Дмитрий
dbe2252421
Closes brain-retro 2026-05-20 #3 SIMPLIFIED — sanitizeWithCount in pii-filter (counts matches per pattern) + persistent monthly counter docs/observer/.pii-counters.json (bumped by Stop-hook on each episode write) + status-md-generator reads real count (no more piiMatches: 0 hardcode). PII patterns themselves NOT changed (F7 of parallel session already extended to 13 patterns). Counter is informational — write failure never blocks Stop-event. 5+1+1=7 new vitest tests, 256/256 GREEN. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
105 lines
4.0 KiB
JavaScript
105 lines
4.0 KiB
JavaScript
/**
|
|
* PII filter for brain governance observer (B2).
|
|
* Used by Stop-hook before JSONL write — per Pravila §16.2 + ADR-011 + spec §5.4.
|
|
*
|
|
* Patterns covered:
|
|
* RU_PHONE — +7XXXXXXXXXX (10 digits after +7)
|
|
* EMAIL — any user@domain.tld
|
|
* JWT — eyJ<base64>.<base64>.<base64> (must run BEFORE OPENAI/Bearer
|
|
* fallbacks to avoid partial matches)
|
|
* AWS_KEY — AKIA[A-Z0-9]{16} (Access Key ID prefix)
|
|
* YC_STATIC — AQVN[\w-]{15,} (Yandex Cloud IAM static key)
|
|
* YC_SESSION — t1.<base64> (Yandex IAM session token)
|
|
* YC_OAUTH — y0_<base64> (Yandex OAuth token)
|
|
* SENTRY_TOKEN — sntrys?_<12+ alphanum>
|
|
* OPENAI_TOKEN — sk-<20+ alphanum>
|
|
* GENERIC_BEARER — Bearer <20+ token chars>
|
|
* IPV4 — dotted-quad (over-redacts 4-segment build numbers — accepted
|
|
* tradeoff; under-redaction is the worse failure)
|
|
* WIN_USER_PATH — C:\Users\<name> → C:\Users\***
|
|
* POSIX_HOME — /home/<name> → /home/***
|
|
*
|
|
* Security Guidance #40: pure regex — no exec/execSync.
|
|
*/
|
|
|
|
const RU_PHONE = /\+7\d{10}/g;
|
|
const EMAIL = /[\w.+-]+@[\w-]+\.[\w.-]+/g;
|
|
const JWT = /\beyJ[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}\b/g;
|
|
const AWS_KEY = /\bAKIA[A-Z0-9]{16}\b/g;
|
|
const YC_STATIC = /\bAQVN[A-Za-z0-9_-]{15,}\b/g;
|
|
const YC_SESSION = /\bt1\.[A-Za-z0-9_-]{40,}\b/g;
|
|
const YC_OAUTH = /\by0_[A-Za-z0-9_-]{40,}\b/g;
|
|
const SENTRY_TOKEN = /sntrys?_[A-Za-z0-9]{12,}/g;
|
|
const OPENAI_TOKEN = /sk-[A-Za-z0-9]{20,}/g;
|
|
const GENERIC_BEARER = /Bearer\s+[A-Za-z0-9._-]{20,}/g;
|
|
const IPV4 = /\b\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}\b/g;
|
|
const WIN_USER_PATH = /([Cc]:[\\/]Users[\\/])[^\\/\s"'<>:|?*]+/g;
|
|
const POSIX_HOME = /(\/home\/)[^/\s"'<>:?*]+/g;
|
|
|
|
function sanitizeString(s) {
|
|
if (typeof s !== 'string') return s;
|
|
return s
|
|
.replace(RU_PHONE, '+7XXXXXXXXXX')
|
|
.replace(EMAIL, '***@***')
|
|
// Highly-specific token patterns first — they would otherwise be eaten
|
|
// by GENERIC_BEARER / OPENAI_TOKEN partial matches.
|
|
.replace(JWT, '[REDACTED:jwt]')
|
|
.replace(AWS_KEY, '[REDACTED:aws]')
|
|
.replace(YC_STATIC, '[REDACTED:yandex]')
|
|
.replace(YC_SESSION, '[REDACTED:yandex]')
|
|
.replace(YC_OAUTH, '[REDACTED:yandex]')
|
|
.replace(SENTRY_TOKEN, '[REDACTED:sentry]')
|
|
.replace(OPENAI_TOKEN, '[REDACTED:openai]')
|
|
.replace(GENERIC_BEARER, '[REDACTED:bearer]')
|
|
.replace(IPV4, '[REDACTED:ipv4]')
|
|
.replace(WIN_USER_PATH, '$1***')
|
|
.replace(POSIX_HOME, '$1***');
|
|
}
|
|
|
|
const PATTERNS = {
|
|
RU_PHONE, EMAIL, JWT, AWS_KEY, YC_STATIC, YC_SESSION, YC_OAUTH,
|
|
SENTRY_TOKEN, OPENAI_TOKEN, GENERIC_BEARER, IPV4, WIN_USER_PATH, POSIX_HOME,
|
|
};
|
|
|
|
function countString(s, counts) {
|
|
if (typeof s !== 'string') return;
|
|
for (const [name, re] of Object.entries(PATTERNS)) {
|
|
const reFresh = new RegExp(re.source, re.flags);
|
|
const matches = s.match(reFresh);
|
|
counts[name] = (counts[name] || 0) + (matches ? matches.length : 0);
|
|
}
|
|
}
|
|
|
|
function walkAndCount(input, counts) {
|
|
if (typeof input === 'string') { countString(input, counts); return; }
|
|
if (input === null || input === undefined) return;
|
|
if (Array.isArray(input)) { input.forEach((v) => walkAndCount(v, counts)); return; }
|
|
if (typeof input === 'object') {
|
|
for (const v of Object.values(input)) walkAndCount(v, counts);
|
|
}
|
|
}
|
|
|
|
/**
|
|
* Sanitize input AND count matches per pattern type.
|
|
* Returns { sanitized, counts: { PATTERN_NAME: N, ... } }.
|
|
* counts is pre-initialised to 0 for all 13 known patterns.
|
|
*/
|
|
export function sanitizeWithCount(input) {
|
|
const counts = {};
|
|
for (const k of Object.keys(PATTERNS)) counts[k] = 0;
|
|
walkAndCount(input, counts);
|
|
return { sanitized: sanitize(input), counts };
|
|
}
|
|
|
|
export function sanitize(input) {
|
|
if (typeof input === 'string') return sanitizeString(input);
|
|
if (input === null || input === undefined) return input;
|
|
if (Array.isArray(input)) return input.map(sanitize);
|
|
if (typeof input === 'object') {
|
|
const out = {};
|
|
for (const [k, v] of Object.entries(input)) out[k] = sanitize(v);
|
|
return out;
|
|
}
|
|
return input;
|
|
}
|