CRT/storebound
1
0
Fork 0
Code Issues Pull requests Releases 1 Packages 1 Activity Actions

scan: an email hit whose line or the 3 lines above (doc comment, enclosing interface) name a server / config identity is not user data (a game apps/server/src/iap/rtdn.ts: email: string | null under 'Push service account email')

Browse source
This commit is contained in:
CRTkafa 2026-10-15 22:51:02 +08:00
parent 9171cb1129
commit a1647e9552
3 changed files with 21 additions and 3 deletions
Download patch file Download diff file Expand all files Collapse all files

6
cli/lib/scan/declare.ts
View file

@ -8,7 +8,7 @@ import { ACCOUNT_CREATION, ACCOUNT_SIGN_UP, accountCreationOf, APPLE_PRIVACY, ap
import { REQUIRED_REASON_APIS } from '../privacy-manifest';
import { IOS_PERMISSIONS } from './permissions';
import { grep, grepOwn, type Hit, lineOf, type ProjectFacts } from './project';
import { SIGNALS } from './rules';
import { SIGNALS, userFacing } from './rules';
export type DeclArea = 'dataSafety' | 'appPrivacy' | 'att' | 'privacyManifest';
export interface DeclItem { area: DeclArea; what: string; value: string; status: 'detected' | 'ask'; evidence: Hit[]; note?: string }
@ -83,7 +83,9 @@ export function proposeDeclarations(p: ProjectFacts, c: ShipConfig | null, confi
if (accounts) {
markAccount('PSL_USER_ACCOUNT', signUp.length ? signUp : [cfgAt(/accounts\s*:/, 'from config (accounts.enabled)')], 'accounts');
for (const s of signUpCfg) for (const t of ACCOUNT_SIGN_UP[s]?.data ?? []) if (t !== 'PSL_USER_ACCOUNT') markAccount(t, [cfgAt(/signUp\s*:/, `accounts.signUp: ${s}`)], `accounts.signUp ${s}`);
const em = grepOwn(p, SIGNALS.email, 2);
const all = grepOwn(p, SIGNALS.email, 30);
// server / config identities (a Pub/Sub push service account, SMTP, env values) are not collected from users
const em = { built: all.built, hits: userFacing(p.sources, all.hits).slice(0, 2) };
if (em.hits.length && !em.built) markAccount('PSL_EMAIL', em.hits, 'email in the sources');
else if (!detected.has('PSL_EMAIL')) {
if (em.hits.length) items.push({ area: 'dataSafety', what: 'PSL_EMAIL', value: 'collected? an email field shows up only in built output', status: 'ask', evidence: em.hits.slice(0, 1), note: 'check the source; not written' });