@yuneta/gobj-js 7.26.19 → 7.26.20

package/dist/gobj-js.umd.js

@@ -3439,6 +3439,11 @@
 		"sessionkey",
 		"authdata"
 	];
+	var SECRET_NAME_SEGMENTS = /* @__PURE__ */ new Set([
+		"pass",
+		"pin",
+		"otp"
+	]);
 	var NOT_SECRET_SEGMENTS = /* @__PURE__ */ new Set([
 		"endpoint",
 		"url",
@@ -3471,10 +3476,16 @@
 		if (typeof name !== "string" || name.length < 3) return false;
 		let lower = name.toLowerCase();
 		let hit = false;
-		for (const part of SECRET_NAME_PARTS) if (lower.indexOf(part) >= 0) {
+		for (const segment of lower.split(/[^a-z0-9]+/)) if (SECRET_NAME_SEGMENTS.has(segment)) {
 			hit = true;
 			break;
 		}
+		if (!hit) {
+			for (const part of SECRET_NAME_PARTS) if (lower.indexOf(part) >= 0) {
+				hit = true;
+				break;
+			}
+		}
 		if (!hit) {
 			let joined = lower.replace(/[_\-. \t]/g, "");
 			for (const part of SECRET_NAME_JOINED) if (joined.indexOf(part) >= 0) {
@@ -3512,17 +3523,63 @@
 		}
 	}
 	/************************************************************
+	*  A credential by its SHAPE, whatever names it -- the C kernel's
+	*  jwt_len() / bearer_token_len(), the shapes the agent's audit
+	*  record redacts:
+	*    - a JWT: "eyJ" (the base64url of '{"') at the start of a
+	*      word, and three parts of base64url joined by '.'; the dots
+	*      at the end of the run are not its own (a JWT ends a
+	*      sentence: "... eyJ.eyJ.sig.");
+	*    - the token after "Bearer " (any case, a word of its own).
+	************************************************************/
+	function is_ascii_alnum_code(code) {
+		return code >= 48 && code <= 57 || code >= 65 && code <= 90 || code >= 97 && code <= 122;
+	}
+	function is_base64url_code(code) {
+		return is_ascii_alnum_code(code) || code === 45 || code === 95;
+	}
+	function jwt_len(str, p) {
+		if (str.length - p < 3 || str[p] !== "e" || str[p + 1] !== "y" || str[p + 2] !== "J") return 0;
+		if (p > 0 && (is_base64url_code(str.charCodeAt(p - 1)) || str[p - 1] === ".")) return 0;
+		let e = p;
+		let dots = 0;
+		while (e < str.length && (is_base64url_code(str.charCodeAt(e)) || str[e] === ".")) {
+			if (str[e] === ".") dots++;
+			e++;
+		}
+		while (str[e - 1] === ".") {
+			e--;
+			dots--;
+		}
+		return dots === 2 ? e - p : 0;
+	}
+	var BEARER_STOPS = " 	\r\n'\",;}]\0";
+	function bearer_token(str, p) {
+		const word_len = 6;
+		if (str.length - p <= word_len || str.slice(p, p + word_len).toLowerCase() !== "bearer") return [0, 0];
+		if (p > 0 && is_ascii_alnum_code(str.charCodeAt(p - 1))) return [0, 0];
+		let t = p + word_len;
+		if (str[t] !== " " && str[t] !== "	") return [0, 0];
+		while (t < str.length && (str[t] === " " || str[t] === "	")) t++;
+		let e = t;
+		while (e < str.length && BEARER_STOPS.indexOf(str[e]) < 0) e++;
+		return [t - p, e - t];
+	}
+	/************************************************************
 	*  A text (a command line) with the value of every "name=value"
 	*  whose name is a secret's written as "********", quoted or not
 	*  (and the "value" of a write-attr whose attribute names a
-	*  secret). The rest as it is. Return null when there was nothing
-	*  to mask. As the C kernel's mask_secrets_inline().
+	*  secret); and a JWT or the token after "Bearer ", wherever they
+	*  are, whatever names them. The rest as it is. Return null when
+	*  there was nothing to mask. As the C kernel's
+	*  mask_secrets_inline().
 	************************************************************/
 	var MASK_MAX_NAME = 128;
 	var MASK_MAX_BYTES = 4194304;
 	var MASK_TOO_LARGE = "<not shown: too large to mask>";
 	function mask_secrets_inline(str) {
-		if (typeof str !== "string" || str.indexOf("=") < 0) return null;
+		if (typeof str !== "string") return null;
+		if (str.indexOf("=") < 0 && str.indexOf("eyJ") < 0 && !/bearer/i.test(str)) return null;
 		if (str.length > MASK_MAX_BYTES) return MASK_TOO_LARGE;
 		let value_is_secret = false;
 		let re_attr = /(^|[ \t])attribute=["']?([^ \t"']*)/g;
@@ -3546,6 +3603,18 @@
 				if (!outer && (p === 0 || str[p - 1] === " " || str[p - 1] === "	" || str[p - 1] === "=")) outer = c;
 				else if (c === outer && is_blank_or_end(p + 1)) outer = "";
 			}
+			let shape = c === "e" ? jwt_len(str, p) : 0;
+			let token_offset = 0;
+			if (c === "b" || c === "B") [token_offset, shape] = bearer_token(str, p);
+			if (shape) {
+				parts.push(str.substring(copied, p + token_offset));
+				parts.push("********");
+				p += token_offset + shape;
+				copied = p;
+				changed = true;
+				word = p;
+				continue;
+			}
 			if (c !== "=") {
 				p++;
 				continue;
@@ -3582,7 +3651,8 @@
 	*  value of a key with a secret's name is "********", whatever
 	*  its type (not an absent one, a null or an empty string); so is
 	*  the "value" of a dict whose "attribute" names a secret; and a
-	*  string is masked as mask_secrets_inline(). Return a masked
+	*  string, under any key, is masked as mask_secrets_inline() (a
+	*  JWT, a "Bearer" token, a secret name=value). Return a masked
 	*  copy, or `jn` itself when there was nothing to mask. As the C
 	*  kernel's json_mask_secrets().
 	*
@@ -3611,7 +3681,7 @@
 				return MASK_TOO_LARGE;
 			}
 			budget.left -= jn.length;
-			let masked = mask_secrets_inline(jn);
+			let masked = mask_secrets_inline(jn.indexOf("\0") >= 0 ? jn.replace(/\u0000/g, " ") : jn);
 			return masked !== null ? masked : jn;
 		}
 		let is_array = Array.isArray(jn);
@@ -7113,15 +7183,34 @@
 		return gobj_save_persistent_attrs(gobj, attr);
 	}
 	/***************************************************************
-	*  "set" as the C command reads it: TRUE / set / 1, FALSE / reset / 0
+	*  "set" as the C command reads it (trace_set_value() of c_yuno.c):
+	*  a boolean; an integer in the range of an int (true unless 0); or
+	*  text -- set / reset, a JSON integer -?(0|[1-9][0-9]*), or true /
+	*  false, yes / no, on / off, any case. null for anything else: a
+	*  real (2.5), " 1", "0x1", "1e3", "+5", "007" and "2.5" are refused,
+	*  as in C. Up to gobj-js 7.26.19 the text went through Number(),
+	*  which took all of them, and "yes" / "on" were refused.
 	***************************************************************/
+	var INT_MIN = -2147483648;
+	var INT_MAX = 2147483647;
 	function parse_set(value) {
 		if (value === true || value === false) return value;
-		let v = String(value === void 0 || value === null ? "" : value).toLowerCase();
-		if (v === "true" || v === "set") return true;
-		if (v === "false" || v === "reset") return false;
-		if (v === "" || isNaN(Number(v))) return null;
-		return Number(v) ? true : false;
+		if (typeof value === "number") {
+			if (!Number.isInteger(value) || value < INT_MIN || value > INT_MAX) return null;
+			return value !== 0;
+		}
+		if (typeof value !== "string" || value === "") return null;
+		let v = value.toLowerCase();
+		if (v === "set") return true;
+		if (v === "reset") return false;
+		if (/^-?(0|[1-9][0-9]*)$/.test(value)) {
+			let n = Number(value);
+			if (n < INT_MIN || n > INT_MAX) return null;
+			return n !== 0;
+		}
+		if (v === "true" || v === "yes" || v === "on") return true;
+		if (v === "false" || v === "no" || v === "off") return false;
+		return null;
 	}
 	function yuno_prefix() {
 		return `${gobj_yuno_role()}^${gobj_yuno_name()}`;