security: widen verifier (openssh/hyphenated-sk/ctx7sk/credential-assign/telegram/conn-string), fix GIT_WORKFLOW guidance
- BEGIN [A-Z0-9 ]*PRIVATE KEY now covers OPENSSH/RSA/EC variants - sk- patterns tolerate hyphens and prefixed families (ctx7sk-) - credential-assign catches PASSWORD=/token:/|API_KEY| tables (placeholder-aware) - telegram bot tokens + connection strings with embedded passwords - .obsidian/** third-party plugin code excluded from value scan (noise) - regression: all 12 files named in REVIEW-FOLLOWUP now flagged - GIT_WORKFLOW: drop git add . / Windows path, add verifier step, note force-push exception for the one-time history rewrite
This commit is contained in:
windyboy
+42
-10
@@ -3,14 +3,36 @@
|
||||
import { execSync } from 'node:child_process'
|
||||
import { readFileSync } from 'node:fs'
|
||||
|
||||
// 值形态的占位符 / 环境引用：不算泄漏
|
||||
const PLACEHOLDER =
|
||||
/(\{\{|<[^>]*>|\$\{|process\.env|\benv\[|your[-_]|example|sample|placeholder|changeme|redacted|\bxxx\b|\.\.\.|\[hidden\])/i
|
||||
|
||||
// 只报路径与行号，绝不打印匹配到的内容
|
||||
const KEY_PATTERNS = [
|
||||
/sk-or-v1-[A-Za-z0-9]{20,}/,
|
||||
/sk-[A-Za-z0-9]{32,}/,
|
||||
/AKIA[0-9A-Z]{16}/,
|
||||
/gh[pousr]_[A-Za-z0-9]{36,}/,
|
||||
/glpat-[A-Za-z0-9_-]{20,}/,
|
||||
/BEGIN PRIVATE KEY/,
|
||||
/xox[baprs]-[A-Za-z0-9-]{10,}/,
|
||||
// OpenAI 系（sk-or-v1 / sk-proj / sk-svcacct / 裸 sk-），键内允许连字符
|
||||
['openai-key', /\bsk-[A-Za-z0-9_-]{16,}/, false],
|
||||
// 第三方 "xxxsk-" 前缀族（如 ctx7sk-…）
|
||||
['prefixed-key', /\b[A-Za-z0-9]{2,8}sk-[A-Za-z0-9_-]{16,}/, false],
|
||||
['aws', /\bAKIA[0-9A-Z]{16}\b/, false],
|
||||
['github-pat', /\bgh[pousr]_[A-Za-z0-9]{20,}/, false],
|
||||
['gitlab-pat', /\bglpat-[A-Za-z0-9_-]{20,}/, false],
|
||||
// 覆盖 OPENSSH / RSA / EC / ENCRYPTED 等全部变体
|
||||
['private-key', /BEGIN [A-Z0-9 ]*PRIVATE KEY/, false],
|
||||
['slack', /\bxox[baprs]-[A-Za-z0-9-]{10,}/, false],
|
||||
// 关键字赋值 / 表格单元格：PASSWORD=… / token: … / | API_KEY | …（值须 ≥16 位密钥形态字符）
|
||||
[
|
||||
'credential-assign',
|
||||
/[A-Za-z0-9_-]{0,32}(?:password|passwd|pwd|token|secret|api[_-]?key|apikey|access[_-]?key|secret[_-]?key|bot[_-]?token|private[_-]?key|credential)["']?\s*[:=|]\s*["']?([A-Za-z0-9_+/=~.!@#$%^&*?:-]{16,})/i,
|
||||
true,
|
||||
],
|
||||
// Telegram bot token：<数字id>:AA<hash>
|
||||
['telegram-bot', /\b\d{8,10}:AA[A-Za-z0-9_-]{30,}/, false],
|
||||
// 带内嵌口令的连接串 postgres://user:pass@host
|
||||
[
|
||||
'conn-string',
|
||||
/\b(?:postgres(?:ql)?|mysql|redis|mongodb(?:\+srv)?|amqp|smtp|mssql):\/\/[^\s'"@:/]+:[^\s'"@]{4,}@/,
|
||||
false,
|
||||
],
|
||||
]
|
||||
|
||||
const OBSIDIAN_HEX_PATTERN = /^[0-9a-f]{64}$/i
|
||||
@@ -36,12 +58,22 @@ for (const file of trackedFiles) {
|
||||
}
|
||||
|
||||
const lines = content.split('\n')
|
||||
// .obsidian/** 是第三方插件代码与状态，值形态规则误报极高（minified JS/CSS）；
|
||||
// 密钥载体 data.json 已解除跟踪，这里只保留 64 位 hex 检查
|
||||
const isObsidian = file.startsWith('.obsidian/')
|
||||
for (let i = 0; i < lines.length; i++) {
|
||||
const line = lines[i]
|
||||
|
||||
for (const pattern of KEY_PATTERNS) {
|
||||
if (pattern.test(line)) {
|
||||
console.error(`KEY LEAK: ${file}:${i + 1}`)
|
||||
if (!isObsidian) {
|
||||
for (const [name, pattern, checkValue] of KEY_PATTERNS) {
|
||||
const m = pattern.exec(line)
|
||||
if (!m) continue
|
||||
// 赋值类：值是占位符 / 环境引用时放行
|
||||
if (checkValue) {
|
||||
const value = m[1]
|
||||
if (!value || PLACEHOLDER.test(value)) continue
|
||||
}
|
||||
console.error(`KEY LEAK (${name}): ${file}:${i + 1}`)
|
||||
found = true
|
||||
}
|
||||
}
|
||||
|
||||
@@ -23,7 +23,7 @@ This prevents conflicts and ensures you're working with the latest version.
|
||||
### Morning (Session Start)
|
||||
|
||||
```bash
|
||||
cd D:\tmp\vault\my-vault
|
||||
cd ~/Documents/ob-vault/my-vault
|
||||
git pull
|
||||
git status # Check for any conflicts
|
||||
```
|
||||
@@ -45,9 +45,10 @@ git status # Periodically check changes
|
||||
|
||||
```bash
|
||||
git status # Review all changes
|
||||
git add . # Stage all changes
|
||||
git add <改动的具体路径> # 按路径暂存，别盲加
|
||||
node .scripts/verify-vault.mjs # 密钥扫描，退出码必须为 0
|
||||
git commit -m "vault backup: $(date +%Y-%m-%d\ %H:%M:%S)"
|
||||
git push # Sync to remote
|
||||
git push # Sync to remote（仅人工执行；agent 受 AGENTS.md 约束）
|
||||
```
|
||||
|
||||
**What this does**:
|
||||
@@ -104,7 +105,7 @@ Archive: Completed research project
|
||||
```bash
|
||||
git status # Check current state
|
||||
git pull # Sync from remote
|
||||
git add . # Stage all changes
|
||||
git add <具体路径> # Stage specific files
|
||||
git commit -m "message" # Commit with message
|
||||
git push # Sync to remote
|
||||
git log --oneline -10 # View recent commits
|
||||
@@ -193,7 +194,7 @@ Delete conflict markers (`<<<<<<<`, `=======`, `>>>>>>>`).
|
||||
**3. Stage and commit**
|
||||
|
||||
```bash
|
||||
git add .
|
||||
git add <已解决冲突的文件>
|
||||
git commit -m "Resolve merge conflicts"
|
||||
git push
|
||||
```
|
||||
@@ -375,7 +376,7 @@ git pull
|
||||
```bash
|
||||
git pull # May auto-merge
|
||||
# If conflicts, resolve manually
|
||||
git add .
|
||||
git add <已解决冲突的文件>
|
||||
git commit -m "Resolve merge conflicts"
|
||||
git push
|
||||
```
|
||||
@@ -427,8 +428,8 @@ git push
|
||||
|
||||
### DON'T ❌
|
||||
|
||||
- **Never force push** to main/master (`git push --force`)
|
||||
- **Don't commit secrets** (API keys, passwords)
|
||||
- **Never force push** to main/master (`git push --force`) —— 例外仅限一次性的历史清理维护窗口（清除已泄漏密钥，见 SECURITY_ROTATION_LOG）
|
||||
- **Don't commit secrets** (API keys, passwords) —— 提交前跑 `node .scripts/verify-vault.mjs`；agent 会话一律禁用 `git add .` 与 `git push`（见 AGENTS.md 权限表）
|
||||
- **Don't commit huge files** (videos > 50MB - use Git LFS)
|
||||
- **Don't edit history** of pushed commits (causes conflicts)
|
||||
- **Don't ignore conflicts** (resolve immediately)
|
||||
@@ -446,7 +447,7 @@ git pull
|
||||
# Work throughout day...
|
||||
|
||||
# Evening
|
||||
git add .
|
||||
git add <改动的具体路径>
|
||||
git commit -m "vault backup: $(date)"
|
||||
git push
|
||||
```
|
||||
@@ -460,7 +461,7 @@ git pull # Gets Desktop's changes
|
||||
# Work on laptop...
|
||||
|
||||
# Before sleep
|
||||
git add .
|
||||
git add <改动的具体路径>
|
||||
git commit -m "vault backup: $(date)"
|
||||
git push
|
||||
```
|
||||
@@ -486,7 +487,7 @@ git pull # Gets Laptop's changes
|
||||
# Daily workflow
|
||||
git pull # Start of session
|
||||
git status # Check changes
|
||||
git add . # Stage all
|
||||
git add <paths> # Stage specific files
|
||||
git commit -m "vault backup: $(date)" # Commit
|
||||
git push # End of session
|
||||
|
||||
@@ -534,5 +535,5 @@ git reset --hard origin/main
|
||||
|
||||
---
|
||||
|
||||
**Last Updated**: 2026-01-06
|
||||
**Last Updated**: 2026-09-26
|
||||
**See Also**: [[CLAUDE]], [[QUICK_REFERENCE]], [[TROUBLESHOOTING]]
|
||||
|
||||
Reference in New Issue
Block a user