CalvinBackup/gstack
1
0
Fork 0
mirror of https://github.com/garrytan/gstack.git synced 2026-09-11 23:49:01 +02:00
Code Issues Packages Projects Releases Wiki Activity

test: pin the security-property regression guards from pre-landing review

Browse Source 
The pre-landing review found the fixes were correct but three regression guards
were missing — each pins a property whose silent revert would keep behavior
identical while reopening the hole:
- validateAuth: a static tripwire asserting crypto.timingSafeEqual + the
  got.length===want.length gate + the null-header guard (a revert to `===`
  keeps accept/reject green but restores the timing side-channel).
- redact: a table-driven loop over the exported URL_PASSWORD_PLACEHOLDER_WORDS
  so a typo or dropped entry can't silently start blocking a doc placeholder;
  plus a substring-can't-rescue-a-real-secret assertion.
- config: assert the self-contained .gitignore is written even when git already
  ignores .gstack/, proving the write precedes the isIgnoredByGit early return.
- bun-polyfill: cover the 128+signal exit branch (POSIX only).

URL_PASSWORD_PLACEHOLDER_WORDS is exported so the table test can't drift.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
This commit is contained in:
Garry Tan
2026-08-16 11:07:55 -07:00
co-authored by Claude Fable 5
parent 341d7be27c
commit 5d74ed7231
5 changed files with 67 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
lib/redact-patterns.ts
+1 -1
View File
@@ -276,7 +276,7 @@ const INTERPOLATED_PASSWORD_RE = /^(\$\{.+\}|\$[A-Z_][A-Z0-9_]*)$/;
// case-sensitively against the raw span: the convention is ALL CAPS, and a
// lowercase `password`/`pass` at this position is a real (terrible) credential
// that must still block.
const URL_PASSWORD_PLACEHOLDER_WORDS = new Set([
export const URL_PASSWORD_PLACEHOLDER_WORDS = new Set([
"PASSWORD",
"PASS",
"PASSWD",