94 lines
2.7 KiB
Bash
Executable File
94 lines
2.7 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
set -euo pipefail
|
|
|
|
mode="${1:---staged}"
|
|
repo_root="$(git rev-parse --show-toplevel)"
|
|
cd "$repo_root"
|
|
|
|
if [[ "$mode" != "--staged" && "$mode" != "--files" ]]; then
|
|
echo "usage: $0 [--staged|--files <path> ...]" >&2
|
|
exit 2
|
|
fi
|
|
|
|
artifact_path_regex='(^|/)(docs/baselines/|baselines/|snapshots?/|exports?/|dumps?/|backups?/|diagnostics?/|artifacts?/|tmp/|temp/)|(^|/).*(baseline|snapshot|export|dump|diagnostic).*(\.json|\.ya?ml|\.txt|\.conf)?$'
|
|
|
|
placeholder_regex='(REDACTED|CHANGE_ME|<redacted>|example|placeholder|your[_ -]?token|your[_ -]?key)'
|
|
|
|
declare -a files=()
|
|
if [[ "$mode" == "--staged" ]]; then
|
|
while IFS= read -r f; do
|
|
[[ -n "$f" ]] && files+=("$f")
|
|
done < <(git diff --cached --name-only --diff-filter=ACMR)
|
|
else
|
|
shift
|
|
for f in "$@"; do
|
|
files+=("$f")
|
|
done
|
|
fi
|
|
|
|
if [[ ${#files[@]} -eq 0 ]]; then
|
|
exit 0
|
|
fi
|
|
|
|
failures=0
|
|
|
|
scan_file() {
|
|
local file="$1"
|
|
[[ -f "$file" ]] || return 0
|
|
[[ "$file" =~ $artifact_path_regex ]] || return 0
|
|
|
|
python3 - "$file" "$placeholder_regex" <<'PY'
|
|
from pathlib import Path
|
|
import re, sys
|
|
|
|
path = Path(sys.argv[1])
|
|
placeholder = re.compile(sys.argv[2], re.I)
|
|
text = path.read_text(errors='ignore')
|
|
lines = text.splitlines()
|
|
|
|
patterns = [
|
|
(re.compile(r'"x_wireguard_private_key"\s*:\s*"([^"]+)"', re.I), 'embedded WireGuard private key'),
|
|
(re.compile(r'"wireguard_client_configuration_file"\s*:\s*"([^"\\]|\\.)*PrivateKey = [A-Za-z0-9+/=]{20,}', re.I), 'embedded WireGuard client config with private key'),
|
|
(re.compile(r'PrivateKey\s*=\s*([A-Za-z0-9+/=]{20,})'), 'WireGuard private key line'),
|
|
(re.compile(r'Authorization\s*[:=]\s*(Bearer\s+)?[A-Za-z0-9._~+/=-]{16,}', re.I), 'authorization header/token material'),
|
|
(re.compile(r'"(token|api[_-]?key|client[_-]?secret|password|secret|cookie)"\s*:\s*"([^"]{12,})"', re.I), 'suspicious secret-like JSON field'),
|
|
]
|
|
|
|
for idx, line in enumerate(lines, start=1):
|
|
for regex, label in patterns:
|
|
m = regex.search(line)
|
|
if not m:
|
|
continue
|
|
if placeholder.search(line):
|
|
continue
|
|
print(f'{path}:{idx}: {label}')
|
|
print(f' {line[:220]}')
|
|
sys.exit(1)
|
|
sys.exit(0)
|
|
PY
|
|
}
|
|
|
|
for file in "${files[@]}"; do
|
|
if ! scan_file "$file"; then
|
|
failures=1
|
|
fi
|
|
done
|
|
|
|
if [[ "$failures" -ne 0 ]]; then
|
|
cat >&2 <<'EOF'
|
|
|
|
Secret-bearing artifact scan failed.
|
|
|
|
This guardrail is intentionally narrow: it is meant to stop raw controller/export/baseline artifacts
|
|
from being committed with embedded keys or tokens.
|
|
|
|
Fix options:
|
|
- remove the raw artifact from the commit
|
|
- replace it with a sanitized markdown summary
|
|
- explicitly redact the secret-bearing fields
|
|
|
|
If raw retention is required, store it outside the main repo or in the encrypted secrets repo.
|
|
EOF
|
|
exit 1
|
|
fi
|