CalvinBackup/gstack
1
0
Fork 0
mirror of https://github.com/garrytan/gstack.git synced 2026-09-11 07:29:00 +02:00
Code Issues Packages Projects Releases Wiki Activity

fix(redact): scan large diffs in line-aligned slices; stop digit-UUIDs matching as cards/phones

Browse Source 
The prepush guard blocked any push whose added lines exceeded the engine's
1 MiB cap with engine.input_too_large — a size error naming no credential —
which trains people onto GSTACK_REDACT_PREPUSH=skip. Scan in 768 KiB
line-aligned slices instead (no pattern is multi-line, so a boundary cannot
bisect a secret); a single oversized line still goes to the engine intact and
fails closed. Also suppress card/phone matches whose span sits ENTIRELY
inside a UUID — digit-only UUID fixtures were 14 of 21 MEDIUM findings on an
ordinary branch, the noise level that stops people reading MEDIUM at all.

Fixes #2304.

Contributed by @luckywenapere (PR #2543).

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
This commit is contained in:
Garry Tan
2026-08-14 20:20:49 -07:00
co-authored by Claude Fable 5
parent 3fa7739689
commit d410142c2f
3 changed files with 141 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files
test/redact-engine.test.ts
+28
View File
@@ -201,6 +201,34 @@ describe("PII patterns", () => {
expect(ids("local 192.168.1.5")).not.toContain("pii.ip_public");
expect(ids("local 10.0.0.1")).not.toContain("pii.ip_public");
});
// Digit-only UUIDs are the standard test-fixture shape, and their digit runs
// collide with both the card pattern (a 13-19 digit slice passes Luhn often
// enough to matter) and the phone pattern (hyphen groups read as national
// formatting). Observed live: 14 of 21 MEDIUM findings on one ordinary branch
// were exactly this, all from test files — the volume that makes people stop
// reading MEDIUM output at all.
test("digit-only UUID fixtures are not cards or phones", () => {
expect(ids("owner_user_id: '00000000-0000-0000-0000-000000000000'")).not.toContain("pii.cc");
expect(ids("const OWNER = '11111111-1111-1111-1111-111111111111'")).not.toContain(
"pii.phone.e164",
);
expect(ids("const TEAM = '22222222-2222-2222-2222-222222222222'")).not.toContain(
"pii.phone.e164",
);
// Hex UUIDs never matched these digit patterns; pinned so the suppression
// is not silently widened to something that swallows real numbers.
expect(ids("id 'a1b2c3d4-1111-2222-3333-444455556666'")).not.toContain("pii.cc");
});
test("UUID suppression requires TOTAL containment", () => {
// Real card sitting next to a UUID still reports — suppression is the
// exception and may only fire when the whole match is UUID interior.
expect(ids("00000000-0000-0000-0000-000000000000 4111111111111111")).toContain("pii.cc");
// And the plain cases are untouched.
expect(ids("card 4111-1111-1111-1111")).toContain("pii.cc");
expect(ids("reach me on +1 415 555 2671")).toContain("pii.phone.e164");
});
});
describe("internal + legal patterns", () => {