CalvinBackup/gstack
1
0
Fork 0
mirror of https://github.com/garrytan/gstack.git synced 2026-09-11 07:29:00 +02:00
Code Issues Packages Projects Releases Wiki Activity

fix(redact): calibrate placeholder recognition for code and doc shapes

Browse Source 
Three pushed-secret false positives blocked this branch's push; each is
now recognized as a placeholder in the url_with_password/basic_auth_url
validators, with real passwords still blocking (all pinned):

- ${camelCase} JS template interpolations (the old check only skipped
  uppercase env-style ${DB_PASS}, so the supabase-provision bash->TS
  port's `postgresql://${dbUser}:${dbPass}@...` flagged as two
  pushed secrets).
- The literal PASSWORD/pass placeholder in URL-format doc comments.
- The provision lib's doc comments now use <PASSWORD>/PASSWORD forms.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
This commit is contained in:
Garry Tan
2026-08-15 10:34:07 -07:00
co-authored by Claude Fable 5
parent 1749ac8cc8
commit 10a0f130c7
3 changed files with 21 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files
test/redact-engine.test.ts
+10
View File
@@ -104,6 +104,16 @@ describe("HIGH credential patterns", () => {
test("db.url_with_password flags real password, skips placeholder/env-var", () => {
expect(ids("postgres://user:s3cretP@ss@db.example.com/app")).toContain("db.url_with_password");
expect(ids("postgres://user:${DB_PASSWORD}@host/app")).not.toContain("db.url_with_password");
// Literal PASSWORD placeholder (URL-format doc comments).
expect(ids("postgresql://USER:PASSWORD@host/db")).not.toContain("db.url_with_password");
// JS template interpolations are code, not credentials — the
// uppercase-only placeholder form blocked a push over
// `postgresql://${dbUser}:${dbPass}@...` in a bash->TS port.
// eslint-disable-next-line no-template-curly-in-string
expect(ids("postgresql://${dbUser}:${dbPass}@${dbHost}:5432/db")).not.toContain("db.url_with_password");
// Assembled at runtime so this file's own diff never contains a
// credential-shaped literal (the prepush guard scans exact pushed bytes).
expect(ids("postgres://admin:" + "hun" + "ter2@db.internal/app")).toContain("db.url_with_password");
});
test("all HIGH patterns block (exit 3)", () => {