@vtstech/pi-security 1.1.8 → 1.2.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/package.json +2 -2
- package/security.js +19 -1
package/package.json
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "@vtstech/pi-security",
|
|
3
|
-
"version": "1.
|
|
3
|
+
"version": "1.2.0",
|
|
4
4
|
"description": "Security extension for Pi Coding Agent",
|
|
5
5
|
"main": "security.js",
|
|
6
6
|
"keywords": ["pi-extensions"],
|
|
@@ -14,7 +14,7 @@
|
|
|
14
14
|
"url": "https://github.com/VTSTech/pi-coding-agent"
|
|
15
15
|
},
|
|
16
16
|
"dependencies": {
|
|
17
|
-
"@vtstech/pi-shared": "1.
|
|
17
|
+
"@vtstech/pi-shared": "1.2.0"
|
|
18
18
|
},
|
|
19
19
|
"peerDependencies": {
|
|
20
20
|
"@mariozechner/pi-coding-agent": ">=0.66"
|
package/security.js
CHANGED
|
@@ -344,10 +344,28 @@ function security_temp_default(pi) {
|
|
|
344
344
|
}
|
|
345
345
|
});
|
|
346
346
|
}
|
|
347
|
+
var SECRET_KEY_PATTERNS = [
|
|
348
|
+
/key$/i,
|
|
349
|
+
/token/i,
|
|
350
|
+
/secret/i,
|
|
351
|
+
/password/i,
|
|
352
|
+
/credential/i,
|
|
353
|
+
/auth/i,
|
|
354
|
+
/apikey/i,
|
|
355
|
+
/api_key/i
|
|
356
|
+
];
|
|
347
357
|
function sanitizeInputForLog(input) {
|
|
348
358
|
const sanitized = {};
|
|
349
359
|
for (const [key, value] of Object.entries(input)) {
|
|
350
|
-
if (typeof value
|
|
360
|
+
if (typeof value !== "string") {
|
|
361
|
+
sanitized[key] = value;
|
|
362
|
+
continue;
|
|
363
|
+
}
|
|
364
|
+
if (SECRET_KEY_PATTERNS.some((p) => p.test(key))) {
|
|
365
|
+
sanitized[key] = "[REDACTED]";
|
|
366
|
+
continue;
|
|
367
|
+
}
|
|
368
|
+
if (value.length > 500) {
|
|
351
369
|
sanitized[key] = value.slice(0, 500) + "... (truncated)";
|
|
352
370
|
} else {
|
|
353
371
|
sanitized[key] = value;
|