Repository navigation
fix(secret-guard): hide *_AUTH/*_PASS values and connection URL passwords - #17
Merged
Merged
Conversation
…ords An env line such as export REDISCLI_AUTH=... passed through, because the name rule knew only SECRET, TOKEN, PASSWORD and the like. AUTH and PASS now count when they are the last whole word of the name, so DB_PASS and REDISCLI_AUTH are hidden while BYPASS, COMPASS and GOOGLE_OAUTH stay. A password in a connection URL, as in redis://:pass@host or postgres://user:pass@host, is now hidden too. Scheme, user and host stay. The value runs to the last @, so a raw @ in the password does not leave a tail visible. The README lists the limits: passwords under 8 characters or with a raw / are not hidden.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Problem
export REDISCLI_AUTH=...passed through. The name rule knew only SECRET, TOKEN, PASSWORD and similar words.redis://:pass@hostorpostgres://user:pass@host.Change
AUTHandPASSnow count when they are the last whole word of an env name.REDISCLI_AUTH,DB_PASSandBASIC_AUTHare hidden.BYPASS,COMPASSandGOOGLE_OAUTHstay.@, so a raw@in the password leaves no visible tail./, is not hidden. A dev URL such aspostgres:postgres@is hidden, so a shell command that holds one is refused.Verification
claude plugin test .: 15 pass, 0 fail. The two new tests fail with the old regexes.claude plugin validate --strict .: passed../typecheck.sh secret-guard: exit 0.