diff --git a/lib/redact-patterns.ts b/lib/redact-patterns.ts index 92b9fe78e..127b4de0e 100644 --- a/lib/redact-patterns.ts +++ b/lib/redact-patterns.ts @@ -253,6 +253,73 @@ export function looksLikeParcelId(span: string, match: RegExpExecArray): boolean return false; } +/** + * Vector geometry reads as a phone number to pii.phone.e164 (#2885, #2827). + * The pattern accepts `.` as a group separator, so a single float + * (`viewBox="0 0 581.66796875 695.65625"`) parses as 581 · 6679 · 6875, and a + * run of path coordinates (`37.6188 101.694`, `100 64.5326 100`) as four + * spaced groups. One rendered /diagram SVG carried 18 of these; a Figma icon + * carries dozens per path. + * + * Phone conventions put a separator between EVERY group, so a token with + * digits, one dot and digits is a decimal number, never a dotted phone + * (415.555.0123 has two dots in one token and stays flagged). Exempt a span + * whose space-separated tokens include at least one decimal and none with two + * dots. A leading `+` is the E.164 marker, so a span starting with it is a + * phone context and never exempt. + */ +export function looksLikeDecimalCoordinates(span: string): boolean { + if (span.startsWith("+")) return false; + const tokens = span.split(" "); + if (tokens.some((t) => t.split(".").length > 2)) return false; + return tokens.some((t) => /^\d+\.\d+$/.test(t)); +} + +/** Span start/end in `match.input`, derived exactly as redact-engine.ts does. */ +function spanBounds(match: RegExpExecArray): { start: number; end: number } { + const spanStartInMatch = match[1] !== undefined ? match[0].indexOf(match[1]) : 0; + const start = match.index + Math.max(0, spanStartInMatch); + return { start, end: start + (match[1] ?? match[0]).length }; +} + +/** + * True when a digit span is one side of a decimal number: `.` sits + * immediately before it or `.` immediately after. pii.cc's `\b` stops + * at the dot, so the 14-digit fraction of `492.34399999999994` in an + * .excalidraw scene is a Luhn candidate, and a random digit run passes Luhn + * about one time in ten (#2827). A card number in prose is never glued to a + * decimal point; a sentence-ending period has no digit after it and stays + * flagged. + */ +export function insideDecimalNumber(match: RegExpExecArray): boolean { + const input = match.input ?? ""; + const { start, end } = spanBounds(match); + const digit = (i: number) => i >= 0 && i < input.length && input[i] >= "0" && input[i] <= "9"; + return (input[start - 1] === "." && digit(start - 2)) || (input[end] === "." && digit(end + 1)); +} + +/** + * JSON keys whose unquoted integer value is a random seed, nonce or epoch + * timestamp. Excalidraw writes three per element (`"seed":1808177121`, + * `"versionNonce":1365644783`, `"updated":1791059590857`), and pii.phone.e164 + * reads each as a bare 10-13 digit number: 92 per /diagram scene (#2827). + */ +const NUMERIC_METADATA_KEY = + /"[A-Za-z0-9_]*(?:seed|nonce|updated|created|timestamp)(?:at|_at|ms|_ms)?"[ \t]*:[ \t]*$/i; + +/** + * True when a digit-only span is the unquoted JSON value of a seed, nonce or + * timestamp key. The evidence is the key, not the digits: the same number + * under `"phone":` still reports. + */ +export function isNumericMetadataValue(span: string, match: RegExpExecArray): boolean { + if (!/^\d+$/.test(span)) return false; + const input = match.input ?? ""; + const { start } = spanBounds(match); + const lineStart = input.lastIndexOf("\n", start - 1) + 1; + return NUMERIC_METADATA_KEY.test(input.slice(Math.max(lineStart, start - 80), start)); +} + // ── Placeholder suppression (per-matched-span, NOT per-line) ───────────────── /** @@ -738,12 +805,16 @@ export const PATTERNS: RedactPattern[] = [ autoRedactable: true, redactToken: "", // A digit-only UUID's hyphen groups read as national phone formatting, and - // so does a county tax-map parcel ID (see looksLikeParcelId). + // so do a county tax-map parcel ID (see looksLikeParcelId), vector + // coordinates (looksLikeDecimalCoordinates) and seed/nonce/timestamp JSON + // values (isNumericMetadataValue). validate: (span, match) => !insideUuid(match) && span.replace(/\D/g, "").length >= 10 && !looksLikeCompactTimestamp(span) && - !looksLikeParcelId(span, match), + !looksLikeParcelId(span, match) && + !looksLikeDecimalCoordinates(span) && + !isNumericMetadataValue(span, match), }, { id: "pii.ssn", @@ -767,9 +838,9 @@ export const PATTERNS: RedactPattern[] = [ regex: /\b((?:\d[ \-]?){13,19})\b/, autoRedactable: true, redactToken: "", - // A 13-19 digit slice of a digit-only UUID passes Luhn often enough to - // matter; the enclosing-UUID check runs first so it never reaches Luhn. - validate: (span, match) => !insideUuid(match) && luhnValid(span), + // A 13-19 digit slice of a digit-only UUID or of a decimal number passes + // Luhn often enough to matter; both context checks run before Luhn. + validate: (span, match) => !insideUuid(match) && !insideDecimalNumber(match) && luhnValid(span), }, { id: "pii.ip_public", diff --git a/test/fixtures/redact-diagram/flow.excalidraw b/test/fixtures/redact-diagram/flow.excalidraw new file mode 100644 index 000000000..61556526f --- /dev/null +++ b/test/fixtures/redact-diagram/flow.excalidraw @@ -0,0 +1 @@ +{"type":"excalidraw","version":2,"source":"gstack-diagram-render","elements":[{"id":"FBmcfSimwEXPzs4bhpTjb","type":"rectangle","x":250.9140625,"y":8,"width":200.109375,"height":60,"angle":0,"strokeColor":"#1e1e1e","backgroundColor":"transparent","fillStyle":"solid","strokeWidth":2,"strokeStyle":"solid","roughness":1,"opacity":100,"groupIds":[],"frameId":null,"index":"a0","roundness":null,"seed":1808177121,"version":3,"versionNonce":1365644783,"isDeleted":false,"boundElements":[{"type":"text","id":"Lk54Qp2D8qFO6X1AMxkXn"},{"id":"RZLjDS-aGR6M6Iha_fygU","type":"arrow"}],"updated":1791059590857,"link":null,"locked":false},{"id":"MgBMziDzzZsUR_ubuPqT3","type":"diamond","x":252.53125,"y":118,"width":197.875,"height":197.875,"angle":0,"strokeColor":"#1e1e1e","backgroundColor":"transparent","fillStyle":"solid","strokeWidth":2,"strokeStyle":"solid","roughness":1,"opacity":100,"groupIds":[],"frameId":null,"index":"a1","roundness":null,"seed":192418479,"version":7,"versionNonce":1049487471,"isDeleted":false,"boundElements":[{"type":"text","id":"DfnkKci8j5sTfUPTqNM_V"},{"id":"RZLjDS-aGR6M6Iha_fygU","type":"arrow"},{"id":"QXtppr3wxF8aWGavgvHCg","type":"arrow"},{"id":"QkuvMiAt5owwKfVGV76Xe","type":"arrow"},{"id":"LwAd4VAY-m3kpx0mf8IZQ","type":"arrow"},{"id":"Xolrx0c730eIssJQTIHut","type":"arrow"}],"updated":1791059590859,"link":null,"locked":false},{"id":"GLaB0IIg5dTU6wbqLh57a","type":"rectangle","x":34.6796875,"y":395.875,"width":157.84375,"height":60,"angle":0,"strokeColor":"#1e1e1e","backgroundColor":"transparent","fillStyle":"solid","strokeWidth":2,"strokeStyle":"solid","roughness":1,"opacity":100,"groupIds":[],"frameId":null,"index":"a2","roundness":null,"seed":365622209,"version":4,"versionNonce":1018495631,"isDeleted":false,"boundElements":[{"type":"text","id":"gqq0ycD8jE4DlXZeLikWp"},{"id":"QXtppr3wxF8aWGavgvHCg","type":"arrow"},{"id":"XUcATSTOjMVv5YvlIR8XP","type":"arrow"}],"updated":1791059590859,"link":null,"locked":false},{"id":"oWWs0W96aNRHAgR5oWl8u","type":"rectangle","x":287.359375,"y":395.875,"width":107.046875,"height":60,"angle":0,"strokeColor":"#1e1e1e","backgroundColor":"transparent","fillStyle":"solid","strokeWidth":2,"strokeStyle":"solid","roughness":1,"opacity":100,"groupIds":[],"frameId":null,"index":"a3","roundness":null,"seed":929031375,"version":4,"versionNonce":1091537231,"isDeleted":false,"boundElements":[{"type":"text","id":"Xgc-Z9fR_xJzSZi552hrg"},{"id":"QkuvMiAt5owwKfVGV76Xe","type":"arrow"},{"id":"m0batfkyDXiNEcdJd9Z-4","type":"arrow"}],"updated":1791059590859,"link":null,"locked":false},{"id":"302jWUU1dMxH1SbQS0qE1","type":"rectangle","x":459.2265625,"y":759.234375,"width":193.421875,"height":60,"angle":0,"strokeColor":"#1e1e1e","backgroundColor":"transparent","fillStyle":"solid","strokeWidth":2,"strokeStyle":"solid","roughness":1,"opacity":100,"groupIds":[],"frameId":null,"index":"a4","roundness":null,"seed":1519965089,"version":4,"versionNonce":1686432207,"isDeleted":false,"boundElements":[{"type":"text","id":"uP6KE-R9_gMd_Z2R1Prra"},{"id":"LwAd4VAY-m3kpx0mf8IZQ","type":"arrow"},{"id":"pRAl45BZ1BxcuUmJ9HD9b","type":"arrow"}],"updated":1791059590859,"link":null,"locked":false},{"id":"dF2UjK6ZPpz78dWKN5evK","type":"diamond","x":269.703125,"y":535.875,"width":143.359375,"height":143.359375,"angle":0,"strokeColor":"#1e1e1e","backgroundColor":"transparent","fillStyle":"solid","strokeWidth":2,"strokeStyle":"solid","roughness":1,"opacity":100,"groupIds":[],"frameId":null,"index":"a5","roundness":null,"seed":1455977199,"version":5,"versionNonce":1134690831,"isDeleted":false,"boundElements":[{"type":"text","id":"RXs9Ti_5xCHis2KHx4duA"},{"id":"m0batfkyDXiNEcdJd9Z-4","type":"arrow"},{"id":"pRAl45BZ1BxcuUmJ9HD9b","type":"arrow"},{"id":"blZCFHehmGZ-PV5jiIJ5p","type":"arrow"}],"updated":1791059590859,"link":null,"locked":false},{"id":"gnjCVoiODEbhYmxyLsgeZ","type":"rectangle","x":174.15625,"y":759.234375,"width":126.34375,"height":60,"angle":0,"strokeColor":"#1e1e1e","backgroundColor":"transparent","fillStyle":"solid","strokeWidth":2,"strokeStyle":"solid","roughness":1,"opacity":100,"groupIds":[],"frameId":null,"index":"a6","roundness":null,"seed":778024833,"version":5,"versionNonce":785037551,"isDeleted":false,"boundElements":[{"type":"text","id":"VAHHwE9eJhL_zD4TcnCdz"},{"id":"blZCFHehmGZ-PV5jiIJ5p","type":"arrow"},{"id":"Xolrx0c730eIssJQTIHut","type":"arrow"},{"id":"Xqf-Ryhsfa4wicqw8j_Y5","type":"arrow"}],"updated":1791059590860,"link":null,"locked":false},{"id":"qYkvsRVNy2LSpOyxA5FwA","type":"rectangle","x":8,"y":577.5546875,"width":211.203125,"height":60,"angle":0,"strokeColor":"#1e1e1e","backgroundColor":"transparent","fillStyle":"solid","strokeWidth":2,"strokeStyle":"solid","roughness":1,"opacity":100,"groupIds":[],"frameId":null,"index":"a7","roundness":null,"seed":842677519,"version":4,"versionNonce":1135798991,"isDeleted":false,"boundElements":[{"type":"text","id":"PUslv2xht6rBVOKD0qYiZ"},{"id":"XUcATSTOjMVv5YvlIR8XP","type":"arrow"},{"id":"Xqf-Ryhsfa4wicqw8j_Y5","type":"arrow"}],"updated":1791059590859,"link":null,"locked":false},{"id":"RZLjDS-aGR6M6Iha_fygU","type":"arrow","x":350.969,"y":68,"width":0,"height":46,"angle":0,"strokeColor":"#1e1e1e","backgroundColor":"transparent","fillStyle":"solid","strokeWidth":2,"strokeStyle":"solid","roughness":1,"opacity":100,"groupIds":[],"frameId":null,"index":"a8","roundness":{"type":2},"seed":1398742881,"version":4,"versionNonce":1881261185,"isDeleted":false,"boundElements":null,"updated":1791059590857,"link":null,"locked":false,"points":[[0,0.5],[0,25],[0,45.5]],"lastCommittedPoint":null,"startBinding":{"elementId":"FBmcfSimwEXPzs4bhpTjb","focus":-0.0000024986335597435903,"gap":1},"endBinding":{"elementId":"MgBMziDzzZsUR_ubuPqT3","focus":-0.0050511686670878676,"gap":4.039322351892704},"startArrowhead":null,"endArrowhead":"arrow","elbowed":false},{"id":"QXtppr3wxF8aWGavgvHCg","type":"arrow","x":288.561,"y":253.467,"width":174.95899999999997,"height":138.408,"angle":0,"strokeColor":"#1e1e1e","backgroundColor":"transparent","fillStyle":"solid","strokeWidth":2,"strokeStyle":"solid","roughness":1,"opacity":100,"groupIds":[],"frameId":null,"index":"a9","roundness":{"type":2},"seed":1831715631,"version":4,"versionNonce":282503201,"isDeleted":false,"boundElements":[{"type":"text","id":"5Js4htRk7mzP1AQKCICD1"}],"updated":1791059590858,"link":null,"locked":false,"points":[[0,0.5],[-174.95899999999997,102.40799999999999],[-174.95899999999997,137.908]],"lastCommittedPoint":null,"startBinding":{"elementId":"MgBMziDzzZsUR_ubuPqT3","focus":0.002951591773886098,"gap":1},"endBinding":{"elementId":"GLaB0IIg5dTU6wbqLh57a","focus":0.0000055434567413702695,"gap":4},"startArrowhead":null,"endArrowhead":"arrow","elbowed":false},{"id":"QkuvMiAt5owwKfVGV76Xe","type":"arrow","x":344.273,"y":309.179,"width":3.390000000000043,"height":82.69600000000003,"angle":0,"strokeColor":"#1e1e1e","backgroundColor":"transparent","fillStyle":"solid","strokeWidth":2,"strokeStyle":"solid","roughness":1,"opacity":100,"groupIds":[],"frameId":null,"index":"aA","roundness":{"type":2},"seed":400984897,"version":4,"versionNonce":1741598657,"isDeleted":false,"boundElements":[{"type":"text","id":"uNyUkUh0TW9WyIOln5owP"}],"updated":1791059590858,"link":null,"locked":false,"points":[[0,0.5],[-3.390000000000043,46.696000000000026],[-3.390000000000043,82.19600000000003]],"lastCommittedPoint":null,"startBinding":{"elementId":"MgBMziDzzZsUR_ubuPqT3","focus":0.005046348522088459,"gap":1},"endBinding":{"elementId":"oWWs0W96aNRHAgR5oWl8u","focus":0.000003503138227555864,"gap":4},"startArrowhead":null,"endArrowhead":"arrow","elbowed":false},{"id":"LwAd4VAY-m3kpx0mf8IZQ","type":"arrow","x":403.22,"y":263.624,"width":129.20799999999997,"height":492.34399999999994,"angle":0,"strokeColor":"#1e1e1e","backgroundColor":"transparent","fillStyle":"solid","strokeWidth":2,"strokeStyle":"solid","roughness":1,"opacity":100,"groupIds":[],"frameId":null,"index":"aB","roundness":{"type":2},"seed":671843663,"version":4,"versionNonce":2091670369,"isDeleted":false,"boundElements":[{"type":"text","id":"HBXZNbW_us_3SilFvl1Ku"}],"updated":1791059590859,"link":null,"locked":false,"points":[[0.5,0.5],[103.24899999999997,92.25099999999998],[103.24899999999997,162.25099999999998],[103.24899999999997,232.25099999999998],[103.24899999999997,343.9309999999999],[103.24899999999997,455.61],[128.70799999999997,491.84399999999994]],"lastCommittedPoint":null,"startBinding":{"elementId":"MgBMziDzzZsUR_ubuPqT3","focus":0.004525597549146976,"gap":1},"endBinding":{"elementId":"302jWUU1dMxH1SbQS0qE1","focus":-0.000008344829791920963,"gap":3.266375000000039},"startArrowhead":null,"endArrowhead":"arrow","elbowed":false},{"id":"m0batfkyDXiNEcdJd9Z-4","type":"arrow","x":340.883,"y":455.875,"width":0,"height":76,"angle":0,"strokeColor":"#1e1e1e","backgroundColor":"transparent","fillStyle":"solid","strokeWidth":2,"strokeStyle":"solid","roughness":1,"opacity":100,"groupIds":[],"frameId":null,"index":"aC","roundness":{"type":2},"seed":1414888225,"version":4,"versionNonce":1082373921,"isDeleted":false,"boundElements":null,"updated":1791059590859,"link":null,"locked":false,"points":[[0,0.5],[0,40],[0,75.5]],"lastCommittedPoint":null,"startBinding":{"elementId":"oWWs0W96aNRHAgR5oWl8u","focus":-0.000003503138227555864,"gap":1},"endBinding":{"elementId":"dF2UjK6ZPpz78dWKN5evK","focus":-0.0069728610354226036,"gap":4.083210136109215},"startArrowhead":null,"endArrowhead":"arrow","elbowed":false},{"id":"pRAl45BZ1BxcuUmJ9HD9b","type":"arrow","x":388.062,"y":632.055,"width":167.87599999999998,"height":123.17900000000009,"angle":0,"strokeColor":"#1e1e1e","backgroundColor":"transparent","fillStyle":"solid","strokeWidth":2,"strokeStyle":"solid","roughness":1,"opacity":100,"groupIds":[],"frameId":null,"index":"aD","roundness":{"type":2},"seed":1647051631,"version":4,"versionNonce":1061297857,"isDeleted":false,"boundElements":[{"type":"text","id":"gZonuQK2JVzn--uH9Balh"}],"updated":1791059590859,"link":null,"locked":false,"points":[[0,0.5],[167.87599999999998,87.17900000000009],[167.87599999999998,122.67900000000009]],"lastCommittedPoint":null,"startBinding":{"elementId":"dF2UjK6ZPpz78dWKN5evK","focus":0.003620750502041193,"gap":1},"endBinding":{"elementId":"302jWUU1dMxH1SbQS0qE1","focus":0.000005170046044732246,"gap":4.000374999999963},"startArrowhead":null,"endArrowhead":"arrow","elbowed":false},{"id":"blZCFHehmGZ-PV5jiIJ5p","type":"arrow","x":297.433,"y":635.784,"width":128.445,"height":120.58799999999997,"angle":0,"strokeColor":"#1e1e1e","backgroundColor":"transparent","fillStyle":"solid","strokeWidth":2,"strokeStyle":"solid","roughness":1,"opacity":100,"groupIds":[],"frameId":null,"index":"aE","roundness":{"type":2},"seed":689663745,"version":4,"versionNonce":1090660961,"isDeleted":false,"boundElements":[{"type":"text","id":"fhiU4S4Oz_eDFhhMs04hg"}],"updated":1791059590859,"link":null,"locked":false,"points":[[0.5,0.5],[-128.445,83.45000000000005],[-92.68799999999999,120.08799999999997]],"lastCommittedPoint":null,"startBinding":{"elementId":"dF2UjK6ZPpz78dWKN5evK","focus":0.004528975068900496,"gap":1},"endBinding":{"elementId":"gnjCVoiODEbhYmxyLsgeZ","focus":-0.0000034847457537809272,"gap":2.8623750000000427},"startArrowhead":null,"endArrowhead":"arrow","elbowed":false},{"id":"Xolrx0c730eIssJQTIHut","type":"arrow","x":300.5,"y":769.601,"width":162.063,"height":494.677,"angle":0,"strokeColor":"#1e1e1e","backgroundColor":"transparent","fillStyle":"solid","strokeWidth":2,"strokeStyle":"solid","roughness":1,"opacity":100,"groupIds":[],"frameId":null,"index":"aF","roundness":{"type":2},"seed":467123599,"version":4,"versionNonce":921814561,"isDeleted":false,"boundElements":null,"updated":1791059590859,"link":null,"locked":false,"points":[[-0.5,-0.5],[162.063,-50.36699999999996],[162.063,-162.04600000000005],[162.063,-273.726],[162.063,-343.726],[162.063,-413.726],[97.543,-494.177]],"lastCommittedPoint":null,"startBinding":{"elementId":"gnjCVoiODEbhYmxyLsgeZ","focus":-0.000008183393622074867,"gap":1},"endBinding":{"elementId":"MgBMziDzzZsUR_ubuPqT3","focus":0.005059953186157659,"gap":3.5784906428898093},"startArrowhead":null,"endArrowhead":"arrow","elbowed":false},{"id":"XUcATSTOjMVv5YvlIR8XP","type":"arrow","x":113.602,"y":455.875,"width":0,"height":117.67999999999995,"angle":0,"strokeColor":"#1e1e1e","backgroundColor":"transparent","fillStyle":"solid","strokeWidth":2,"strokeStyle":"solid","roughness":1,"opacity":100,"groupIds":[],"frameId":null,"index":"aG","roundness":{"type":2},"seed":2092426977,"version":4,"versionNonce":1459450337,"isDeleted":false,"boundElements":null,"updated":1791059590859,"link":null,"locked":false,"points":[[0,0.5],[0,40],[0,117.17999999999995]],"lastCommittedPoint":null,"startBinding":{"elementId":"GLaB0IIg5dTU6wbqLh57a","focus":-0.0000055434567413702695,"gap":1},"endBinding":{"elementId":"qYkvsRVNy2LSpOyxA5FwA","focus":0.00000414293112354401,"gap":3.99968750000005},"startArrowhead":null,"endArrowhead":"arrow","elbowed":false},{"id":"Xqf-Ryhsfa4wicqw8j_Y5","type":"arrow","x":136.539,"y":637.555,"width":82.436,"height":118.17100000000005,"angle":0,"strokeColor":"#1e1e1e","backgroundColor":"transparent","fillStyle":"solid","strokeWidth":2,"strokeStyle":"solid","roughness":1,"opacity":100,"groupIds":[],"frameId":null,"index":"aH","roundness":{"type":2},"seed":944190383,"version":4,"versionNonce":895561121,"isDeleted":false,"boundElements":null,"updated":1791059590860,"link":null,"locked":false,"points":[[0.5,0.5],[62.44900000000001,81.67900000000009],[81.936,117.67100000000005]],"lastCommittedPoint":null,"startBinding":{"elementId":"qYkvsRVNy2LSpOyxA5FwA","focus":-0.0000016613407085052204,"gap":1},"endBinding":{"elementId":"gnjCVoiODEbhYmxyLsgeZ","focus":-0.000003561724373496304,"gap":3.508375000000001},"startArrowhead":null,"endArrowhead":"arrow","elbowed":false},{"id":"Lk54Qp2D8qFO6X1AMxkXn","type":"text","x":290.7001953125,"y":25.5,"width":120.537109375,"height":25,"angle":0,"strokeColor":"#1e1e1e","backgroundColor":"transparent","fillStyle":"solid","strokeWidth":2,"strokeStyle":"solid","roughness":1,"opacity":100,"groupIds":[],"frameId":null,"index":"aI","roundness":null,"seed":1630335393,"version":3,"versionNonce":51171713,"isDeleted":false,"boundElements":null,"updated":1791059590860,"link":null,"locked":false,"text":"Push requested","fontSize":20,"fontFamily":5,"textAlign":"center","verticalAlign":"middle","containerId":"FBmcfSimwEXPzs4bhpTjb","originalText":"Push requested","autoResize":true,"lineHeight":1.25},{"id":"DfnkKci8j5sTfUPTqNM_V","type":"text","x":310.9580078125,"y":191.96875,"width":81.083984375,"height":50,"angle":0,"strokeColor":"#1e1e1e","backgroundColor":"transparent","fillStyle":"solid","strokeWidth":2,"strokeStyle":"solid","roughness":1,"opacity":100,"groupIds":[],"frameId":null,"index":"aJ","roundness":null,"seed":1220547969,"version":3,"versionNonce":503563023,"isDeleted":false,"boundElements":null,"updated":1791059590860,"link":null,"locked":false,"text":"Redaction\nscan","fontSize":20,"fontFamily":5,"textAlign":"center","verticalAlign":"middle","containerId":"MgBMziDzzZsUR_ubuPqT3","originalText":"Redaction scan","autoResize":true,"lineHeight":1.25},{"id":"gqq0ycD8jE4DlXZeLikWp","type":"text","x":68.3232421875,"y":413.375,"width":90.556640625,"height":25,"angle":0,"strokeColor":"#1e1e1e","backgroundColor":"transparent","fillStyle":"solid","strokeWidth":2,"strokeStyle":"solid","roughness":1,"opacity":100,"groupIds":[],"frameId":null,"index":"aK","roundness":null,"seed":1040432481,"version":3,"versionNonce":123271521,"isDeleted":false,"boundElements":null,"updated":1791059590860,"link":null,"locked":false,"text":"Block push","fontSize":20,"fontFamily":5,"textAlign":"center","verticalAlign":"middle","containerId":"GLaB0IIg5dTU6wbqLh57a","originalText":"Block push","autoResize":true,"lineHeight":1.25},{"id":"Xgc-Z9fR_xJzSZi552hrg","type":"text","x":319.4765625,"y":413.375,"width":42.8125,"height":25,"angle":0,"strokeColor":"#1e1e1e","backgroundColor":"transparent","fillStyle":"solid","strokeWidth":2,"strokeStyle":"solid","roughness":1,"opacity":100,"groupIds":[],"frameId":null,"index":"aL","roundness":null,"seed":1078421825,"version":3,"versionNonce":1909885231,"isDeleted":false,"boundElements":null,"updated":1791059590860,"link":null,"locked":false,"text":"Warn","fontSize":20,"fontFamily":5,"textAlign":"center","verticalAlign":"middle","containerId":"oWWs0W96aNRHAgR5oWl8u","originalText":"Warn","autoResize":true,"lineHeight":1.25},{"id":"uP6KE-R9_gMd_Z2R1Prra","type":"text","x":498.447265625,"y":776.734375,"width":114.98046875,"height":25,"angle":0,"strokeColor":"#1e1e1e","backgroundColor":"transparent","fillStyle":"solid","strokeWidth":2,"strokeStyle":"solid","roughness":1,"opacity":100,"groupIds":[],"frameId":null,"index":"aM","roundness":null,"seed":954898721,"version":3,"versionNonce":596976961,"isDeleted":false,"boundElements":null,"updated":1791059590860,"link":null,"locked":false,"text":"Push proceeds","fontSize":20,"fontFamily":5,"textAlign":"center","verticalAlign":"middle","containerId":"302jWUU1dMxH1SbQS0qE1","originalText":"Push proceeds","autoResize":true,"lineHeight":1.25},{"id":"RXs9Ti_5xCHis2KHx4duA","type":"text","x":310.99609375,"y":582.71484375,"width":61.09375,"height":50,"angle":0,"strokeColor":"#1e1e1e","backgroundColor":"transparent","fillStyle":"solid","strokeWidth":2,"strokeStyle":"solid","roughness":1,"opacity":100,"groupIds":[],"frameId":null,"index":"aN","roundness":null,"seed":962383105,"version":3,"versionNonce":1739295567,"isDeleted":false,"boundElements":null,"updated":1791059590860,"link":null,"locked":false,"text":"Review\ner","fontSize":20,"fontFamily":5,"textAlign":"center","verticalAlign":"middle","containerId":"dF2UjK6ZPpz78dWKN5evK","originalText":"Reviewer","autoResize":true,"lineHeight":1.25},{"id":"VAHHwE9eJhL_zD4TcnCdz","type":"text","x":203.9052734375,"y":776.734375,"width":66.845703125,"height":25,"angle":0,"strokeColor":"#1e1e1e","backgroundColor":"transparent","fillStyle":"solid","strokeWidth":2,"strokeStyle":"solid","roughness":1,"opacity":100,"groupIds":[],"frameId":null,"index":"aO","roundness":null,"seed":2031977697,"version":3,"versionNonce":1663096097,"isDeleted":false,"boundElements":null,"updated":1791059590860,"link":null,"locked":false,"text":"Edit diff","fontSize":20,"fontFamily":5,"textAlign":"center","verticalAlign":"middle","containerId":"gnjCVoiODEbhYmxyLsgeZ","originalText":"Edit diff","autoResize":true,"lineHeight":1.25},{"id":"PUslv2xht6rBVOKD0qYiZ","type":"text","x":45.5791015625,"y":595.0546875,"width":136.044921875,"height":25,"angle":0,"strokeColor":"#1e1e1e","backgroundColor":"transparent","fillStyle":"solid","strokeWidth":2,"strokeStyle":"solid","roughness":1,"opacity":100,"groupIds":[],"frameId":null,"index":"aP","roundness":null,"seed":331104449,"version":3,"versionNonce":2077968751,"isDeleted":false,"boundElements":null,"updated":1791059590860,"link":null,"locked":false,"text":"Rotate credential","fontSize":20,"fontFamily":5,"textAlign":"center","verticalAlign":"middle","containerId":"qYkvsRVNy2LSpOyxA5FwA","originalText":"Rotate credential","autoResize":true,"lineHeight":1.25},{"id":"5Js4htRk7mzP1AQKCICD1","type":"text","x":88.6068828125,"y":343.375,"width":49.990234375,"height":25,"angle":0,"strokeColor":"#1e1e1e","backgroundColor":"transparent","fillStyle":"solid","strokeWidth":2,"strokeStyle":"solid","roughness":1,"opacity":100,"groupIds":[],"frameId":null,"index":"aQ","roundness":null,"seed":190286945,"version":3,"versionNonce":963348737,"isDeleted":false,"boundElements":null,"updated":1791059590860,"link":null,"locked":false,"text":"HIGH","fontSize":20,"fontFamily":5,"textAlign":"center","verticalAlign":"middle","containerId":"QXtppr3wxF8aWGavgvHCg","originalText":"HIGH","autoResize":true,"lineHeight":1.25},{"id":"uNyUkUh0TW9WyIOln5owP","type":"text","x":299.2179609375,"y":343.375,"width":83.330078125,"height":25,"angle":0,"strokeColor":"#1e1e1e","backgroundColor":"transparent","fillStyle":"solid","strokeWidth":2,"strokeStyle":"solid","roughness":1,"opacity":100,"groupIds":[],"frameId":null,"index":"aR","roundness":null,"seed":1995373569,"version":3,"versionNonce":195969935,"isDeleted":false,"boundElements":null,"updated":1791059590860,"link":null,"locked":false,"text":"MEDIUM","fontSize":20,"fontFamily":5,"textAlign":"center","verticalAlign":"middle","containerId":"QkuvMiAt5owwKfVGV76Xe","originalText":"MEDIUM","autoResize":true,"lineHeight":1.25},{"id":"HBXZNbW_us_3SilFvl1Ku","type":"text","x":485.37525,"y":483.375,"width":42.1875,"height":25,"angle":0,"strokeColor":"#1e1e1e","backgroundColor":"transparent","fillStyle":"solid","strokeWidth":2,"strokeStyle":"solid","roughness":1,"opacity":100,"groupIds":[],"frameId":null,"index":"aS","roundness":null,"seed":751112097,"version":3,"versionNonce":2146746593,"isDeleted":false,"boundElements":null,"updated":1791059590860,"link":null,"locked":false,"text":"clean","fontSize":20,"fontFamily":5,"textAlign":"center","verticalAlign":"middle","containerId":"LwAd4VAY-m3kpx0mf8IZQ","originalText":"clean","autoResize":true,"lineHeight":1.25},{"id":"gZonuQK2JVzn--uH9Balh","type":"text","x":530.4057734375,"y":706.734,"width":51.064453125,"height":25,"angle":0,"strokeColor":"#1e1e1e","backgroundColor":"transparent","fillStyle":"solid","strokeWidth":2,"strokeStyle":"solid","roughness":1,"opacity":100,"groupIds":[],"frameId":null,"index":"aT","roundness":null,"seed":1814178561,"version":3,"versionNonce":928840111,"isDeleted":false,"boundElements":null,"updated":1791059590860,"link":null,"locked":false,"text":"accept","fontSize":20,"fontFamily":5,"textAlign":"center","verticalAlign":"middle","containerId":"pRAl45BZ1BxcuUmJ9HD9b","originalText":"accept","autoResize":true,"lineHeight":1.25},{"id":"fhiU4S4Oz_eDFhhMs04hg","type":"text","x":157.8796015625,"y":706.734,"width":22.216796875,"height":25,"angle":0,"strokeColor":"#1e1e1e","backgroundColor":"transparent","fillStyle":"solid","strokeWidth":2,"strokeStyle":"solid","roughness":1,"opacity":100,"groupIds":[],"frameId":null,"index":"aU","roundness":null,"seed":1106419361,"version":3,"versionNonce":877395137,"isDeleted":false,"boundElements":null,"updated":1791059590860,"link":null,"locked":false,"text":"fix","fontSize":20,"fontFamily":5,"textAlign":"center","verticalAlign":"middle","containerId":"blZCFHehmGZ-PV5jiIJ5p","originalText":"fix","autoResize":true,"lineHeight":1.25}],"appState":{"viewBackgroundColor":"#ffffff"},"files":{}} \ No newline at end of file diff --git a/test/fixtures/redact-diagram/flow.mmd b/test/fixtures/redact-diagram/flow.mmd new file mode 100644 index 000000000..d530d0967 --- /dev/null +++ b/test/fixtures/redact-diagram/flow.mmd @@ -0,0 +1,11 @@ +flowchart TD + A[Push requested] --> B{Redaction scan} + B -->|HIGH| C[Block push] + B -->|MEDIUM| D[Warn] + B -->|clean| E[Push proceeds] + D --> F{Reviewer} + F -->|accept| E + F -->|fix| G[Edit diff] + G --> B + C --> H[Rotate credential] + H --> G diff --git a/test/fixtures/redact-diagram/flow.svg b/test/fixtures/redact-diagram/flow.svg new file mode 100644 index 000000000..de8584015 --- /dev/null +++ b/test/fixtures/redact-diagram/flow.svg @@ -0,0 +1 @@ +HIGHMEDIUMcleanacceptfixPush requestedRedaction scanBlock pushWarnPush proceedsReviewerEdit diffRotate credential \ No newline at end of file diff --git a/test/redact-context-exemptions.test.ts b/test/redact-context-exemptions.test.ts new file mode 100644 index 000000000..d0967b735 --- /dev/null +++ b/test/redact-context-exemptions.test.ts @@ -0,0 +1,80 @@ +/** + * Redaction false positives that blocked pushes and decision logs, each paired + * with true-positive controls that must still report at the same tier. + * + * Every exemption below is decided by context, so each table carries the + * benign vector AND the same (or same-shaped) value in a sensitive context. + * A guard that passes the benign half by gutting the pattern fails the + * control half. + */ +import { describe, test, expect } from "bun:test"; +import * as fs from "node:fs"; +import * as path from "node:path"; +import { scan, type Finding } from "../lib/redact-engine"; + +const FIXTURES = path.join(import.meta.dir, "fixtures", "redact-diagram"); + +function findings(text: string): Finding[] { + return scan(text, { repoVisibility: "private" }).findings; +} +function tierOf(text: string, id: string): string | undefined { + return findings(text).find((f) => f.id === id)?.severity; +} + +function table(id: string, tier: string, benign: string[], controls: string[]): void { + for (const input of benign) { + test(`clean: ${input.slice(0, 70)}`, () => { + expect(findings(input).map((f) => f.id)).not.toContain(id); + }); + } + for (const input of controls) { + test(`still ${tier}: ${input.slice(0, 70)}`, () => { + expect(tierOf(input, id)).toBe(tier); + }); + } +} + +describe("pii.phone.e164 / pii.cc: vector geometry is not PII (#2885, #2827)", () => { + table( + "pii.phone.e164", + "MEDIUM", + [ + "M 37.6188 101.694 L 100 64.5326 100", + "M50 1C1 2 37.6188 101.694 51.6863 99.4363Z", + 'viewBox="0 0 581.66796875 695.65625"', + 'transform="translate(296.1484375, 298.796875)"', + "fill:hsl(0, 0%, 98.9215686275%)", + "v 12.3456 100.125 7.5", + '{"type":"rectangle","x":250.9140625,"y":8}', + '{"seed":1808177121,"version":3,"versionNonce":1365644783}', + '"updated": 1791059590857,', + ], + [ + "call me at +1 415 555 0123 tomorrow", + "tel: +14155550123", + "p 415.555.0123", + "tel +1 415.555.0123", + "ring +44 20 7946 0958", + "phone: (415) 555-0123", + "+37.6188 101.694", + '{"phone":1808177121}', + '"contact": 14155550123,', + "seed 1808177121", + ], + ); + + table( + "pii.cc", + "MEDIUM", + ['"height":492.34399999999994,', '"gap":3.266375000000039}', "0.4111111111111111"], + ["card 4111 1111 1111 1111", "card 4111111111111111.", "4111111111111111"], + ); + + test("a rendered /diagram triplet produces no PII findings", () => { + for (const name of ["flow.svg", "flow.excalidraw"]) { + const text = fs.readFileSync(path.join(FIXTURES, name), "utf8"); + const pii = findings(text).filter((f) => f.id === "pii.phone.e164" || f.id === "pii.cc"); + expect({ name, pii: pii.map((f) => f.id) }).toEqual({ name, pii: [] }); + } + }); +});