CalvinBackup/gstack
1
0
Fork 0
mirror of https://github.com/garrytan/gstack.git synced 2026-09-14 17:05:28 +02:00
Code Issues Packages Projects Releases Wiki Activity

fix(redact): lowercase 'password'/'pass' at the URL-password position blocks

Browse Source 
The case-insensitive placeholder words waved postgres://admin:password@host
through the HIGH gate as a doc placeholder (codex adversarial,
verified zero findings pre-fix). URL-password position is now stricter
than generic placeholder detection: ALL-CAPS doc convention
(USER:PASSWORD), ${identifier} interpolations, bare $UPPER_SNAKE, and
structural shapes (<your-password>) suppress; lowercase dictionary
words block. Pinned in both directions.
This commit is contained in:
Garry Tan
2026-08-15 17:01:41 -07:00
parent 1e35386c54
commit 7e17691af4
2 changed files with 17 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
lib/redact-patterns.ts
+9 -1
View File
@@ -267,7 +267,15 @@ const INTERPOLATED_PASSWORD_RE = /^(\$\{[A-Za-z_][A-Za-z0-9_]*\}|\$[A-Z_][A-Z0-9
function urlPasswordIsPlaceholder(span: string): boolean {
const m = span.match(/:\/\/[^:]+:([^@]+)@/);
const pw = m?.[1] ?? "";
return pw === "" || isPlaceholderSpan(pw) || INTERPOLATED_PASSWORD_RE.test(pw);
if (pw === "") return true;
if (INTERPOLATED_PASSWORD_RE.test(pw)) return true;
// URL-password position is STRICTER than generic placeholder detection.
// Doc-comment convention writes placeholders in ALL CAPS
// (postgres://USER:PASSWORD@host); a lowercase `password` or `pass` at
// this position is a real (terrible) credential and must block — the
// case-insensitive isPlaceholderSpan words would wave it through.
if (/^[A-Z][A-Z0-9_]*$/.test(pw)) return true;
return PLACEHOLDER_STRUCTURAL.some((re) => re.test(pw));
}
export const PATTERNS: RedactPattern[] = [