dsh-code-security 0.4.0 → 0.4.1

package/CHANGELOG.md

@@ -4,6 +4,11 @@
 
 [历史英文记录](docs/CHANGELOG.en.md)
 
+## 0.4.1 (2026-10-15)
+
+- 修复同一行同时命中高熵密钥和其他安全规则时，其他规则的证据仍带出原始字符串的问题；所有证据统一使用同一套高熵脱敏判断，也覆盖截断的字符串。
+- 回归检查模型返回值、历史、已接受基线、SARIF 与 Markdown，保留原始证据指纹用于跟踪。
+
 ## 0.4.0 (2026-10-15)
 
 - 增加 DSH 中英文设置工作台：项目选择、扫描/增量/复查、覆盖情况、问题筛选、脱敏证据、复制位置与报告下载。

package/docs/VALIDATION.md

@@ -2,6 +2,10 @@
 
 本页整理原 README 的历史验证说明，保留当时的版本、日期与范围。自动测试、启动检查、浏览器操作和真实服务验收分别记录，不能相互替代。更详细的版本验收文件仍保留在仓库中。
 
+## 0.4.1（2026-10-15）
+
+79 项 Windows 测试全部通过，包含下列三个真实原生引擎。新增同一行同时命中注入与高熵密钥的回归，确认其他规则的证据、返回值、历史、基线和导出也不再带出原值；截断的字符串使用相同判断。其余功能与客户端沿用 0.4.0 的验收范围。
+
 ## 0.4.0（2026-10-15）
 
 本地环境：Windows、Node 24.16.0、官方 npm DSH 0.2.1-alpha.3。全部使用 E 盘隔离目录与合成数据，没有复制用户密钥或修改前台桌面窗口。

package/lib/privacy.d.ts

@@ -1,4 +1,5 @@
 import type { Finding } from './scanner.js';
+export declare function isHighEntropyToken(value: string): boolean;
 export declare function evidenceFingerprint(finding: Pick<Finding, 'ruleId' | 'file' | 'snippet'> & {
     fingerprint?: string;
 }): string;

package/lib/privacy.js

@@ -1,6 +1,19 @@
 /** Findings crossing the scanner boundary never contain complete credentials. */
 import { createHash } from 'node:crypto';
 import path from 'node:path';
+export function isHighEntropyToken(value) {
+    if (value.length < 24 || !/\d/.test(value) || /^[0-9]+$/.test(value))
+        return false;
+    const counts = new Map();
+    for (const char of value)
+        counts.set(char, (counts.get(char) ?? 0) + 1);
+    let entropy = 0;
+    for (const count of counts.values()) {
+        const frequency = count / value.length;
+        entropy -= frequency * Math.log2(frequency);
+    }
+    return entropy >= 3.8;
+}
 export function evidenceFingerprint(finding) {
     if (/^[a-f0-9]{64}$/.test(finding.fingerprint ?? ''))
         return finding.fingerprint;
@@ -15,7 +28,9 @@ export function redactText(text) {
         .replace(/(^\s*[A-Z0-9_]*(?:KEY|TOKEN|SECRET|PASSWORD|PASS)[A-Z0-9_]*\s*=\s*)([^\r\n]+)/gm, '$1[REDACTED]')
         .replace(/\b(?:gh[pousr]_[A-Za-z0-9_]{16,}|github_pat_[A-Za-z0-9_]{20,}|sk-(?:proj-)?[A-Za-z0-9_-]{16,}|AKIA[A-Z0-9]{16})\b/g, '[REDACTED]')
         .replace(/(\bBearer\s+)[A-Za-z0-9._~+\/-]{12,}/gi, '$1[REDACTED]')
-        .replace(/(https?:\/\/)[^\s/@]+:[^\s/@]+@/g, '$1[REDACTED]@');
+        .replace(/(https?:\/\/)[^\s/@]+:[^\s/@]+@/g, '$1[REDACTED]@')
+        // A credential must stay redacted when another rule reports the same source line.
+        .replace(/(['"`])([A-Za-z0-9+/=_-]{24,})(?:\1|$)/g, (match, quote, value) => isHighEntropyToken(value) ? quote + '[REDACTED]' + quote : match);
 }
 export function protectFinding(finding) {
     const fingerprint = evidenceFingerprint(finding);

package/lib/scanner.js

@@ -9,7 +9,7 @@ import { createHash } from 'node:crypto';
 import { DEFAULT_EXCLUDE_DIRS } from './config.js';
 import { languageForFile, RULES } from './rules.js';
 import { policyExcludesDir, policyIgnores } from './policy.js';
-import { protectFinding } from './privacy.js';
+import { protectFinding, isHighEntropyToken } from './privacy.js';
 import { sanitizedHtmlLines } from './syntax.js';
 const DISABLE_NEXT = /secure-review-disable-next-line(?:\s+([\w,-]+))?/;
 const DISABLE_LINE = /secure-review-disable-line(?:\s+([\w,-]+))?/;
@@ -50,31 +50,12 @@ function shouldScanFile(file) {
         return true;
     return TEXT_EXTENSIONS.test(file);
 }
-/** Shannon 熵；只对 24 位以上且以字母数字为主的 token 判分。 */
-function shannon(text) {
-    if (text.length < 16)
-        return 0;
-    const counts = new Map();
-    for (const char of text)
-        counts.set(char, (counts.get(char) ?? 0) + 1);
-    let entropy = 0;
-    for (const count of counts.values()) {
-        const p = count / text.length;
-        entropy -= p * Math.log2(p);
-    }
-    return entropy;
-}
 const TOKEN_PATTERN = /['"]([A-Za-z0-9+/=_-]{24,})['"]/g;
-const HIGH_ENTROPY_THRESHOLD = 3.8;
 function detectHighEntropy(line, lineNumber, rel, rule) {
     const findings = [];
     for (const match of line.matchAll(TOKEN_PATTERN)) {
         const token = match[1];
-        if (/^[0-9]+$/.test(token))
-            continue;
-        if (!/\d/.test(token))
-            continue;
-        if (shannon(token) < HIGH_ENTROPY_THRESHOLD)
+        if (!isHighEntropyToken(token))
             continue;
         const id = makeId(rule.id, rel, lineNumber, token.slice(0, 32));
         findings.push({

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dsh-code-security",
-  "version": "0.4.0",
+  "version": "0.4.1",
   "description": "对代码与 Git 改动进行本地静态安全检查，并追踪修复结果。",
   "type": "module",
   "main": "lib/index.js",