mirror of
https://github.com/larksuite/cli.git
synced 2026-07-03 14:02:43 +08:00
e93e2a98e1
* feat(apps): replace +html-publish cwd hard-reject with credential-file scan The previous --path == "." block was a coarse heuristic: it caught the common foot-gun of publishing a repo root, but also rejected legitimate clean cwds, and let a ./dist with a forgotten .env ship the secret through anyway (the sensitive-paths scanner was advisory and never ran on the Execute path). Move the gate from path shape to path content: - Validate now walks --path candidates and rejects publishes that include well-known credential files (.env / .env.* / .npmrc / .netrc / .git-credentials / .aws/credentials / .gcloud/credentials* / .docker/config.json / .kube/config). Living in Validate (not DryRun) means dry-run returns non-zero on hit too, so the dry-run preview matches Execute. - Narrow the credential pattern set. .git/, SSH private keys, *.pem and *.key are out of scope -- they're not env-token files and the false-positive rate (public certs, docs about key formats) is high. - Add --allow-sensitive as the escape hatch for legitimate cases (e.g. a docs site shipping .env.example on purpose). DryRun surfaces the waived list in sensitive_waived so the caller can relay it. - Drop the cwd defense-in-depth in runHTMLPublish. A clean cwd is now a valid publish target. The lark-apps skill and the html-publish reference are updated to describe the new gate, the override flag, and the patterns now explicitly out of scope. * feat(apps): drop .gcloud/* from credential-file scan The .gcloud/credentials pattern matched a non-existent path: gcloud's actual config dir is ~/.config/gcloud/ (XDG-based), and the real credential files there are credentials.db / access_tokens.db / application_default_credentials.json -- none of which would land under a .gcloud/ segment in a publish payload. Drop the rule rather than fix it: the realistic gcloud foot-gun would require recognizing the .config/gcloud/* tree by file basename, which is a broader change than the targeted env/cred scan in this PR. The remaining 7 patterns (.env / .env.* / .npmrc / .netrc / .git-credentials / .aws/credentials / .docker/config.json / .kube/config) cover the common Node/Python/CLI-tooling foot-guns. * fix(apps): close credential-scan bypass when --path is the parent dir itself isSensitiveRelPath anchors cloud-SDK matchers on adjacent parent/file segments (.aws/credentials, .docker/config.json, .kube/config), but walker strips that parent via filepath.Rel when --path is the conventional parent dir (e.g. ./.aws), yielding a bare RelPath="credentials" that slipped through silently. Same bypass for the single-file form --path ./.aws/credentials (walker sets RelPath = Base(rootPath)). Wrap the scan in isSensitiveCandidate: keep the fast RelPath scan, and on miss fall back to filepath.Abs(AbsPath) so the parent segment is visible again. isSensitiveRelPath itself is unchanged; existing tests still pin its pure-function contract. * fix(apps): drop filepath.Abs from sensitive scan to satisfy forbidigo lint The previous fix called filepath.Abs(c.AbsPath) — banned by the repo's forbidigo rule because shortcuts must not reach into the filesystem for path resolution. Reframe the same fix without fs access: re-prepend the root's basename (or, for the single-file form, the parent dir's basename of rootPath) to RelPath and re-scan only the parent-anchored credential pairs (.aws/credentials, .docker/config.json, .kube/config). Leaf matchers (.env / .npmrc / ...) stay scoped to RelPath — incidentally closing a latent false-positive where --path /home/alice/.env/dist would have flagged every file under it just because .env appeared in the absolute path.
71 lines
2.2 KiB
Go
71 lines
2.2 KiB
Go
// Copyright (c) 2026 Lark Technologies Pte. Ltd.
|
|
// SPDX-License-Identifier: MIT
|
|
|
|
package apps
|
|
|
|
import "testing"
|
|
|
|
func TestIsSensitiveRelPath(t *testing.T) {
|
|
cases := []struct {
|
|
rel string
|
|
want bool
|
|
}{
|
|
// .env family (token-bearing env files)
|
|
{".env", true},
|
|
{".env.local", true},
|
|
{".env.production", true},
|
|
{"backend/.env", true},
|
|
{"src/config/.env.staging", true},
|
|
|
|
// HTTP auth tokens
|
|
{".npmrc", true},
|
|
{"sub/.npmrc", true},
|
|
{".netrc", true},
|
|
{"home/.netrc", true},
|
|
|
|
// Git HTTPS credentials store
|
|
{".git-credentials", true},
|
|
{"backup/.git-credentials", true},
|
|
|
|
// Cloud SDK credentials (require conventional parent dir)
|
|
{".aws/credentials", true},
|
|
{"home/.aws/credentials", true},
|
|
{".docker/config.json", true},
|
|
{"backup/.docker/config.json", true},
|
|
{".kube/config", true},
|
|
{"home/.kube/config", true},
|
|
|
|
// Out of scope (intentionally NOT blocked anymore)
|
|
{".gitignore", false}, // intentionally committed
|
|
{".git/config", false}, // SCM history, not tokens
|
|
{".git/HEAD", false}, // same
|
|
{".ssh/id_rsa", false}, // SSH key — different threat model
|
|
{".ssh/id_ed25519", false}, // same
|
|
{"backup/id_rsa.pub", false}, // same
|
|
{".aws/config", false}, // just region/profile, no token
|
|
{"server.pem", false}, // too broad — could be a public cert
|
|
{"certs/private.key", false}, // too broad — could be a sample
|
|
{"path/to/whatever.pem", false},
|
|
|
|
// Lookalikes that should NOT match
|
|
{".envrc", false}, // direnv config, no tokens
|
|
{"environment.yml", false}, // conda env, not .env
|
|
{"my.env.file.txt", false}, // segment doesn't start with .env
|
|
{".kube/configmap.yaml", false}, // segment is configmap.yaml not config
|
|
{".docker/config", false}, // .docker/config (not .json) doesn't carry token
|
|
{"aws/credentials", false}, // missing leading dot on aws
|
|
|
|
// Benign
|
|
{"index.html", false},
|
|
{"dist/main.js", false},
|
|
{"assets/logo.svg", false},
|
|
{"README.md", false},
|
|
{"package.json", false},
|
|
}
|
|
for _, c := range cases {
|
|
if got := isSensitiveRelPath(c.rel); got != c.want {
|
|
t.Errorf("isSensitiveRelPath(%q) = %v, want %v", c.rel, got, c.want)
|
|
}
|
|
}
|
|
}
|