mirror of
https://github.com/luongnv89/claude-howto.git
synced 2026-05-27 22:22:36 +02:00
Luong NGUYEN
2cbb10c959
* fix(hooks): make hook scripts compatible with Windows Git Bash and use stdin JSON protocol - Replace `grep -P` (Perl regex) with `sed` for JSON field extraction, as Windows Git Bash does not support `grep -P` - Replace positional arg (`$1`) with stdin JSON parsing to match the actual Claude Code hook protocol (hooks receive data via stdin, not args) - Fix JSON double-quote escaping in grep patterns that silently fails on Windows Git Bash - Remove python3 dependency for JSON parsing, making scripts portable - Add Windows Git Bash to compatibility notes in script headers Affected scripts: security-scan.sh, validate-prompt.sh, log-bash.sh, format-code.sh Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> * fix(hooks): address review issues in Windows Git Bash compatibility scripts - security-scan.sh: wrap output in hookSpecificOutput format required by PostToolUse protocol; restore secret/token detection pattern that was dropped; escape file path and issues for safe JSON construction - validate-prompt.sh: extract "user_prompt" field first (Claude Code UserPromptSubmit protocol), falling back to "prompt" - log-bash.sh: document sed truncation limitation for commands with double-quoted strings - format-code.sh: fix misleading comment about updatedInput output * fix(hooks): produce valid JSON from security-scan.sh - Use \\n (JSON newline escape) when building ISSUES, not real newlines, so the value passes safely through printf into the JSON string - Remove the real-newline-to-\\n sed pass (no longer needed) - Output is now verifiably valid JSON per python3 json.loads * fix(hooks): fix grep -E POSIX compat and semgrep/trufflehog stdout mixing - Replace \s with [[:space:]] in grep -E patterns (security-scan.sh lines 34,44): \s is a Perl extension, silently fails on macOS BSD grep and BusyBox — password/secret detection was a no-op on macOS - Suppress stdout of semgrep/trufflehog (>/dev/null) to prevent their output mixing with hookSpecificOutput JSON, which would produce invalid JSON and cause the additionalContext to fail parsing - Fix format-code.sh hook comment: PreToolUse → PostToolUse (matches README example and actual hook behavior) --------- Co-authored-by: Bruce <binyuli1993@foxmail.com> Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>
79 lines
3.2 KiB
Bash
79 lines
3.2 KiB
Bash
#!/bin/bash
|
|
# Security scan on file write
|
|
# Hook: PostToolUse:Write
|
|
#
|
|
# Scans files for hardcoded secrets, API keys, and credentials.
|
|
# Outputs a non-blocking warning via additionalContext when issues are found.
|
|
#
|
|
# Compatible with: macOS, Linux, Windows (Git Bash)
|
|
|
|
# Read JSON input from stdin (Claude Code hook protocol)
|
|
INPUT=$(cat)
|
|
|
|
# Extract file_path using sed (compatible with all platforms including Windows Git Bash)
|
|
# Avoids grep -P (not available on Windows Git Bash) and python3 dependency
|
|
FILE_PATH=$(echo "$INPUT" | sed -n 's/.*"file_path"[[:space:]]*:[[:space:]]*"\([^"]*\)".*/\1/p' | head -1)
|
|
|
|
if [ -z "$FILE_PATH" ] || [ ! -f "$FILE_PATH" ]; then
|
|
exit 0
|
|
fi
|
|
|
|
# Skip binary files, vendor dirs, and build artifacts
|
|
case "$FILE_PATH" in
|
|
*.png|*.jpg|*.jpeg|*.gif|*.svg|*.ico|*.woff|*.woff2|*.ttf|*.eot) exit 0 ;;
|
|
*/node_modules/*|*/.git/*|*/dist/*|*/build/*) exit 0 ;;
|
|
esac
|
|
|
|
ISSUES=""
|
|
|
|
# Check for hardcoded passwords
|
|
# Handles both JSON format ("password": "value") and code format (password = 'value')
|
|
# Use \\n as separator — it is a valid JSON newline escape and passes through printf safely
|
|
if grep -qiE '"password"[[:space:]]*:[[:space:]]*"[^"]+"' "$FILE_PATH" 2>/dev/null; then
|
|
ISSUES="${ISSUES}- WARNING: Potential hardcoded password detected\\n"
|
|
elif grep -qiE '(password|passwd|pwd)[[:space:]]*=[[:space:]]*'"'"'[^'"'"']+'"'"'' "$FILE_PATH" 2>/dev/null; then
|
|
ISSUES="${ISSUES}- WARNING: Potential hardcoded password detected\\n"
|
|
fi
|
|
|
|
# Check for hardcoded API keys
|
|
if grep -qiE '"(api[_-]?key|apikey|access[_-]?token)"[[:space:]]*:[[:space:]]*"[^"]+"' "$FILE_PATH" 2>/dev/null; then
|
|
ISSUES="${ISSUES}- WARNING: Potential hardcoded API key detected\\n"
|
|
fi
|
|
|
|
# Check for hardcoded secrets and tokens
|
|
if grep -qiE '(secret|token)[[:space:]]*=[[:space:]]*['"'"'"][^'"'"'"]+['"'"'"]' "$FILE_PATH" 2>/dev/null; then
|
|
ISSUES="${ISSUES}- WARNING: Potential hardcoded secret or token detected\\n"
|
|
fi
|
|
|
|
# Check for private keys
|
|
if grep -q "BEGIN.*PRIVATE KEY" "$FILE_PATH" 2>/dev/null; then
|
|
ISSUES="${ISSUES}- WARNING: Private key detected\\n"
|
|
fi
|
|
|
|
# Check for AWS keys
|
|
if grep -qE "AKIA[0-9A-Z]{16}" "$FILE_PATH" 2>/dev/null; then
|
|
ISSUES="${ISSUES}- WARNING: AWS access key detected\\n"
|
|
fi
|
|
|
|
# Scan with semgrep if available (stdout suppressed to avoid mixing with JSON output)
|
|
if command -v semgrep &> /dev/null; then
|
|
semgrep --config=auto "$FILE_PATH" --quiet >/dev/null 2>/dev/null
|
|
fi
|
|
|
|
# Scan with trufflehog if available (stdout suppressed to avoid mixing with JSON output)
|
|
if command -v trufflehog &> /dev/null; then
|
|
trufflehog filesystem "$FILE_PATH" --only-verified --quiet >/dev/null 2>/dev/null
|
|
fi
|
|
|
|
# If issues found, output as additionalContext (non-blocking warning)
|
|
# Use hookSpecificOutput format required by Claude Code PostToolUse protocol
|
|
if [ -n "$ISSUES" ]; then
|
|
# Escape file path for JSON (backslash and double-quote)
|
|
# ISSUES already uses \\n as separator (valid JSON escape) — only escape double-quotes
|
|
SAFE_PATH=$(printf '%s' "$FILE_PATH" | sed 's/\\/\\\\/g; s/"/\\"/g')
|
|
SAFE_ISSUES=$(printf '%s' "$ISSUES" | sed 's/"/\\"/g')
|
|
printf '{"hookSpecificOutput": {"hookEventName": "PostToolUse", "additionalContext": "Security scan found issues in %s:\\n%sPlease review and use environment variables instead."}}' "$SAFE_PATH" "$SAFE_ISSUES"
|
|
fi
|
|
|
|
exit 0
|