CalvinBackup/gstack
1
0
Fork 0
mirror of https://github.com/garrytan/gstack.git synced 2026-09-16 18:05:31 +02:00
Code Issues Packages Projects Releases Wiki Activity

fix(redact): calibrate placeholder recognition for code and doc shapes

Browse Source 
Three pushed-secret false positives blocked this branch's push; each is
now recognized as a placeholder in the url_with_password/basic_auth_url
validators, with real passwords still blocking (all pinned):

- ${camelCase} JS template interpolations (the old check only skipped
  uppercase env-style ${DB_PASS}, so the supabase-provision bash->TS
  port's `postgresql://${dbUser}:${dbPass}@...` flagged as two
  pushed secrets).
- The literal PASSWORD/pass placeholder in URL-format doc comments.
- The provision lib's doc comments now use <PASSWORD>/PASSWORD forms.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
This commit is contained in:
Garry Tan
2026-08-15 10:34:07 -07:00
co-authored by Claude Fable 5
parent 1749ac8cc8
commit 10a0f130c7
3 changed files with 21 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files
lib/redact-patterns.ts
+9 -2
View File
@@ -189,6 +189,7 @@ const PLACEHOLDER_STRUCTURAL = [
// keys like AKIAIOSFODNN7EXAMPLE are bare tokens, so the guard still catches them.
const PLACEHOLDER_SUBSTRING = [
/example/i, // AKIAIOSFODNN7EXAMPLE etc — AWS docs convention
/^pass(word)?$/i, // literal PASSWORD/pass in URL-format doc comments
/^changeme$/i,
/^redacted/i,
/^placeholder/i,
@@ -440,7 +441,10 @@ export const PATTERNS: RedactPattern[] = [
validate: (span) => {
const m = span.match(/:\/\/[^:]+:([^@]+)@/);
const pw = m?.[1] ?? "";
return !isPlaceholderSpan(pw) && pw !== "" && !/^\$\{?[A-Z_]+\}?$/.test(pw);
// Any $VAR / ${identifier} interpolation is code, not a credential —
// covers bash ${DB_PASS} and JS template `${dbPass}` alike (the
// uppercase-only form flagged ported TS templates as pushed secrets).
return !isPlaceholderSpan(pw) && pw !== "" && !/^\$\{?[A-Za-z_][A-Za-z0-9_]*\}?$/.test(pw);
},
},
{
@@ -452,7 +456,10 @@ export const PATTERNS: RedactPattern[] = [
validate: (span) => {
const m = span.match(/:\/\/[^:]+:([^@]+)@/);
const pw = m?.[1] ?? "";
return !isPlaceholderSpan(pw) && pw !== "" && !/^\$\{?[A-Z_]+\}?$/.test(pw);
// Any $VAR / ${identifier} interpolation is code, not a credential —
// covers bash ${DB_PASS} and JS template `${dbPass}` alike (the
// uppercase-only form flagged ported TS templates as pushed secrets).
return !isPlaceholderSpan(pw) && pw !== "" && !/^\$\{?[A-Za-z_][A-Za-z0-9_]*\}?$/.test(pw);
},
},