CalvinBackup/gstack
1
0
Fork 0
mirror of https://github.com/garrytan/gstack.git synced 2026-09-10 23:19:09 +02:00
Code Issues Packages Projects Releases Wiki Activity

fix(redact): interpolation allowance can't swallow a real $word password

Browse Source 
The placeholder calibration used optional braces on both sides, which
also suppressed bare $lowercase — a real password starting with '$'
would have passed the HIGH gate. Interpolation now means ${identifier}
(braced, any case) or bare $UPPER_SNAKE only; both connection-string
patterns share one validator so they can't drift. Pins added for the
bare-$word block, $UPPER allowance, and mismatched-brace block.
This commit is contained in:
Garry Tan
2026-08-15 16:49:39 -07:00
parent d4e1b4dc31
commit f6e3297b3d
2 changed files with 27 additions and 17 deletions
Download Patch File Download Diff File Expand all files Collapse all files
test/redact-engine.test.ts
+7
View File
@@ -114,6 +114,13 @@ describe("HIGH credential patterns", () => {
// Assembled at runtime so this file's own diff never contains a
// credential-shaped literal (the prepush guard scans exact pushed bytes).
expect(ids("postgres://admin:" + "hun" + "ter2@db.internal/app")).toContain("db.url_with_password");
// Bare $UPPER_SNAKE is shell convention → suppressed; bare $lowercase is
// NOT an interpolation form — a real password starting with `$` must
// still block (both-braces-optional would have let it through).
expect(ids("postgres://user:$DB_PASSWORD@host/app")).not.toContain("db.url_with_password");
expect(ids("postgres://admin:$" + "hun" + "ter2@db.internal/app")).toContain("db.url_with_password");
// Mismatched brace is not an interpolation either.
expect(ids("postgres://admin:${dbPass@db.internal/app")).toContain("db.url_with_password");
});
test("all HIGH patterns block (exit 3)", () => {