CRT/storebound
1
0
Fork 0
Code Issues Pull requests Releases 1 Packages 1 Activity Actions

scan: an email hit whose line or the 3 lines above (doc comment, enclosing interface) name a server / config identity is not user data (a game apps/server/src/iap/rtdn.ts: email: string | null under 'Push service account email')

Browse source
This commit is contained in:
CRTkafa 2026-10-15 22:51:02 +08:00
parent 9171cb1129
commit a1647e9552
3 changed files with 21 additions and 3 deletions
Download patch file Download diff file Expand all files Collapse all files

12
cli/lib/scan/rules.ts
View file

@ -108,6 +108,18 @@ export function userLine(re: RegExp): RegExp {
const c = codeLine(re);
return new RegExp(c.source.replace(/^\^/, `^${skip}`), c.flags);
}
/** A hit whose own line or the 3 lines above it (doc comment, the enclosing interface / object key) name a server or
* config identity: a game's `email: string | null;` in `interface RtdnAuthConfig` under "Push service account email
* ...". Pure. */
export const SERVER_IDENTITY = /audience|\boidc\b|pub\/?sub|service[_ -]?account|client_email|\brtdn|\bsmtp|reply[_-]?to|\bsender\b|admin[_a-z]*email|email[_a-z]*from|process\.env|bun\.env|import\.meta\.env|deno\.env|getenv/i;
export function userFacing<H extends { file: string; line: number }>(sources: { path: string; text: string }[], hits: H[]): H[] {
const text = new Map(sources.map(s => [s.path, s.text.split('\n')]));
return hits.filter(h => {
const lines = text.get(h.file);
if (!lines) return true;
return !SERVER_IDENTITY.test(lines.slice(Math.max(0, h.line - 4), h.line).join('\n'));
});
}
export const SIGNALS = {
appleSignIn: /ASAuthorizationAppleIDProvider|SignInWithAppleButton|AppleAuthenticationButton|AppleAuthentication\.signInAsync|appleAuth\.performRequest|SignInWithApple|OAuthProvider\(\s*['"]apple\.com|AppleAuthProvider|signInWithApple|AppleAuthManager/,
thirdPartyLogin: /GIDSignIn|GoogleSignin\.signIn|GoogleSignIn\(|GoogleAuthProvider|signInWithGoogle|FacebookAuthProvider|LoginManager\(\)\.logIn|LoginManager\.logInWithPermissions|signInWithFacebook|FacebookLogin|TwitterAuthProvider|GithubAuthProvider|OAuthProvider\(\s*['"](microsoft\.com|yahoo\.com|twitter\.com|github\.com)/,