev/mvdan.cc/sh/v3/syntax#Printer.Print)
+
+Constructor options like
+[syntax.KeepComments](https://pkg.go.dev/mvdan.cc/sh/v3/syntax#KeepComments) are
+also available.
+
+The original `io.Reader` parameters can take a string or a
+[stream.Readable](https://nodejs.org/api/stream.html#stream_class_stream_readable)
+object. `io.Writer` parameters are replaced by string returns.
+
+The nodes you will find in the syntax tree are all equivalent to the nodes you
+will see on the Go API. To get the type of a node, use `syntax.NodeType` as the
+example above shows. Some of the most common node types include:
+
+* [syntax.File](https://pkg.go.dev/mvdan.cc/sh/v3/syntax#File)
+* [syntax.Stmt](https://pkg.go.dev/mvdan.cc/sh/v3/syntax#Stmt)
+* [syntax.CallExpr](https://pkg.go.dev/mvdan.cc/sh/v3/syntax#CallExpr)
+* [syntax.Word](https://pkg.go.dev/mvdan.cc/sh/v3/syntax#Word)
+* [syntax.Lit](https://pkg.go.dev/mvdan.cc/sh/v3/syntax#Lit)
+
+The five above will show up in your syntax tree if you parse a `echo foo`
+command, which you can see if you use `syntax.DebugPrint` to inspect the syntax
+tree.
+
+### Building
+
+You will need:
+
+* Latest Go 1.17.x
+* NodeJS, to run the `testmain.js` test suite
+
+Then, simply run `./build`. The result will be `index.js`, which isn't minified.
+At the time of writing, `index.js` weighs 1.7MiB in plaintext, and 220KiB when
+minified and gzipped.