logshield-cli 0.6.0 → 0.7.0

package/CHANGELOG.md

@@ -1,5 +1,28 @@
 # Changelog
 
+## v0.7.0
+
+### Security
+
+- Added a per-line safety cap (`64KB`) alongside the existing `200KB` total input cap
+- Overlong single-line input now fails with a deterministic bounded error instead of flowing into rule evaluation
+- Hardened the strict-mode credit card detector to reduce ambiguous separator-heavy matching on pathological near-miss input
+
+### Improved
+
+- Added adversarial regression coverage for line-length boundaries, multiline line reporting, and regex near-miss cases
+- Added bounded-failure contract coverage for CLI and detection-only code paths
+
+### Docs
+
+- Synced README limits documentation with the final bounded input behavior and error contract
+
+### Notes
+
+- No new CLI flags
+- No breaking changes to normal successful scan output
+- Input/usage bounded failures continue to exit with code `2`
+
 ## v0.6.0
 
 ### Added

package/README.md

@@ -201,6 +201,7 @@ Note: the npm package ships the CLI only; there is no supported JS API surface.
 ### Limits
 
 - Maximum input size: **200KB** (safety cap). Oversized input exits with code `2`.
+- Maximum line length: **64KB** per line. If any single line exceeds the cap, LogShield exits with code `2` and a deterministic `Log line <n> exceeds 64KB limit` error.
 
 
 ### Windows note

package/dist/cli/index.cjs

@@ -140,15 +140,23 @@ var init_applyRules = __esm({
 // src/engine/guard.ts
 function guardInput(input) {
   if (!input) return "";
-  if (input.length > MAX_SIZE) {
+  if (input.length > MAX_INPUT_SIZE) {
     throw new Error("Log size exceeds 200KB limit");
   }
+  const lines = input.split(/\r?\n/);
+  for (let i = 0; i < lines.length; i += 1) {
+    if (lines[i].length > MAX_LINE_LENGTH) {
+      const lineNumber = i + 1;
+      throw new Error(`Log line ${lineNumber} exceeds 64KB limit`);
+    }
+  }
   return input;
 }
-var MAX_SIZE;
+var MAX_INPUT_SIZE, MAX_LINE_LENGTH;
 var init_guard = __esm({
   "src/engine/guard.ts"() {
-    MAX_SIZE = 200 * 1024;
+    MAX_INPUT_SIZE = 200 * 1024;
+    MAX_LINE_LENGTH = 64 * 1024;
   }
 });
 
@@ -387,7 +395,9 @@ var init_creditCard = __esm({
     creditCardRules = [
       {
         name: "CREDIT_CARD",
-        pattern: /\b(?:\d[ -]*?){13,19}\b/g,
+        // Keep separators simple and bounded between digits to avoid ambiguous
+        // repetition on long near-miss inputs.
+        pattern: /\b\d(?:[ -]?\d){12,18}\b/g,
         replace: (match, { strict }) => {
           if (!strict) return match;
           return isValidLuhn(match) ? "<REDACTED_CC>" : match;
@@ -595,7 +605,7 @@ var ALLOWED_FLAGS = /* @__PURE__ */ new Set([
   "--help"
 ]);
 function getVersion() {
-  return true ? "0.6.0" : "unknown";
+  return true ? "0.7.0" : "unknown";
 }
 function printHelp() {
   process.stdout.write(`Usage: logshield scan [file]

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "logshield-cli",
-  "version": "0.6.0",
+  "version": "0.7.0",
   "license": "Apache-2.0",
   "type": "commonjs",
   "bin": {