logshield-cli 0.2.7 → 0.2.9
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/dist/cli/index.cjs +6 -15
- package/package.json +1 -1
- package/dist/cli/engine/applyRules.js +0 -21
- package/dist/cli/engine/guard.js +0 -12
- package/dist/cli/engine/sanitizeLog.js +0 -18
- package/dist/cli/readInput.js +0 -15
- package/dist/cli/rules/cloud.js +0 -15
- package/dist/cli/rules/credentials.js +0 -15
- package/dist/cli/rules/creditCard.js +0 -15
- package/dist/cli/rules/custom.js +0 -15
- package/dist/cli/rules/index.js +0 -38
- package/dist/cli/rules/tokens.js +0 -20
- package/dist/cli/rules/types.js +0 -2
- package/dist/cli/rules/urls.js +0 -10
- package/dist/cli/summary.js +0 -10
- package/dist/cli/utils/luhn.js +0 -19
- package/dist/cli/writeOutput.js +0 -8
package/dist/cli/index.cjs
CHANGED
|
@@ -346,8 +346,6 @@ var init_sanitizeLog = __esm({
|
|
|
346
346
|
});
|
|
347
347
|
|
|
348
348
|
// src/cli/index.ts
|
|
349
|
-
var import_fs = __toESM(require("fs"));
|
|
350
|
-
var import_path = __toESM(require("path"));
|
|
351
349
|
var { readInput: readInput2 } = (init_readInput(), __toCommonJS(readInput_exports));
|
|
352
350
|
var { writeOutput: writeOutput2 } = (init_writeOutput(), __toCommonJS(writeOutput_exports));
|
|
353
351
|
var { printSummary: printSummary2 } = (init_summary(), __toCommonJS(summary_exports));
|
|
@@ -357,14 +355,7 @@ function hasFlag(flag) {
|
|
|
357
355
|
return args.includes(flag);
|
|
358
356
|
}
|
|
359
357
|
function getVersion() {
|
|
360
|
-
|
|
361
|
-
const cliPath = process.argv[1];
|
|
362
|
-
const pkgPath = import_path.default.resolve(cliPath, "../../../package.json");
|
|
363
|
-
const pkg = JSON.parse(import_fs.default.readFileSync(pkgPath, "utf8"));
|
|
364
|
-
return pkg.version;
|
|
365
|
-
} catch {
|
|
366
|
-
return "unknown";
|
|
367
|
-
}
|
|
358
|
+
return true ? "0.2.9" : "unknown";
|
|
368
359
|
}
|
|
369
360
|
function getFileArg() {
|
|
370
361
|
const file = args[1];
|
|
@@ -376,11 +367,11 @@ async function main() {
|
|
|
376
367
|
process.stdout.write(`Usage: logshield scan [file]
|
|
377
368
|
|
|
378
369
|
Options:
|
|
379
|
-
--strict
|
|
380
|
-
--json
|
|
381
|
-
--summary
|
|
382
|
-
--version
|
|
383
|
-
--help
|
|
370
|
+
--strict Aggressive redaction
|
|
371
|
+
--json JSON output
|
|
372
|
+
--summary Print summary
|
|
373
|
+
--version Print version
|
|
374
|
+
--help Show help
|
|
384
375
|
`);
|
|
385
376
|
process.exit(0);
|
|
386
377
|
}
|
package/package.json
CHANGED
|
@@ -1,21 +0,0 @@
|
|
|
1
|
-
"use strict";
|
|
2
|
-
Object.defineProperty(exports, "__esModule", { value: true });
|
|
3
|
-
exports.applyRules = applyRules;
|
|
4
|
-
function applyRules(input, rules, ctx, matches) {
|
|
5
|
-
let output = input;
|
|
6
|
-
for (const rule of rules) {
|
|
7
|
-
output = output.replace(rule.pattern, (...args) => {
|
|
8
|
-
const match = args[0];
|
|
9
|
-
const groups = args.slice(1, -2);
|
|
10
|
-
const replaced = rule.replace(match, ctx, groups);
|
|
11
|
-
if (replaced !== match) {
|
|
12
|
-
matches.push({
|
|
13
|
-
rule: rule.name,
|
|
14
|
-
value: match,
|
|
15
|
-
});
|
|
16
|
-
}
|
|
17
|
-
return replaced;
|
|
18
|
-
});
|
|
19
|
-
}
|
|
20
|
-
return output;
|
|
21
|
-
}
|
package/dist/cli/engine/guard.js
DELETED
|
@@ -1,12 +0,0 @@
|
|
|
1
|
-
"use strict";
|
|
2
|
-
Object.defineProperty(exports, "__esModule", { value: true });
|
|
3
|
-
exports.guardInput = guardInput;
|
|
4
|
-
const MAX_SIZE = 200 * 1024; // 200KB
|
|
5
|
-
function guardInput(input) {
|
|
6
|
-
if (!input)
|
|
7
|
-
return "";
|
|
8
|
-
if (input.length > MAX_SIZE) {
|
|
9
|
-
throw new Error("Log size exceeds 200KB limit");
|
|
10
|
-
}
|
|
11
|
-
return input;
|
|
12
|
-
}
|
|
@@ -1,18 +0,0 @@
|
|
|
1
|
-
"use strict";
|
|
2
|
-
Object.defineProperty(exports, "__esModule", { value: true });
|
|
3
|
-
exports.sanitizeLog = sanitizeLog;
|
|
4
|
-
const applyRules_1 = require("./applyRules");
|
|
5
|
-
const guard_1 = require("./guard");
|
|
6
|
-
const rules_1 = require("../rules");
|
|
7
|
-
function sanitizeLog(input, options) {
|
|
8
|
-
(0, guard_1.guardInput)(input);
|
|
9
|
-
if (!input) {
|
|
10
|
-
return { output: "", matches: [] };
|
|
11
|
-
}
|
|
12
|
-
const ctx = {
|
|
13
|
-
strict: Boolean(options?.strict),
|
|
14
|
-
};
|
|
15
|
-
const matches = [];
|
|
16
|
-
const output = (0, applyRules_1.applyRules)(input, rules_1.allRules, ctx, matches);
|
|
17
|
-
return { output, matches };
|
|
18
|
-
}
|
package/dist/cli/readInput.js
DELETED
|
@@ -1,15 +0,0 @@
|
|
|
1
|
-
import fs from "fs";
|
|
2
|
-
export function readInput(file) {
|
|
3
|
-
if (file) {
|
|
4
|
-
if (!fs.existsSync(file)) {
|
|
5
|
-
throw new Error(`File not found: ${file}`);
|
|
6
|
-
}
|
|
7
|
-
return Promise.resolve(fs.readFileSync(file, "utf8"));
|
|
8
|
-
}
|
|
9
|
-
return new Promise((resolve) => {
|
|
10
|
-
let data = "";
|
|
11
|
-
process.stdin.setEncoding("utf8");
|
|
12
|
-
process.stdin.on("data", (chunk) => (data += chunk));
|
|
13
|
-
process.stdin.on("end", () => resolve(data));
|
|
14
|
-
});
|
|
15
|
-
}
|
package/dist/cli/rules/cloud.js
DELETED
|
@@ -1,15 +0,0 @@
|
|
|
1
|
-
"use strict";
|
|
2
|
-
Object.defineProperty(exports, "__esModule", { value: true });
|
|
3
|
-
exports.cloudRules = void 0;
|
|
4
|
-
exports.cloudRules = [
|
|
5
|
-
{
|
|
6
|
-
name: "AWS_ACCESS_KEY",
|
|
7
|
-
pattern: /\bAKIA[0-9A-Z]{16,20}\b/g,
|
|
8
|
-
replace: (match, { strict }) => strict ? "<REDACTED_AWS_KEY>" : match,
|
|
9
|
-
},
|
|
10
|
-
{
|
|
11
|
-
name: "STRIPE_SECRET_KEY",
|
|
12
|
-
pattern: /\b(?:LS_STRIPE_(?:TEST|LIVE)_KEY_[A-Z0-9_]{10,}|sk_(?:test|live)_[A-Za-z0-9]{16,})\b/g,
|
|
13
|
-
replace: (match, ctx) => ctx.strict ? "<REDACTED_STRIPE_KEY>" : match,
|
|
14
|
-
},
|
|
15
|
-
];
|
|
@@ -1,15 +0,0 @@
|
|
|
1
|
-
"use strict";
|
|
2
|
-
Object.defineProperty(exports, "__esModule", { value: true });
|
|
3
|
-
exports.credentialRules = void 0;
|
|
4
|
-
exports.credentialRules = [
|
|
5
|
-
{
|
|
6
|
-
name: "PASSWORD",
|
|
7
|
-
pattern: /\bpassword=([^\s]+)/gi,
|
|
8
|
-
replace: (_match, _value, _ctx) => "password=<REDACTED_PASSWORD>",
|
|
9
|
-
},
|
|
10
|
-
{
|
|
11
|
-
name: "API_KEY",
|
|
12
|
-
pattern: /\bapiKey=([A-Za-z0-9_\-]{16,})\b/g,
|
|
13
|
-
replace: () => "<REDACTED_API_KEY>",
|
|
14
|
-
},
|
|
15
|
-
];
|
|
@@ -1,15 +0,0 @@
|
|
|
1
|
-
"use strict";
|
|
2
|
-
Object.defineProperty(exports, "__esModule", { value: true });
|
|
3
|
-
exports.creditCardRules = void 0;
|
|
4
|
-
const luhn_1 = require("../utils/luhn");
|
|
5
|
-
exports.creditCardRules = [
|
|
6
|
-
{
|
|
7
|
-
name: "CREDIT_CARD",
|
|
8
|
-
pattern: /\b(?:\d[ -]*?){13,19}\b/g,
|
|
9
|
-
replace: (match, { strict }) => {
|
|
10
|
-
if (!strict)
|
|
11
|
-
return match;
|
|
12
|
-
return (0, luhn_1.isValidLuhn)(match) ? "<REDACTED_CC>" : match;
|
|
13
|
-
},
|
|
14
|
-
},
|
|
15
|
-
];
|
package/dist/cli/rules/custom.js
DELETED
|
@@ -1,15 +0,0 @@
|
|
|
1
|
-
"use strict";
|
|
2
|
-
Object.defineProperty(exports, "__esModule", { value: true });
|
|
3
|
-
exports.customRules = void 0;
|
|
4
|
-
exports.customRules = [
|
|
5
|
-
{
|
|
6
|
-
name: "GENERIC_SECRET_KV",
|
|
7
|
-
pattern: /"(\w+)":"([^"]{12,})"/g,
|
|
8
|
-
replace: (match, ctx, groups) => {
|
|
9
|
-
if (!ctx.strict)
|
|
10
|
-
return match;
|
|
11
|
-
const key = groups[0] ?? "token";
|
|
12
|
-
return `"${key}":"<REDACTED_SECRET>"`;
|
|
13
|
-
},
|
|
14
|
-
},
|
|
15
|
-
];
|
package/dist/cli/rules/index.js
DELETED
|
@@ -1,38 +0,0 @@
|
|
|
1
|
-
"use strict";
|
|
2
|
-
Object.defineProperty(exports, "__esModule", { value: true });
|
|
3
|
-
exports.allRules = void 0;
|
|
4
|
-
const tokens_1 = require("./tokens");
|
|
5
|
-
const credentials_1 = require("./credentials");
|
|
6
|
-
const cloud_1 = require("./cloud");
|
|
7
|
-
const creditCard_1 = require("./creditCard");
|
|
8
|
-
const urls_1 = require("./urls");
|
|
9
|
-
const custom_1 = require("./custom");
|
|
10
|
-
function normalize(rules) {
|
|
11
|
-
return rules.map((rule) => {
|
|
12
|
-
if (typeof rule.replace === "function") {
|
|
13
|
-
return rule;
|
|
14
|
-
}
|
|
15
|
-
const value = rule.replace;
|
|
16
|
-
return {
|
|
17
|
-
...rule,
|
|
18
|
-
replace: () => value,
|
|
19
|
-
};
|
|
20
|
-
});
|
|
21
|
-
}
|
|
22
|
-
/**
|
|
23
|
-
* ORDER IS CONTRACT:
|
|
24
|
-
* 1. tokenRules ? JWT first
|
|
25
|
-
* 2. credential ? password, api key
|
|
26
|
-
* 3. cloud
|
|
27
|
-
* 4. credit card
|
|
28
|
-
* 5. urls
|
|
29
|
-
* 6. custom
|
|
30
|
-
*/
|
|
31
|
-
exports.allRules = normalize([
|
|
32
|
-
...tokens_1.tokenRules,
|
|
33
|
-
...credentials_1.credentialRules,
|
|
34
|
-
...cloud_1.cloudRules,
|
|
35
|
-
...creditCard_1.creditCardRules,
|
|
36
|
-
...urls_1.urlRules,
|
|
37
|
-
...custom_1.customRules,
|
|
38
|
-
]);
|
package/dist/cli/rules/tokens.js
DELETED
|
@@ -1,20 +0,0 @@
|
|
|
1
|
-
"use strict";
|
|
2
|
-
Object.defineProperty(exports, "__esModule", { value: true });
|
|
3
|
-
exports.tokenRules = void 0;
|
|
4
|
-
exports.tokenRules = [
|
|
5
|
-
{
|
|
6
|
-
name: "JWT",
|
|
7
|
-
pattern: /\beyJ[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\b/g,
|
|
8
|
-
replace: () => "<REDACTED_JWT>",
|
|
9
|
-
},
|
|
10
|
-
{
|
|
11
|
-
name: "AUTH_BEARER",
|
|
12
|
-
pattern: /\bBearer\s+[A-Za-z0-9._-]+\b/g,
|
|
13
|
-
replace: () => "Bearer <REDACTED_TOKEN>",
|
|
14
|
-
},
|
|
15
|
-
{
|
|
16
|
-
name: "EMAIL",
|
|
17
|
-
pattern: /\b[A-Z0-9._%+-]+@[A-Z0-9.-]+\.[A-Z]{2,}\b/gi,
|
|
18
|
-
replace: () => "<REDACTED_EMAIL>",
|
|
19
|
-
},
|
|
20
|
-
];
|
package/dist/cli/rules/types.js
DELETED
package/dist/cli/rules/urls.js
DELETED
package/dist/cli/summary.js
DELETED
|
@@ -1,10 +0,0 @@
|
|
|
1
|
-
export function printSummary(matches) {
|
|
2
|
-
const counter = {};
|
|
3
|
-
for (const m of matches) {
|
|
4
|
-
counter[m.rule] = (counter[m.rule] || 0) + 1;
|
|
5
|
-
}
|
|
6
|
-
process.stderr.write("LogShield Summary\n");
|
|
7
|
-
for (const [rule, count] of Object.entries(counter)) {
|
|
8
|
-
process.stderr.write(`${rule}: ${count}\n`);
|
|
9
|
-
}
|
|
10
|
-
}
|
package/dist/cli/utils/luhn.js
DELETED
|
@@ -1,19 +0,0 @@
|
|
|
1
|
-
"use strict";
|
|
2
|
-
Object.defineProperty(exports, "__esModule", { value: true });
|
|
3
|
-
exports.isValidLuhn = isValidLuhn;
|
|
4
|
-
function isValidLuhn(input) {
|
|
5
|
-
const digits = input.replace(/\D/g, "");
|
|
6
|
-
let sum = 0;
|
|
7
|
-
let alt = false;
|
|
8
|
-
for (let i = digits.length - 1; i >= 0; i--) {
|
|
9
|
-
let n = parseInt(digits[i], 10);
|
|
10
|
-
if (alt) {
|
|
11
|
-
n *= 2;
|
|
12
|
-
if (n > 9)
|
|
13
|
-
n -= 9;
|
|
14
|
-
}
|
|
15
|
-
sum += n;
|
|
16
|
-
alt = !alt;
|
|
17
|
-
}
|
|
18
|
-
return sum % 10 === 0;
|
|
19
|
-
}
|