@yuneta/gobj-js 7.26.20 → 7.26.21

package/README.md

@@ -674,16 +674,31 @@ is_secret_name("mapping")                 // → false (pin inside a word)
 is_secret_name("token_endpoint")          // → false (names something ABOUT one)
 mask_secrets_inline("login user=a passw=x")  // → "login user=a passw=********"
 mask_secrets_inline("curl -H 'Authorization: Bearer abc' u")
-                                          // → "curl -H 'Authorization: Bearer ********' u"
+                                          // → "curl -H 'Authorization: ********' u"
+mask_secrets_inline("sent Bearer mF_9.B5f-4.1JqM")  // → "sent Bearer ********"
+mask_secrets_inline("the bearer of this letter")    // → null: prose
+mask_secrets_inline("\"password\": hunter2")        // → "\"password\": ********"
 json_mask_secrets({user: "a", password: "x"})  // → {user: "a", password: "********"}
 json_mask_secrets({note: "eyJhbGciOiJIUzI1NiJ9.eyJzdWIiOiJ4In0.c2ln"})
                                           // → {note: "********"}: a JWT under any key
 trace_json_masked(kw, "sent")            // trace_json() of the masked copy
 ```
 
-As the C kernel's: the same names, the same shapes by value (a JWT, the token
-after `Bearer `), a NUL in a string read as a blank; linear and bounded (a text
-over 4 MB is not shown at all). `key` and `cert` are not secrets' names.
+As the C kernel's: the same names, the same rules. By name: the value of a
+`name=value` and of a `name: value` (`"password": x`, `Authorization: Basic x`,
+`bearer: tok`, `{\"password\":\"x\"}` of a json inside a json) whose name is
+a secret's, whole. By value: a JWT or a JWE (`eyJ`, base64url and a `.`: also
+one a cap cut), and after `Bearer` or `Basic` the word that can be a credential
+-- quoted, after the scheme doubled, or not a word of prose (a digit, a symbol,
+a character that is no ASCII, its case mixed, 24 characters or more; for
+`Bearer` 8 at least, for `Basic` a run of base64 that decodes to a
+`user:password`). Each rule judges the text as it came, and a run of
+characters to mask is one `********`: nothing that the masking of 7.26.9 hid is
+shown, but the word after a bare `Bearer` that cannot be a credential. A key
+is judged as a name, never as a value: a key that is itself a credential (a
+dict keyed by tokens, `{"eyJ...": 1}`) is shown as it is. A NUL in a string is
+read as a blank; linear and bounded (a text over 4 MB is not shown at all).
+`key` and `cert` are not secrets' names.
 
 ### Logging
 

package/dist/gobj-js.cjs.js

@@ -3521,77 +3521,249 @@ function inline_secret_value_end(str, p, outer) {
 }
 /************************************************************
 *  A credential by its SHAPE, whatever names it -- the C kernel's
-*  jwt_len() / bearer_token_len(), the shapes the agent's audit
-*  record redacts:
-*    - a JWT: "eyJ" (the base64url of '{"') at the start of a
-*      word, and three parts of base64url joined by '.'; the dots
-*      at the end of the run are not its own (a JWT ends a
-*      sentence: "... eyJ.eyJ.sig.");
-*    - the token after "Bearer " (any case, a word of its own).
-************************************************************/
+*  jwt_len() / scheme_credential(), the shapes the agent's audit
+*  record redacts, and the schemes of an HTTP Authorization:
+*    - a JWT or a JWE: "eyJ" (the base64url of '{"') at the start
+*      of a word, base64url, and a '.' after it -- three parts
+*      joined by '.' (a JWS), five (a JWE), or fewer when a cap cut
+*      it; the dots at the end of the run are not its own (a JWT
+*      ends a sentence: "... eyJ.eyJ.sig.");
+*    - the credential after the scheme word "Bearer" or "Basic"
+*      (any case, a word of its own): scheme_credential().
+************************************************************/
+var MASK_TOKEN_MIN = 8;
+var MASK_PROSE_MAX = 24;
 function is_ascii_alnum_code(code) {
 	return code >= 48 && code <= 57 || code >= 65 && code <= 90 || code >= 97 && code <= 122;
 }
+function is_ascii_letter_code(code) {
+	return code >= 65 && code <= 90 || code >= 97 && code <= 122;
+}
+function is_ascii_upper_code(code) {
+	return code >= 65 && code <= 90;
+}
 function is_base64url_code(code) {
 	return is_ascii_alnum_code(code) || code === 45 || code === 95;
 }
+function ascii_case_equal(str, p, word) {
+	if (str.length - p < word.length) return false;
+	for (let i = 0; i < word.length; i++) {
+		let code = str.charCodeAt(p + i);
+		if (code >= 65 && code <= 90) code += 32;
+		if (code !== word.charCodeAt(i)) return false;
+	}
+	return true;
+}
 function jwt_len(str, p) {
 	if (str.length - p < 3 || str[p] !== "e" || str[p + 1] !== "y" || str[p + 2] !== "J") return 0;
 	if (p > 0 && (is_base64url_code(str.charCodeAt(p - 1)) || str[p - 1] === ".")) return 0;
 	let e = p;
-	let dots = 0;
+	let dotted = false;
 	while (e < str.length && (is_base64url_code(str.charCodeAt(e)) || str[e] === ".")) {
-		if (str[e] === ".") dots++;
+		if (str[e] === ".") dotted = true;
 		e++;
 	}
-	while (str[e - 1] === ".") {
-		e--;
-		dots--;
+	if (!dotted) return 0;
+	while (str[e - 1] === ".") e--;
+	return e - p;
+}
+function scheme_word_len(str, p) {
+	if (p > 0 && is_ascii_alnum_code(str.charCodeAt(p - 1))) return 0;
+	for (const scheme of ["bearer", "basic"]) {
+		const n = scheme.length;
+		if (str.length - p > n && ascii_case_equal(str, p, scheme) && (str[p + n] === " " || str[p + n] === "	")) return n;
+	}
+	return 0;
+}
+function code_points(str, w, n) {
+	let count = 0;
+	for (let i = w; i < w + n; i++) {
+		const code = str.charCodeAt(i);
+		if (code < 56320 || code > 57343) count++;
+	}
+	return count;
+}
+function is_prose_word(str, w, n) {
+	if (n === 0 || n >= MASK_PROSE_MAX) return false;
+	let i = w;
+	const end = w + n;
+	while (true) {
+		let r = i;
+		let upper_rest = true;
+		let lower_rest = true;
+		while (r < end && is_ascii_letter_code(str.charCodeAt(r))) {
+			if (r > i) {
+				if (is_ascii_upper_code(str.charCodeAt(r))) lower_rest = false;
+				else upper_rest = false;
+			}
+			r++;
+		}
+		if (r === i) return false;
+		if (!lower_rest && !(upper_rest && is_ascii_upper_code(str.charCodeAt(i)))) return false;
+		if (r === end) return true;
+		if (str[r] !== "-" && str[r] !== "." && str[r] !== "/" || r + 1 === end) return false;
+		i = r + 1;
+	}
+}
+function base64_digit(code) {
+	if (code >= 65 && code <= 90) return code - 65;
+	if (code >= 97 && code <= 122) return code - 97 + 26;
+	if (code >= 48 && code <= 57) return code - 48 + 52;
+	if (code === 43) return 62;
+	if (code === 47) return 63;
+	return -1;
+}
+function is_basic_credential(str, w, n) {
+	let bits = 0;
+	let n_bits = 0;
+	for (let i = 0; i < n; i++) {
+		const v = base64_digit(str.charCodeAt(w + i));
+		if (v < 0) return false;
+		bits = (bits << 6 | v) & 16383;
+		n_bits += 6;
+		if (n_bits >= 8) {
+			n_bits -= 8;
+			if ((bits >> n_bits & 255) === 58) return true;
+		}
 	}
-	return dots === 2 ? e - p : 0;
+	return false;
 }
-var BEARER_STOPS = " 	\r\n'\",;}]\0";
-function bearer_token(str, p) {
-	const word_len = 6;
-	if (str.length - p <= word_len || str.slice(p, p + word_len).toLowerCase() !== "bearer") return [0, 0];
-	if (p > 0 && is_ascii_alnum_code(str.charCodeAt(p - 1))) return [0, 0];
-	let t = p + word_len;
-	if (str[t] !== " " && str[t] !== "	") return [0, 0];
+var SCHEME_WORD_STOPS = " 	\r\n\"',;}]\0";
+function scheme_credential(str, p) {
+	const n = scheme_word_len(str, p);
+	if (!n) return [0, 0];
+	const scheme = n === 5 ? "basic" : "bearer";
+	let context = false;
+	let t = p + n;
 	while (t < str.length && (str[t] === " " || str[t] === "	")) t++;
+	if (t < str.length && scheme_word_len(str, t) === n && ascii_case_equal(str, t, scheme)) {
+		t += n;
+		context = true;
+		while (t < str.length && (str[t] === " " || str[t] === "	")) t++;
+	}
+	if (t >= str.length) return [0, 0];
+	if (str[t] === "\"" || str[t] === "'") {
+		let q = t + 1;
+		while (q < str.length && str[q] !== str[t] && str[q] !== " " && str[q] !== "	" && str[q] !== "\r" && str[q] !== "\n" && str[q] !== "\0") q++;
+		if (q < str.length && str[q] === str[t] && q > t + 1) return [t - p, q + 1 - t];
+		return [0, 0];
+	}
 	let e = t;
-	while (e < str.length && BEARER_STOPS.indexOf(str[e]) < 0) e++;
+	while (e < str.length && SCHEME_WORD_STOPS.indexOf(str[e]) < 0) e++;
+	if (e === t) return [0, 0];
+	if (!context) {
+		let w_end = e;
+		while (w_end > t && str[w_end - 1] === ".") w_end--;
+		const len = w_end - t;
+		if (len === 0 || is_prose_word(str, t, len)) return [0, 0];
+		if (n === 5) {
+			if (!is_basic_credential(str, t, len)) return [0, 0];
+		} else if (code_points(str, t, len) < MASK_TOKEN_MIN) return [0, 0];
+	}
 	return [t - p, e - t];
 }
-/************************************************************
-*  A text (a command line) with the value of every "name=value"
-*  whose name is a secret's written as "********", quoted or not
-*  (and the "value" of a write-attr whose attribute names a
-*  secret); and a JWT or the token after "Bearer ", wherever they
-*  are, whatever names them. The rest as it is. Return null when
-*  there was nothing to mask. As the C kernel's
-*  mask_secrets_inline().
-************************************************************/
+function shape_len(str, p) {
+	const c = str[p];
+	if (c === "e") return [0, jwt_len(str, p)];
+	if (c === "b" || c === "B") return scheme_credential(str, p);
+	return [0, 0];
+}
+function shape_len_7_26_9(str, p) {
+	const c = str[p];
+	if (c === "e") {
+		if (str.length - p < 3 || str[p + 1] !== "y" || str[p + 2] !== "J") return [0, 0];
+		if (p > 0 && (is_base64url_code(str.charCodeAt(p - 1)) || str[p - 1] === ".")) return [0, 0];
+		let e = p;
+		let dots = 0;
+		while (e < str.length && (is_base64url_code(str.charCodeAt(e)) || str[e] === ".")) {
+			if (str[e] === ".") dots++;
+			e++;
+		}
+		while (str[e - 1] === ".") {
+			e--;
+			dots--;
+		}
+		return dots === 2 ? [0, e - p] : [0, 0];
+	}
+	if (c === "b" || c === "B") {
+		if (str.length - p <= 6 || !ascii_case_equal(str, p, "bearer")) return [0, 0];
+		if (p > 0 && is_ascii_alnum_code(str.charCodeAt(p - 1))) return [0, 0];
+		let t = p + 6;
+		if (str[t] !== " " && str[t] !== "	") return [0, 0];
+		while (t < str.length && (str[t] === " " || str[t] === "	")) t++;
+		let e = t;
+		while (e < str.length && " 	\r\n'\",;}]\0".indexOf(str[e]) < 0) e++;
+		return [t - p, e - t];
+	}
+	return [0, 0];
+}
+var COLON_VALUE_STOPS = " 	\r\n,;&)]}<>\"'\0";
+function colon_value_end(str, v) {
+	if (v >= str.length) return v;
+	const c = str[v];
+	if (c === "\"" || c === "'") {
+		let e = v + 1;
+		while (e < str.length && str[e] !== c) {
+			if (str[e] === "\\" && e + 1 < str.length) e++;
+			e++;
+		}
+		return e < str.length ? e + 1 : str.length;
+	}
+	if (c === "{" || c === "[") {
+		let depth = 0;
+		let in_string = false;
+		for (let e = v; e < str.length; e++) if (in_string) {
+			if (str[e] === "\\" && e + 1 < str.length) e++;
+			else if (str[e] === "\"") in_string = false;
+		} else if (str[e] === "\"") in_string = true;
+		else if (str[e] === "{" || str[e] === "[") depth++;
+		else if (str[e] === "}" || str[e] === "]") {
+			depth--;
+			if (depth === 0) return e + 1;
+		}
+		return str.length;
+	}
+	if (c === "\\") {
+		let q = v;
+		while (q < str.length && str[q] === "\\") q++;
+		if (q < str.length && (str[q] === "\"" || str[q] === "'")) {
+			const level = q - v;
+			let run = 0;
+			for (let e = q + 1; e < str.length; e++) {
+				if (str[e] === "\\") {
+					run++;
+					continue;
+				}
+				if (str[e] === str[q] && run === level) return e + 1;
+				run = 0;
+			}
+			return str.length;
+		}
+	}
+	let e = v;
+	const n = scheme_word_len(str, v);
+	if (n) {
+		e = v + n;
+		while (e < str.length && (str[e] === " " || str[e] === "	")) e++;
+		if (e < str.length && (str[e] === "\"" || str[e] === "'")) return colon_value_end(str, e);
+	}
+	while (e < str.length && COLON_VALUE_STOPS.indexOf(str[e]) < 0) e++;
+	return e;
+}
 var MASK_MAX_NAME = 128;
 var MASK_MAX_BYTES = 4194304;
 var MASK_TOO_LARGE = "<not shown: too large to mask>";
-function mask_secrets_inline(str) {
-	if (typeof str !== "string") return null;
-	if (str.indexOf("=") < 0 && str.indexOf("eyJ") < 0 && !/bearer/i.test(str)) return null;
-	if (str.length > MASK_MAX_BYTES) return MASK_TOO_LARGE;
-	let value_is_secret = false;
-	let re_attr = /(^|[ \t])attribute=["']?([^ \t"']*)/g;
-	let m;
-	while ((m = re_attr.exec(str)) !== null) if (is_secret_name(m[2].slice(-128))) value_is_secret = true;
-	let parts = [];
-	let copied = 0;
-	let changed = false;
+function mark_range(marks, from, to) {
+	for (let i = from; i < to; i++) marks[i] = 1;
+}
+function mark_params(str, value_is_secret, as_7_26_9, marks) {
+	const is_blank_or_end = (i) => i >= str.length || str[i] === " " || str[i] === "	" || str[i] === "\0";
 	let outer = "";
 	let word = 0;
 	let p = 0;
-	const is_blank_or_end = (i) => i >= str.length || str[i] === " " || str[i] === "	";
 	while (p < str.length) {
-		let c = str[p];
-		if (c === " " || c === "	") {
+		const c = str[p];
+		if (c === " " || c === "	" || c === "\0") {
 			p++;
 			word = p;
 			continue;
@@ -3600,48 +3772,116 @@ function mask_secrets_inline(str) {
 			if (!outer && (p === 0 || str[p - 1] === " " || str[p - 1] === "	" || str[p - 1] === "=")) outer = c;
 			else if (c === outer && is_blank_or_end(p + 1)) outer = "";
 		}
-		let shape = c === "e" ? jwt_len(str, p) : 0;
-		let token_offset = 0;
-		if (c === "b" || c === "B") [token_offset, shape] = bearer_token(str, p);
-		if (shape) {
-			parts.push(str.substring(copied, p + token_offset));
-			parts.push("********");
-			p += token_offset + shape;
-			copied = p;
-			changed = true;
-			word = p;
-			continue;
+		if (as_7_26_9) {
+			const [offset, n] = shape_len_7_26_9(str, p);
+			if (n) {
+				p += offset + n;
+				word = p;
+				continue;
+			}
 		}
 		if (c !== "=") {
 			p++;
 			continue;
 		}
-		let name = str.substring(Math.max(word, p - MASK_MAX_NAME), p);
+		const name_from = Math.max(word, p - MASK_MAX_NAME);
+		const name = str.substring(name_from, p);
 		word = p + 1;
-		if (!(is_secret_name(name) || value_is_secret && name.toLowerCase() === "value")) {
+		if (!(is_secret_name(name) || value_is_secret && name.length === 5 && ascii_case_equal(str, name_from, "value"))) {
 			p++;
 			continue;
 		}
 		p++;
-		let quote = str[p] === "\"" || str[p] === "'" ? str[p] : "";
 		let end;
+		const quote = p < str.length && (str[p] === "\"" || str[p] === "'") ? str[p] : "";
 		if (quote) {
 			end = p + 1;
-			while (end < str.length && str[end] !== quote) end++;
-			if (str[end] === quote) end++;
+			while (end < str.length && str[end] !== quote && str[end] !== "\0") end++;
+			if (end < str.length && str[end] === quote) end++;
 		} else end = inline_secret_value_end(str, p, outer);
-		if (end > p) {
-			parts.push(str.substring(copied, p));
+		mark_range(marks, p, end);
+		p = end;
+		word = p;
+	}
+}
+function mark_shapes(str, marks) {
+	for (let p = 0; p < str.length; p++) {
+		const c = str[p];
+		if (c !== "e" && c !== "b" && c !== "B") continue;
+		const [offset, n] = shape_len(str, p);
+		if (n) mark_range(marks, p + offset, p + offset + n);
+	}
+}
+function mark_labels(str, marks) {
+	let word = 0;
+	let p = 0;
+	while (p < str.length) {
+		const c = str[p];
+		if (c === " " || c === "	" || c === "\0" || c === "=") {
+			p++;
+			word = p;
+			continue;
+		}
+		if (c !== ":") {
+			p++;
+			continue;
+		}
+		if (!is_secret_name(str.substring(Math.max(word, p - MASK_MAX_NAME), p))) {
+			p++;
+			word = p;
+			continue;
+		}
+		let v = p + 1;
+		while (v < str.length && (str[v] === " " || str[v] === "	")) v++;
+		const e = colon_value_end(str, v);
+		mark_range(marks, v, e);
+		const n_scheme = scheme_word_len(str, v);
+		if (n_scheme) p = v + n_scheme;
+		else p = e > v ? e : p + 1;
+		word = p;
+	}
+}
+/************************************************************
+*  A text (a command line) with the secrets that can be told
+*  written as "********" (each run of them as one), the rest as it
+*  is: the value of every "name=value" whose name is a secret's,
+*  quoted or not (and the "value" of a write-attr whose attribute
+*  names a secret); the same for a "name: value", its name in quotes
+*  or not (a json, a header, a label: "password": x, Authorization:
+*  Basic x, bearer: tok); and a JWT or the credential after "Bearer "
+*  or "Basic ", wherever they are, whatever names them. Each rule
+*  judges the text as it came. Return null when there was nothing to
+*  mask. As the C kernel's mask_secrets_inline().
+************************************************************/
+function mask_secrets_inline(str) {
+	if (typeof str !== "string") return null;
+	if (str.indexOf("=") < 0 && str.indexOf(":") < 0 && str.indexOf("eyJ") < 0 && !/bearer|basic/i.test(str)) return null;
+	if (str.length > MASK_MAX_BYTES) return MASK_TOO_LARGE;
+	let value_is_secret = false;
+	let re_attr = /(^|[ \t])attribute=["']?([^ \t"'\u0000]*)/g;
+	let m;
+	while ((m = re_attr.exec(str)) !== null) if (is_secret_name(m[2].slice(-128))) value_is_secret = true;
+	const marks = new Uint8Array(str.length);
+	mark_params(str, value_is_secret, true, marks);
+	mark_params(str, value_is_secret, false, marks);
+	mark_shapes(str, marks);
+	mark_labels(str, marks);
+	let parts = [];
+	let changed = false;
+	let i = 0;
+	while (i < str.length) {
+		let j = i;
+		if (marks[i]) {
+			while (j < str.length && marks[j]) j++;
 			parts.push("********");
-			copied = end;
 			changed = true;
+		} else {
+			while (j < str.length && !marks[j]) j++;
+			parts.push(str.substring(i, j));
 		}
-		p = end;
-		word = p;
+		i = j;
 	}
-	if (!changed) return null;
-	parts.push(str.substring(copied));
-	return parts.join("");
+	return changed ? parts.join("") : null;
 }
 /************************************************************
 *  A json as a log or a trace may show it: at any depth, the