euredact 0.2.0 → 0.3.1

package/dist/cjs/rules/deDistricts.js

@@ -0,0 +1,92 @@
+"use strict";
+/**
+ * German vehicle registration district codes (Unterscheidungszeichen).
+ *
+ * The set is closed: codes are fixed by the Fahrzeug-Zulassungsverordnung and
+ * maintained by the Kraftfahrt-Bundesamt, changing only when a district is
+ * created, merged, or a historic code is reinstated. That makes membership a
+ * usable precision signal — unlike the open-ended blocklist of standards
+ * prefixes it replaces, which only ever catches acronyms someone thought of.
+ *
+ * Used as a **tier**, not a filter: code on this list -> emit; code absent but
+ * a plate cue nearby -> emit; neither -> reject. So a missing code costs
+ * recall only where there is also no cue. Some entries are also standards
+ * prefixes — DIN is Dinslaken as well as the standards body — which is why the
+ * standards guard is kept alongside this one.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.DE_DISTRICT_CODES = void 0;
+exports.DE_DISTRICT_CODES = new Set([
+    "A", "AA", "AB", "ABG", "AC", "AE", "AH", "AIB", "AIC", "AK", "AL", "ALF",
+    "ALS", "ALZ", "AM", "AN", "ANA", "ANG", "ANK", "AP", "APD", "AR", "ARN",
+    "ART", "AS", "ASD", "ASL", "ASZ", "AT", "AU", "AUR", "AW", "AZ", "AZE",
+    "AÖ", "B", "BA", "BAD", "BAR", "BB", "BBG", "BBL", "BC", "BCH", "BD",
+    "BE", "BED", "BEI", "BEL", "BER", "BF", "BG", "BGD", "BGL", "BH", "BI",
+    "BID", "BIN", "BIR", "BIT", "BIW", "BK", "BKS", "BL", "BLB", "BLK", "BM",
+    "BN", "BNA", "BO", "BOG", "BOH", "BOR", "BOT", "BP", "BR", "BRA", "BRB",
+    "BRG", "BRI", "BRK", "BRL", "BRV", "BS", "BSB", "BSK", "BT", "BTF", "BU",
+    "BUL", "BUR", "BW", "BWL", "BYL", "BZ", "BZA", "BÖ", "BÜD", "BÜS", "BÜZ",
+    "C", "CA", "CAS", "CB", "CE", "CHA", "CHL", "CLP", "CLZ", "CO", "COC",
+    "COE", "CR", "CT", "CUX", "CW", "D", "DA", "DAH", "DAN", "DAU", "DB",
+    "DBR", "DD", "DE", "DEG", "DEL", "DG", "DGF", "DH", "DI", "DIL", "DIN",
+    "DIZ", "DKB", "DL", "DLG", "DM", "DN", "DO", "DON", "DS", "DT", "DU",
+    "DUD", "DW", "DZ", "DÜW", "E", "EA", "EB", "EBE", "EBN", "EBS", "ECK",
+    "ED", "EE", "EF", "EG", "EH", "EHI", "EI", "EIC", "EIH", "EIL", "EIN",
+    "EIS", "EL", "EM", "EMD", "EMS", "EN", "ER", "ERB", "ERH", "ERK", "ES",
+    "ESA", "ESB", "ESW", "EU", "EUT", "EW", "F", "FAL", "FB", "FD", "FDB",
+    "FDS", "FEU", "FF", "FFB", "FG", "FH", "FI", "FKB", "FL", "FLÖ", "FN",
+    "FO", "FOR", "FR", "FRG", "FRI", "FRW", "FS", "FT", "FTL", "FW", "FZ",
+    "FÜ", "FÜS", "G", "GA", "GAN", "GAP", "GC", "GD", "GDB", "GE", "GEL",
+    "GEM", "GEO", "GER", "GF", "GG", "GHA", "GHC", "GI", "GK", "GL", "GLA",
+    "GM", "GMN", "GN", "GNT", "GOA", "GOH", "GP", "GR", "GRA", "GRH", "GRI",
+    "GRM", "GRS", "GRZ", "GS", "GT", "GTH", "GUB", "GUN", "GV", "GVM", "GW",
+    "GZ", "GÖ", "GÜ", "H", "HA", "HAB", "HAL", "HAM", "HAS", "HB", "HBN",
+    "HBS", "HC", "HCH", "HD", "HDH", "HDL", "HE", "HEB", "HEF", "HEI", "HEL",
+    "HER", "HET", "HF", "HG", "HGN", "HGW", "HH", "HHM", "HI", "HIG", "HIP",
+    "HK", "HL", "HM", "HMU", "HN", "HO", "HOG", "HOH", "HOL", "HOM", "HOR",
+    "HOT", "HP", "HR", "HRO", "HS", "HSK", "HST", "HU", "HUS", "HV", "HVL",
+    "HW", "HWI", "HX", "HY", "HZ", "HÖS", "HÜN", "IGB", "IK", "IL", "ILL",
+    "IN", "IS", "IZ", "J", "JB", "JE", "JEV", "JL", "JÜL", "K", "KA", "KAR",
+    "KB", "KC", "KE", "KEH", "KEL", "KEM", "KF", "KG", "KH", "KI", "KIB",
+    "KK", "KL", "KLE", "KLT", "KLZ", "KM", "KN", "KO", "KOZ", "KR", "KRU",
+    "KS", "KT", "KU", "KUS", "KW", "KY", "KYF", "KÖN", "KÖT", "KÜN", "L",
+    "LA", "LAN", "LAT", "LAU", "LB", "LBS", "LBZ", "LC", "LD", "LDK", "LDS",
+    "LE", "LEO", "LER", "LEV", "LF", "LG", "LH", "LI", "LIB", "LIF", "LIN",
+    "LIP", "LK", "LL", "LM", "LN", "LOH", "LOS", "LP", "LR", "LS", "LSA",
+    "LSN", "LSZ", "LU", "LUK", "LWL", "LÖ", "LÖB", "LÜD", "LÜN", "M", "MA",
+    "MAB", "MAI", "MAK", "MAL", "MAR", "MB", "MC", "MD", "ME", "MED", "MEG",
+    "MEI", "MEK", "MEL", "MEP", "MER", "MES", "MET", "MG", "MGH", "MGN", "MH",
+    "MHL", "MI", "MIL", "MK", "MKK", "ML", "MM", "MN", "MO", "MOD", "MOL",
+    "MON", "MOS", "MQ", "MR", "MS", "MSP", "MST", "MT", "MTK", "MTL", "MVL",
+    "MW", "MY", "MYK", "MZ", "MZG", "MÜ", "MÜB", "MÜL", "MÜN", "MÜR", "N",
+    "NAB", "NAI", "NAU", "NB", "ND", "NDH", "NE", "NEA", "NEB", "NEC", "NEN",
+    "NES", "NEU", "NEW", "NF", "NH", "NI", "NIB", "NK", "NL", "NM", "NMB",
+    "NMS", "NOH", "NOL", "NOM", "NOR", "NP", "NR", "NRW", "NRÜ", "NT", "NU",
+    "NVP", "NW", "NWM", "NY", "NZ", "NÖ", "OA", "OAL", "OB", "OBB", "OBG",
+    "OC", "OCH", "OD", "OE", "OF", "OG", "OH", "OHA", "OHV", "OHZ", "OK",
+    "OL", "OLD", "OP", "OPR", "OR", "OS", "OSL", "OTT", "OTW", "OVI", "OVL",
+    "OVP", "OZ", "P", "PA", "PAF", "PAN", "PAR", "PB", "PCH", "PE", "PEG",
+    "PER", "PF", "PI", "PIR", "PK", "PL", "PLÖ", "PM", "PN", "PR", "PRÜ",
+    "PS", "PW", "PZ", "QFT", "QLB", "R", "RA", "RC", "RD", "RDG", "RE", "REG",
+    "REH", "REI", "RG", "RH", "RI", "RID", "RIE", "RL", "RM", "RN", "RO",
+    "ROD", "ROF", "ROH", "ROK", "ROL", "ROS", "ROT", "ROW", "RPL", "RS",
+    "RSL", "RT", "RU", "RV", "RW", "RWL", "RY", "RZ", "RÜD", "RÜG", "S", "SA",
+    "SAB", "SAD", "SAL", "SAN", "SAO", "SAW", "SB", "SBG", "SBK", "SC", "SCZ",
+    "SDH", "SDL", "SDT", "SE", "SEB", "SEE", "SEF", "SEL", "SF", "SFA", "SFB",
+    "SFT", "SG", "SGH", "SH", "SHA", "SHG", "SHK", "SHL", "SHS", "SI", "SIG",
+    "SIM", "SK", "SL", "SLE", "SLF", "SLG", "SLK", "SLN", "SLS", "SLZ", "SLÜ",
+    "SM", "SMÜ", "SN", "SNH", "SO", "SOB", "SOG", "SOK", "SOL", "SON", "SP",
+    "SPB", "SPN", "SPR", "SR", "SRB", "SRO", "ST", "STA", "STB", "STD", "STE",
+    "STH", "STL", "STO", "SU", "SUL", "SW", "SWA", "SWZ", "SY", "SZ", "SZB",
+    "SÄK", "SÖM", "SÜW", "TBB", "TE", "TF", "TG", "TGO", "THL", "THW", "TIR",
+    "TO", "TP", "TR", "TS", "TT", "TUT", "TÖL", "TÖN", "TÜ", "UE", "UEM",
+    "UER", "UFF", "UH", "UL", "UM", "UN", "USI", "V", "VAI", "VB", "VEC",
+    "VER", "VIB", "VIE", "VIT", "VK", "VL", "VOF", "VOH", "VR", "VS", "W",
+    "WA", "WAF", "WAK", "WAM", "WAN", "WAR", "WAT", "WB", "WBS", "WD", "WDA",
+    "WE", "WEB", "WEG", "WEI", "WEL", "WEM", "WEN", "WER", "WES", "WF", "WG",
+    "WHV", "WI", "WIL", "WIS", "WIT", "WIZ", "WK", "WL", "WLG", "WM", "WMS",
+    "WN", "WND", "WO", "WOB", "WOH", "WOL", "WOR", "WOS", "WR", "WRN", "WS",
+    "WSF", "WST", "WSW", "WT", "WTL", "WTM", "WUG", "WUM", "WUN", "WUR", "WW",
+    "WZ", "WZL", "WÜ", "X", "Y", "Z", "ZE", "ZEL", "ZI", "ZIG", "ZP", "ZR",
+    "ZS", "ZW", "ZZ", "ÖHR", "ÜB",
+]);

package/dist/cjs/rules/engine.js

@@ -1,15 +1,66 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.RuleEngine = void 0;
+exports.RuleEngine = exports.COUNTRY_CODE_ALIASES = void 0;
+exports.resolveCountryCode = resolveCountryCode;
 const types_js_1 = require("../types.js");
 const matchers_js_1 = require("./matchers.js");
 const suppressors_js_1 = require("./suppressors.js");
 const structural_js_1 = require("./structural.js");
 const index_js_1 = require("./countries/index.js");
+/**
+ * Heuristic to detect nested quantifiers that cause catastrophic backtracking.
+ * After stripping escaped chars and character classes, look for an unbounded
+ * quantifier (+/*) closing a group that is itself quantified (+/*).
+ */
+const NESTED_QUANTIFIER_RE = /[+*]\)[+*]/;
+function validateCustomPattern(pattern) {
+    try {
+        new RegExp(pattern, "gu");
+    }
+    catch (e) {
+        throw new Error(`Invalid regex pattern: ${e instanceof Error ? e.message : e}`);
+    }
+    const stripped = pattern
+        .replace(/\\./g, "X")
+        .replace(/\[(?:[^\]\\]|\\.)*\]/g, "X");
+    if (NESTED_QUANTIFIER_RE.test(stripped)) {
+        throw new Error("Pattern contains nested quantifiers (e.g. (a+)+) which can cause " +
+            "catastrophic backtracking (ReDoS). Restructure the pattern to " +
+            "avoid quantifiers inside quantified groups.");
+    }
+}
+/**
+ * The country modules use the EU/VAT convention (UK, EL) while the public
+ * contract is ISO 3166-1 alpha-2 (GB, GR). Accept both spellings so a caller
+ * passing correct ISO codes is not punished for it.
+ */
+exports.COUNTRY_CODE_ALIASES = {
+    GB: "UK",
+    GR: "EL",
+    UK: "UK",
+    EL: "EL",
+};
+/** Map a caller-supplied code to a registered one, or null if unknown. */
+function resolveCountryCode(countryCode) {
+    let code = countryCode.trim().toUpperCase();
+    code = exports.COUNTRY_CODE_ALIASES[code] ?? code;
+    return code in index_js_1.COUNTRY_CONFIGS && code !== "SHARED" ? code : null;
+}
+const warnedCountries = new Set();
+function warnUnknownCountry(code) {
+    if (warnedCountries.has(code))
+        return;
+    warnedCountries.add(code);
+    const available = Object.keys(index_js_1.COUNTRY_CONFIGS).filter(c => c !== "SHARED").sort();
+    console.warn(`[euredact] Unknown country code: ${JSON.stringify(code)}. Continuing with ` +
+        `shared country-independent patterns only (email, IBAN, international ` +
+        `phone, credit card, ...). Available: ${available.join(", ")}`);
+}
 class RuleEngine {
     matcher = new matchers_js_1.MultiPatternMatcher();
     loadedCountries = new Set();
     addCustomPattern(name, pattern) {
+        validateCustomPattern(pattern);
         const pdef = {
             entityType: name, pattern, validator: null,
             description: "", contextKeywords: [], requiresContext: false,
@@ -25,7 +76,15 @@ class RuleEngine {
         else {
             configs = [];
             for (const c of countryCodes) {
-                const code = c.toUpperCase();
+                const code = resolveCountryCode(c);
+                if (code === null) {
+                    // Detection continues with the shared, country-independent
+                    // patterns. Throwing on an unknown locale invites callers to wrap
+                    // the call in try/catch and skip redaction — failing open, with
+                    // unredacted PII in the output.
+                    warnUnknownCountry(c);
+                    continue;
+                }
                 const config = index_js_1.COUNTRY_CONFIGS[code];
                 if (config)
                     configs.push(config);
@@ -47,38 +106,87 @@ class RuleEngine {
     }
     detect(text, countryCodes) {
         this.loadCountries(countryCodes);
-        let rawMatches = this.matcher.scan(text);
+        // Scope the scan to requested countries for efficiency
+        // Resolve through the alias table so `countries: ["GB"]` actually scans
+        // the patterns registered under "UK".
+        let scanCodes = null;
         if (countryCodes !== null) {
-            const codesUpper = new Set(countryCodes.map(c => c.toUpperCase()));
-            rawMatches = rawMatches.filter(m => codesUpper.has(m.countryCode) || m.countryCode === "SHARED" || m.countryCode === "CUSTOM");
+            scanCodes = new Set();
+            for (const c of countryCodes) {
+                const code = resolveCountryCode(c);
+                if (code !== null)
+                    scanCodes.add(code);
+            }
+            scanCodes.add("SHARED");
+            scanCodes.add("CUSTOM");
         }
+        let rawMatches = this.matcher.scan(text, scanCodes);
         // Matches that have a validator but fail it create suppression zones:
         // the span is recognisably a specific entity (e.g. IBAN-shaped) so
         // overlapping regex-only matches (license plate, phone) are false
         // positives and must be suppressed.
         const validated = [];
-        const suppressionZones = [];
+        const rawZones = [];
         for (const m of rawMatches) {
-            if (this.matcher.validate(m)) {
-                validated.push(m);
+            const isValid = this.matcher.validate(m);
+            if (isValid) {
+                validated.push({ match: m, hasValidValidator: m.patternDef.validator !== null });
             }
             else if (m.patternDef.validator !== null && !m.patternDef.requiresContext) {
-                suppressionZones.push([m.start, m.end]);
+                rawZones.push([m.start, m.end]);
+            }
+        }
+        // Merge overlapping suppression zones for O(log n) containment checks
+        let zoneStarts = [];
+        let zoneEnds = [];
+        if (rawZones.length > 0) {
+            rawZones.sort((a, b) => a[0] - b[0] || a[1] - b[1]);
+            let [ms, me] = rawZones[0];
+            for (let i = 1; i < rawZones.length; i++) {
+                const [zs, ze] = rawZones[i];
+                if (zs <= me) {
+                    me = Math.max(me, ze);
+                }
+                else {
+                    zoneStarts.push(ms);
+                    zoneEnds.push(me);
+                    ms = zs;
+                    me = ze;
+                }
             }
+            zoneStarts.push(ms);
+            zoneEnds.push(me);
         }
         // Build candidates with priority: validated (3) > custom (2) > regex-only (1)
         const candidates = [];
-        for (const match of validated) {
+        for (const { match, hasValidValidator } of validated) {
             if ((0, suppressors_js_1.shouldSuppress)(text, match))
                 continue;
-            if (match.patternDef.validator === null && suppressionZones.length > 0) {
-                if (suppressionZones.some(([zStart, zEnd]) => match.start >= zStart && match.end <= zEnd)) {
-                    continue;
+            // O(log n) binary-search containment check on merged zones
+            if (match.patternDef.validator === null && zoneStarts.length > 0) {
+                let lo = 0, hi = zoneStarts.length;
+                while (lo < hi) {
+                    const mid = (lo + hi) >>> 1;
+                    if (zoneStarts[mid] <= match.start)
+                        lo = mid + 1;
+                    else
+                        hi = mid;
                 }
+                const idx = lo - 1;
+                if (idx >= 0 && zoneEnds[idx] >= match.end)
+                    continue;
             }
-            const hasValidator = match.patternDef.validator !== null;
-            const isValid = this.matcher.validate(match);
-            const priority = (hasValidator && isValid) ? 3 : match.countryCode === "CUSTOM" ? 2 : 1;
+            // A bare digit run is the weakest evidence in the engine and must never
+            // re-cut a span a structured detector claims (PHONE, SSN, NATIONAL_ID,
+            // BANK_ACCOUNT, VAT...). Postal codes take unclaimed spans only,
+            // whatever the span lengths.
+            const priority = hasValidValidator
+                ? 3
+                : match.countryCode === "CUSTOM"
+                    ? 2
+                    : match.patternDef.entityType === types_js_1.EntityType.POSTAL_CODE
+                        ? 0
+                        : 1;
             const spanLength = match.end - match.start;
             const score = priority * 1_000_000 + spanLength;
             candidates.push({
@@ -109,16 +217,20 @@ class RuleEngine {
             return [];
         const sorted = [...candidates].sort((a, b) => b.score - a.score);
         const result = [];
+        const occupied = new Set();
         for (const { det } of sorted) {
             let overlaps = false;
-            for (const kept of result) {
-                if (det.start < kept.end && det.end > kept.start) {
+            for (let p = det.start; p < det.end; p++) {
+                if (occupied.has(p)) {
                     overlaps = true;
                     break;
                 }
             }
-            if (!overlaps)
+            if (!overlaps) {
+                for (let p = det.start; p < det.end; p++)
+                    occupied.add(p);
                 result.push(det);
+            }
         }
         return result;
     }

package/dist/cjs/rules/matchers.js

@@ -22,11 +22,13 @@ class MultiPatternMatcher {
     compile() {
         this.compiled = true;
     }
-    scan(text) {
+    scan(text, countryCodes = null) {
         if (!this.compiled)
             this.compile();
         const matches = [];
         for (const { regex, patternDef, countryCode } of this.patterns) {
+            if (countryCodes !== null && !countryCodes.has(countryCode))
+                continue;
             regex.lastIndex = 0;
             let m;
             while ((m = regex.exec(text)) !== null) {