CRT/storebound
1
0
Fork 0
Code Issues Pull requests Releases 1 Packages 1 Activity Actions

scan: an email hit whose line or the 3 lines above (doc comment, enclosing interface) name a server / config identity is not user data (a game apps/server/src/iap/rtdn.ts: email: string | null under 'Push service account email')

Browse source
This commit is contained in:
CRTkafa 2026-10-15 22:51:02 +08:00
parent 9171cb1129
commit a1647e9552
3 changed files with 21 additions and 3 deletions
Download patch file Download diff file Expand all files Collapse all files

6
tests/scan.test.ts
View file

@ -13,7 +13,7 @@ import { runScan } from '../cli/lib/scan';
import { PLAY_REFS } from '../cli/lib/scan/play-rules';
import { vaguePurpose } from '../cli/lib/scan/permissions';
import { detectProject, isBuilt, parsePlist } from '../cli/lib/scan/project';
import { SIGNALS } from '../cli/lib/scan/rules';
import { SIGNALS, userFacing } from '../cli/lib/scan/rules';
import { localSwiftPackages, nativeIosPlugins, workspaceDirs } from '../cli/lib/node-packages';
import type { ScanFinding } from '../cli/lib/scan/rules';
import { matchesSdk, SDKS, versionAtLeast } from '../cli/lib/scan/sdks';
@ -395,6 +395,10 @@ describe('monorepo: username accounts without email, plugins in apps/native/node
' pubsub: { email: cfg.serviceAccount },', ' smtp: { host, email: env.SMTP_USER },'];
for (const s of yes) expect({ s, hit: SIGNALS.email.test(s) }).toEqual({ s, hit: true });
for (const s of no) expect({ s, hit: SIGNALS.email.test(s) }).toEqual({ s, hit: false });
// multi-line: the identity is named in the doc comment above (a game apps/server/src/iap/rtdn.ts)
const rtdn = 'export interface RtdnAuthConfig {\n /** OIDC audience of the push subscription. */\n audience: string | null;\n /** Push service account email the token must carry. */\n email: string | null;\n}\nconst body = { email: form.email };';
const src = [{ path: 'rtdn.ts', text: rtdn }];
expect(userFacing(src, [{ file: 'rtdn.ts', line: 5 }, { file: 'rtdn.ts', line: 7 }]).map(h => h.line)).toEqual([7]);
});
test('built output is low trust', () => {
expect(isBuilt('apps/native/web/bundle/routes-AbC12345.js')).toBe(true);