@yuneta/gobj-js 7.26.20 → 7.26.21

package/dist/gobj-js.umd.js

@@ -3524,77 +3524,249 @@
 	}
 	/************************************************************
 	*  A credential by its SHAPE, whatever names it -- the C kernel's
-	*  jwt_len() / bearer_token_len(), the shapes the agent's audit
-	*  record redacts:
-	*    - a JWT: "eyJ" (the base64url of '{"') at the start of a
-	*      word, and three parts of base64url joined by '.'; the dots
-	*      at the end of the run are not its own (a JWT ends a
-	*      sentence: "... eyJ.eyJ.sig.");
-	*    - the token after "Bearer " (any case, a word of its own).
-	************************************************************/
+	*  jwt_len() / scheme_credential(), the shapes the agent's audit
+	*  record redacts, and the schemes of an HTTP Authorization:
+	*    - a JWT or a JWE: "eyJ" (the base64url of '{"') at the start
+	*      of a word, base64url, and a '.' after it -- three parts
+	*      joined by '.' (a JWS), five (a JWE), or fewer when a cap cut
+	*      it; the dots at the end of the run are not its own (a JWT
+	*      ends a sentence: "... eyJ.eyJ.sig.");
+	*    - the credential after the scheme word "Bearer" or "Basic"
+	*      (any case, a word of its own): scheme_credential().
+	************************************************************/
+	var MASK_TOKEN_MIN = 8;
+	var MASK_PROSE_MAX = 24;
 	function is_ascii_alnum_code(code) {
 		return code >= 48 && code <= 57 || code >= 65 && code <= 90 || code >= 97 && code <= 122;
 	}
+	function is_ascii_letter_code(code) {
+		return code >= 65 && code <= 90 || code >= 97 && code <= 122;
+	}
+	function is_ascii_upper_code(code) {
+		return code >= 65 && code <= 90;
+	}
 	function is_base64url_code(code) {
 		return is_ascii_alnum_code(code) || code === 45 || code === 95;
 	}
+	function ascii_case_equal(str, p, word) {
+		if (str.length - p < word.length) return false;
+		for (let i = 0; i < word.length; i++) {
+			let code = str.charCodeAt(p + i);
+			if (code >= 65 && code <= 90) code += 32;
+			if (code !== word.charCodeAt(i)) return false;
+		}
+		return true;
+	}
 	function jwt_len(str, p) {
 		if (str.length - p < 3 || str[p] !== "e" || str[p + 1] !== "y" || str[p + 2] !== "J") return 0;
 		if (p > 0 && (is_base64url_code(str.charCodeAt(p - 1)) || str[p - 1] === ".")) return 0;
 		let e = p;
-		let dots = 0;
+		let dotted = false;
 		while (e < str.length && (is_base64url_code(str.charCodeAt(e)) || str[e] === ".")) {
-			if (str[e] === ".") dots++;
+			if (str[e] === ".") dotted = true;
 			e++;
 		}
-		while (str[e - 1] === ".") {
-			e--;
-			dots--;
+		if (!dotted) return 0;
+		while (str[e - 1] === ".") e--;
+		return e - p;
+	}
+	function scheme_word_len(str, p) {
+		if (p > 0 && is_ascii_alnum_code(str.charCodeAt(p - 1))) return 0;
+		for (const scheme of ["bearer", "basic"]) {
+			const n = scheme.length;
+			if (str.length - p > n && ascii_case_equal(str, p, scheme) && (str[p + n] === " " || str[p + n] === "	")) return n;
+		}
+		return 0;
+	}
+	function code_points(str, w, n) {
+		let count = 0;
+		for (let i = w; i < w + n; i++) {
+			const code = str.charCodeAt(i);
+			if (code < 56320 || code > 57343) count++;
+		}
+		return count;
+	}
+	function is_prose_word(str, w, n) {
+		if (n === 0 || n >= MASK_PROSE_MAX) return false;
+		let i = w;
+		const end = w + n;
+		while (true) {
+			let r = i;
+			let upper_rest = true;
+			let lower_rest = true;
+			while (r < end && is_ascii_letter_code(str.charCodeAt(r))) {
+				if (r > i) {
+					if (is_ascii_upper_code(str.charCodeAt(r))) lower_rest = false;
+					else upper_rest = false;
+				}
+				r++;
+			}
+			if (r === i) return false;
+			if (!lower_rest && !(upper_rest && is_ascii_upper_code(str.charCodeAt(i)))) return false;
+			if (r === end) return true;
+			if (str[r] !== "-" && str[r] !== "." && str[r] !== "/" || r + 1 === end) return false;
+			i = r + 1;
+		}
+	}
+	function base64_digit(code) {
+		if (code >= 65 && code <= 90) return code - 65;
+		if (code >= 97 && code <= 122) return code - 97 + 26;
+		if (code >= 48 && code <= 57) return code - 48 + 52;
+		if (code === 43) return 62;
+		if (code === 47) return 63;
+		return -1;
+	}
+	function is_basic_credential(str, w, n) {
+		let bits = 0;
+		let n_bits = 0;
+		for (let i = 0; i < n; i++) {
+			const v = base64_digit(str.charCodeAt(w + i));
+			if (v < 0) return false;
+			bits = (bits << 6 | v) & 16383;
+			n_bits += 6;
+			if (n_bits >= 8) {
+				n_bits -= 8;
+				if ((bits >> n_bits & 255) === 58) return true;
+			}
 		}
-		return dots === 2 ? e - p : 0;
+		return false;
 	}
-	var BEARER_STOPS = " 	\r\n'\",;}]\0";
-	function bearer_token(str, p) {
-		const word_len = 6;
-		if (str.length - p <= word_len || str.slice(p, p + word_len).toLowerCase() !== "bearer") return [0, 0];
-		if (p > 0 && is_ascii_alnum_code(str.charCodeAt(p - 1))) return [0, 0];
-		let t = p + word_len;
-		if (str[t] !== " " && str[t] !== "	") return [0, 0];
+	var SCHEME_WORD_STOPS = " 	\r\n\"',;}]\0";
+	function scheme_credential(str, p) {
+		const n = scheme_word_len(str, p);
+		if (!n) return [0, 0];
+		const scheme = n === 5 ? "basic" : "bearer";
+		let context = false;
+		let t = p + n;
 		while (t < str.length && (str[t] === " " || str[t] === "	")) t++;
+		if (t < str.length && scheme_word_len(str, t) === n && ascii_case_equal(str, t, scheme)) {
+			t += n;
+			context = true;
+			while (t < str.length && (str[t] === " " || str[t] === "	")) t++;
+		}
+		if (t >= str.length) return [0, 0];
+		if (str[t] === "\"" || str[t] === "'") {
+			let q = t + 1;
+			while (q < str.length && str[q] !== str[t] && str[q] !== " " && str[q] !== "	" && str[q] !== "\r" && str[q] !== "\n" && str[q] !== "\0") q++;
+			if (q < str.length && str[q] === str[t] && q > t + 1) return [t - p, q + 1 - t];
+			return [0, 0];
+		}
 		let e = t;
-		while (e < str.length && BEARER_STOPS.indexOf(str[e]) < 0) e++;
+		while (e < str.length && SCHEME_WORD_STOPS.indexOf(str[e]) < 0) e++;
+		if (e === t) return [0, 0];
+		if (!context) {
+			let w_end = e;
+			while (w_end > t && str[w_end - 1] === ".") w_end--;
+			const len = w_end - t;
+			if (len === 0 || is_prose_word(str, t, len)) return [0, 0];
+			if (n === 5) {
+				if (!is_basic_credential(str, t, len)) return [0, 0];
+			} else if (code_points(str, t, len) < MASK_TOKEN_MIN) return [0, 0];
+		}
 		return [t - p, e - t];
 	}
-	/************************************************************
-	*  A text (a command line) with the value of every "name=value"
-	*  whose name is a secret's written as "********", quoted or not
-	*  (and the "value" of a write-attr whose attribute names a
-	*  secret); and a JWT or the token after "Bearer ", wherever they
-	*  are, whatever names them. The rest as it is. Return null when
-	*  there was nothing to mask. As the C kernel's
-	*  mask_secrets_inline().
-	************************************************************/
+	function shape_len(str, p) {
+		const c = str[p];
+		if (c === "e") return [0, jwt_len(str, p)];
+		if (c === "b" || c === "B") return scheme_credential(str, p);
+		return [0, 0];
+	}
+	function shape_len_7_26_9(str, p) {
+		const c = str[p];
+		if (c === "e") {
+			if (str.length - p < 3 || str[p + 1] !== "y" || str[p + 2] !== "J") return [0, 0];
+			if (p > 0 && (is_base64url_code(str.charCodeAt(p - 1)) || str[p - 1] === ".")) return [0, 0];
+			let e = p;
+			let dots = 0;
+			while (e < str.length && (is_base64url_code(str.charCodeAt(e)) || str[e] === ".")) {
+				if (str[e] === ".") dots++;
+				e++;
+			}
+			while (str[e - 1] === ".") {
+				e--;
+				dots--;
+			}
+			return dots === 2 ? [0, e - p] : [0, 0];
+		}
+		if (c === "b" || c === "B") {
+			if (str.length - p <= 6 || !ascii_case_equal(str, p, "bearer")) return [0, 0];
+			if (p > 0 && is_ascii_alnum_code(str.charCodeAt(p - 1))) return [0, 0];
+			let t = p + 6;
+			if (str[t] !== " " && str[t] !== "	") return [0, 0];
+			while (t < str.length && (str[t] === " " || str[t] === "	")) t++;
+			let e = t;
+			while (e < str.length && " 	\r\n'\",;}]\0".indexOf(str[e]) < 0) e++;
+			return [t - p, e - t];
+		}
+		return [0, 0];
+	}
+	var COLON_VALUE_STOPS = " 	\r\n,;&)]}<>\"'\0";
+	function colon_value_end(str, v) {
+		if (v >= str.length) return v;
+		const c = str[v];
+		if (c === "\"" || c === "'") {
+			let e = v + 1;
+			while (e < str.length && str[e] !== c) {
+				if (str[e] === "\\" && e + 1 < str.length) e++;
+				e++;
+			}
+			return e < str.length ? e + 1 : str.length;
+		}
+		if (c === "{" || c === "[") {
+			let depth = 0;
+			let in_string = false;
+			for (let e = v; e < str.length; e++) if (in_string) {
+				if (str[e] === "\\" && e + 1 < str.length) e++;
+				else if (str[e] === "\"") in_string = false;
+			} else if (str[e] === "\"") in_string = true;
+			else if (str[e] === "{" || str[e] === "[") depth++;
+			else if (str[e] === "}" || str[e] === "]") {
+				depth--;
+				if (depth === 0) return e + 1;
+			}
+			return str.length;
+		}
+		if (c === "\\") {
+			let q = v;
+			while (q < str.length && str[q] === "\\") q++;
+			if (q < str.length && (str[q] === "\"" || str[q] === "'")) {
+				const level = q - v;
+				let run = 0;
+				for (let e = q + 1; e < str.length; e++) {
+					if (str[e] === "\\") {
+						run++;
+						continue;
+					}
+					if (str[e] === str[q] && run === level) return e + 1;
+					run = 0;
+				}
+				return str.length;
+			}
+		}
+		let e = v;
+		const n = scheme_word_len(str, v);
+		if (n) {
+			e = v + n;
+			while (e < str.length && (str[e] === " " || str[e] === "	")) e++;
+			if (e < str.length && (str[e] === "\"" || str[e] === "'")) return colon_value_end(str, e);
+		}
+		while (e < str.length && COLON_VALUE_STOPS.indexOf(str[e]) < 0) e++;
+		return e;
+	}
 	var MASK_MAX_NAME = 128;
 	var MASK_MAX_BYTES = 4194304;
 	var MASK_TOO_LARGE = "<not shown: too large to mask>";
-	function mask_secrets_inline(str) {
-		if (typeof str !== "string") return null;
-		if (str.indexOf("=") < 0 && str.indexOf("eyJ") < 0 && !/bearer/i.test(str)) return null;
-		if (str.length > MASK_MAX_BYTES) return MASK_TOO_LARGE;
-		let value_is_secret = false;
-		let re_attr = /(^|[ \t])attribute=["']?([^ \t"']*)/g;
-		let m;
-		while ((m = re_attr.exec(str)) !== null) if (is_secret_name(m[2].slice(-128))) value_is_secret = true;
-		let parts = [];
-		let copied = 0;
-		let changed = false;
+	function mark_range(marks, from, to) {
+		for (let i = from; i < to; i++) marks[i] = 1;
+	}
+	function mark_params(str, value_is_secret, as_7_26_9, marks) {
+		const is_blank_or_end = (i) => i >= str.length || str[i] === " " || str[i] === "	" || str[i] === "\0";
 		let outer = "";
 		let word = 0;
 		let p = 0;
-		const is_blank_or_end = (i) => i >= str.length || str[i] === " " || str[i] === "	";
 		while (p < str.length) {
-			let c = str[p];
-			if (c === " " || c === "	") {
+			const c = str[p];
+			if (c === " " || c === "	" || c === "\0") {
 				p++;
 				word = p;
 				continue;
@@ -3603,48 +3775,116 @@
 				if (!outer && (p === 0 || str[p - 1] === " " || str[p - 1] === "	" || str[p - 1] === "=")) outer = c;
 				else if (c === outer && is_blank_or_end(p + 1)) outer = "";
 			}
-			let shape = c === "e" ? jwt_len(str, p) : 0;
-			let token_offset = 0;
-			if (c === "b" || c === "B") [token_offset, shape] = bearer_token(str, p);
-			if (shape) {
-				parts.push(str.substring(copied, p + token_offset));
-				parts.push("********");
-				p += token_offset + shape;
-				copied = p;
-				changed = true;
-				word = p;
-				continue;
+			if (as_7_26_9) {
+				const [offset, n] = shape_len_7_26_9(str, p);
+				if (n) {
+					p += offset + n;
+					word = p;
+					continue;
+				}
 			}
 			if (c !== "=") {
 				p++;
 				continue;
 			}
-			let name = str.substring(Math.max(word, p - MASK_MAX_NAME), p);
+			const name_from = Math.max(word, p - MASK_MAX_NAME);
+			const name = str.substring(name_from, p);
 			word = p + 1;
-			if (!(is_secret_name(name) || value_is_secret && name.toLowerCase() === "value")) {
+			if (!(is_secret_name(name) || value_is_secret && name.length === 5 && ascii_case_equal(str, name_from, "value"))) {
 				p++;
 				continue;
 			}
 			p++;
-			let quote = str[p] === "\"" || str[p] === "'" ? str[p] : "";
 			let end;
+			const quote = p < str.length && (str[p] === "\"" || str[p] === "'") ? str[p] : "";
 			if (quote) {
 				end = p + 1;
-				while (end < str.length && str[end] !== quote) end++;
-				if (str[end] === quote) end++;
+				while (end < str.length && str[end] !== quote && str[end] !== "\0") end++;
+				if (end < str.length && str[end] === quote) end++;
 			} else end = inline_secret_value_end(str, p, outer);
-			if (end > p) {
-				parts.push(str.substring(copied, p));
+			mark_range(marks, p, end);
+			p = end;
+			word = p;
+		}
+	}
+	function mark_shapes(str, marks) {
+		for (let p = 0; p < str.length; p++) {
+			const c = str[p];
+			if (c !== "e" && c !== "b" && c !== "B") continue;
+			const [offset, n] = shape_len(str, p);
+			if (n) mark_range(marks, p + offset, p + offset + n);
+		}
+	}
+	function mark_labels(str, marks) {
+		let word = 0;
+		let p = 0;
+		while (p < str.length) {
+			const c = str[p];
+			if (c === " " || c === "	" || c === "\0" || c === "=") {
+				p++;
+				word = p;
+				continue;
+			}
+			if (c !== ":") {
+				p++;
+				continue;
+			}
+			if (!is_secret_name(str.substring(Math.max(word, p - MASK_MAX_NAME), p))) {
+				p++;
+				word = p;
+				continue;
+			}
+			let v = p + 1;
+			while (v < str.length && (str[v] === " " || str[v] === "	")) v++;
+			const e = colon_value_end(str, v);
+			mark_range(marks, v, e);
+			const n_scheme = scheme_word_len(str, v);
+			if (n_scheme) p = v + n_scheme;
+			else p = e > v ? e : p + 1;
+			word = p;
+		}
+	}
+	/************************************************************
+	*  A text (a command line) with the secrets that can be told
+	*  written as "********" (each run of them as one), the rest as it
+	*  is: the value of every "name=value" whose name is a secret's,
+	*  quoted or not (and the "value" of a write-attr whose attribute
+	*  names a secret); the same for a "name: value", its name in quotes
+	*  or not (a json, a header, a label: "password": x, Authorization:
+	*  Basic x, bearer: tok); and a JWT or the credential after "Bearer "
+	*  or "Basic ", wherever they are, whatever names them. Each rule
+	*  judges the text as it came. Return null when there was nothing to
+	*  mask. As the C kernel's mask_secrets_inline().
+	************************************************************/
+	function mask_secrets_inline(str) {
+		if (typeof str !== "string") return null;
+		if (str.indexOf("=") < 0 && str.indexOf(":") < 0 && str.indexOf("eyJ") < 0 && !/bearer|basic/i.test(str)) return null;
+		if (str.length > MASK_MAX_BYTES) return MASK_TOO_LARGE;
+		let value_is_secret = false;
+		let re_attr = /(^|[ \t])attribute=["']?([^ \t"'\u0000]*)/g;
+		let m;
+		while ((m = re_attr.exec(str)) !== null) if (is_secret_name(m[2].slice(-128))) value_is_secret = true;
+		const marks = new Uint8Array(str.length);
+		mark_params(str, value_is_secret, true, marks);
+		mark_params(str, value_is_secret, false, marks);
+		mark_shapes(str, marks);
+		mark_labels(str, marks);
+		let parts = [];
+		let changed = false;
+		let i = 0;
+		while (i < str.length) {
+			let j = i;
+			if (marks[i]) {
+				while (j < str.length && marks[j]) j++;
 				parts.push("********");
-				copied = end;
 				changed = true;
+			} else {
+				while (j < str.length && !marks[j]) j++;
+				parts.push(str.substring(i, j));
 			}
-			p = end;
-			word = p;
+			i = j;
 		}
-		if (!changed) return null;
-		parts.push(str.substring(copied));
-		return parts.join("");
+		return changed ? parts.join("") : null;
 	}
 	/************************************************************
 	*  A json as a log or a trace may show it: at any depth, the