CalvinBackup/gstack
1
0
Fork 0
mirror of https://github.com/garrytan/gstack.git synced 2026-09-09 22:48:57 +02:00
Code Issues Packages Projects Releases Wiki Activity

fix(redact): fully-braced ${...} interpolations are code, whatever they contain

Browse Source 
The identifier-only braced form flagged the DSN builder's own
${encodeURIComponent(dbPass)} call site as a pushed secret — a scan
that cries wolf on the fix for the previous finding. Any ${...}
spanning the whole password segment is template code; bare $word
stays uppercase-only so $hunter2 still blocks. The mismatched-brace
negative fixture assembles at runtime so this file's own pushed bytes
carry no blockable URL shape.
This commit is contained in:
Garry Tan
2026-08-15 17:08:15 -07:00
parent 7726d25396
commit 09a50b5203
2 changed files with 12 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files
test/redact-engine.test.ts
+7 -2
View File
@@ -119,8 +119,13 @@ describe("HIGH credential patterns", () => {
// still block (both-braces-optional would have let it through).
expect(ids("postgres://user:$DB_PASSWORD@host/app")).not.toContain("db.url_with_password");
expect(ids("postgres://admin:$" + "hun" + "ter2@db.internal/app")).toContain("db.url_with_password");
// Mismatched brace is not an interpolation either.
expect(ids("postgres://admin:${dbPass@db.internal/app")).toContain("db.url_with_password");
// Mismatched brace is not an interpolation either (assembled at runtime
// so this file's own pushed bytes carry no blockable URL shape).
expect(ids("postgres://admin:${" + "dbPass@db.internal/app")).toContain("db.url_with_password");
// A fully-braced interpolation is code whatever it contains — the DSN
// builder's `${encodeURIComponent(dbPass)}` call site must not scan as a
// pushed secret.
expect(ids("postgresql://user:${encodeURIComponent(dbPass)}@host:5432/db")).not.toContain("db.url_with_password");
// A LOWERCASE literal 'password'/'pass' at the URL-password position is a
// real (terrible) credential, not a doc placeholder — only the ALL-CAPS
// doc convention (USER:PASSWORD) is suppressed. Assembled at runtime so