@wrongstack/core 0.3.8 → 0.4.1

package/dist/types/index.js

@@ -393,7 +393,7 @@ function walkCount(node, vault, counter) {
   if (Array.isArray(node)) {
     return node.map((item) => walkCount(item, vault, counter));
   }
-  const out = {};
+  const out = /* @__PURE__ */ Object.create(null);
   for (const [k, v] of Object.entries(node)) {
     if (typeof v === "string" && isSecretField(k) && !vault.isEncrypted(v) && v.length > 0) {
       out[k] = vault.encrypt(v);
@@ -406,7 +406,15 @@ function walkCount(node, vault, counter) {
   }
   return out;
 }
-var FORBIDDEN_PROTO_KEYS = /* @__PURE__ */ new Set(["__proto__", "constructor", "prototype"]);
+var FORBIDDEN_PROTO_KEYS = /* @__PURE__ */ new Set([
+  "__proto__",
+  "constructor",
+  "prototype",
+  "__defineGetter__",
+  "__defineSetter__",
+  "__lookupGetter__",
+  "__lookupSetter__"
+]);
 function deepMerge(a, b) {
   const out = { ...a };
   for (const [k, v] of Object.entries(b)) {
@@ -1152,12 +1160,15 @@ var PATTERNS = [
   { type: "redis_uri", regex: /redis:\/\/[^\s"'`]+/g },
   {
     type: "bearer_token",
-    regex: /(?<![A-Za-z0-9_.~+/-])Bearer\s+[A-Za-z0-9._~+/-]{20,}=*(?![A-Za-z0-9_.~+/-])/g
+    // Bounded at 512 chars to prevent catastrophic backtracking on adversarial input.
+    // Negative lookahead is a simple single-char check — no backtracking risk.
+    regex: /(?<![A-Za-z0-9_.~+/-])Bearer\s+[A-Za-z0-9._~+/-]{20,512}=*(?![A-Za-z0-9_.~+/-])/g
   },
   {
     type: "high_entropy_env",
-    // Value-side word boundary + length gate to avoid matching short random strings
-    regex: /\b([A-Z_]{4,}(?:KEY|TOKEN|SECRET|PASSWORD|PWD))\s*[:=]\s*['"]?([A-Za-z0-9_/+=-]{20,})['"]?(?!\s*[A-Za-z_]{4,}(?:KEY|TOKEN|SECRET|PASSWORD|PWD))/g
+    // Value bounded at 512 chars; negative lookahead simplified to avoid
+    // nested quantifier backtracking on adversarial input.
+    regex: /\b([A-Z_]{4,}(?:KEY|TOKEN|SECRET|PASSWORD|PWD))\s*[:=]\s*['"]?([A-Za-z0-9_/+=-]{20,512})['"]?/g
   }
 ];
 var SCRUB_CHUNK_BYTES = 64 * 1024;