KTeam/kt-template-online-api
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix: 扩展运行时证据文本脱敏

Browse Source
This commit is contained in:
sunlei 2026-06-13 18:28:20 +08:00
parent 7f4ff45938
commit 340cb073be
2 changed files with 39 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

9
src/runtime/evidence/runtime-evidence.service.ts
View File

@ -9,7 +9,7 @@ const REDACTED_BASE64_VALUE = '<redacted-base64>';
const SENSITIVE_KEY_PATTERN =
/password|secret|token|authorization|cookie|privatekey|sshkey|ticket|randstr|replytext|base64/i;
const SENSITIVE_TEXT_KEY_PATTERN =
'password|secret|token|authorization|cookie|private[_-]?key|ssh[_-]?key|ticket|randstr|replyText|sid';
'(?:[A-Za-z0-9_-]*(?:password|secret|token|authorization|cookie|private[_-]?key|ssh[_-]?key|ticket|randstr|replyText|base64)[A-Za-z0-9_-]*|sid)';
const SENSITIVE_TEXT_REPLACEMENTS: Array<[RegExp, string]> = [
[
/data:[a-z0-9.+-]+\/[a-z0-9.+-]+;base64,[a-z0-9+/=\r\n]+/gi,
@ -26,8 +26,11 @@ const SENSITIVE_TEXT_REPLACEMENTS: Array<[RegExp, string]> = [
'$1$2$1:$3<redacted>$3',
],
[
new RegExp(`\\b(${SENSITIVE_TEXT_KEY_PATTERN})\\s*=\\s*[^\\s,;&]+`, 'gi'),
'$1=<redacted>',
new RegExp(
`\\b(${SENSITIVE_TEXT_KEY_PATTERN})(\\s*[:=]\\s*)[^\\s,;&]+`,
'gi',
),
'$1$2<redacted>',
],
];

33
test/runtime/runtime-evidence.service.spec.ts
View File

@ -216,4 +216,37 @@ describe('RuntimeEvidenceService', () => {
expect(serialized).toContain('captcha evidence');
expect(serialized).toContain('kept');
});
it('redacts compound token and secret text keys while preserving session identifiers', () => {
const service = new RuntimeEvidenceService();
const record = service.createRecord({
title: 'compound token evidence',
taskType: 'api',
project: 'kt-template-online-api',
environment: 'local',
operation: 'admin-login',
target: 'sessionId=KT_SCAN_SAFE',
status: 'failed',
details: {
sessionId: 'KT_SCAN_SAFE',
text:
'accessToken=raw-access-token refreshToken=raw-refresh-token access_token=raw-snake-token client_secret=raw-client-secret sessionId=KT_SCAN_SAFE',
jsonText:
'{"accessToken":"raw-json-access","refreshToken":"raw-json-refresh","access_token":"raw-json-snake","client_secret":"raw-json-client-secret","sessionId":"KT_SCAN_SAFE"}',
},
});
const serialized = JSON.stringify(record);
expect(serialized).not.toContain('raw-access-token');
expect(serialized).not.toContain('raw-refresh-token');
expect(serialized).not.toContain('raw-snake-token');
expect(serialized).not.toContain('raw-client-secret');
expect(serialized).not.toContain('raw-json-access');
expect(serialized).not.toContain('raw-json-refresh');
expect(serialized).not.toContain('raw-json-snake');
expect(serialized).not.toContain('raw-json-client-secret');
expect(serialized).toContain('KT_SCAN_SAFE');
});
});