From 12c1c7141b50a6532816e836870233c783dffa9d Mon Sep 17 00:00:00 2001 From: GhosTnever Date: Sun, 25 Oct 2026 06:09:49 +0400 Subject: [PATCH] fix: redact temporary AWS credentials --- CHANGELOG.md | 6 ++++++ index.html | 2 +- src/core.js | 4 ++-- test/core.test.js | 9 +++++++++ 4 files changed, 18 insertions(+), 3 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index 8477ed2..8ab8015 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -1,5 +1,11 @@ # Changelog +## Unreleased + +- Redact temporary AWS access keys and `aws_session_token` assignments found in logs. +- Add regression coverage for both credential formats. +- Refresh the browser script URL so hosted clients load the updated core. + ## v1.0.11 — 2026-10-13 - Keep distinct uploaded logs even when their sanitized names and sizes match; exact duplicate content is still skipped. diff --git a/index.html b/index.html index 353888a..80b404e 100644 --- a/index.html +++ b/index.html @@ -8,7 +8,7 @@ BugBundle — Share the signal, not your secrets - +
diff --git a/src/core.js b/src/core.js index 8d7ede4..4608af8 100644 --- a/src/core.js +++ b/src/core.js @@ -1,7 +1,7 @@ const RULES = [ ['Private key', /-----BEGIN (?:RSA |EC |OPENSSH |DSA )?PRIVATE KEY-----[\s\S]*?-----END (?:RSA |EC |OPENSSH |DSA )?PRIVATE KEY-----/g], ['GitHub token', /\b(?:gh[pousr]_[A-Za-z0-9_]{20,}|github_pat_[A-Za-z0-9_]{20,})\b/g], - ['AWS access key', /\bAKIA[0-9A-Z]{16}\b/g], + ['AWS access key', /\b(?:AKIA|ASIA)[0-9A-Z]{16}\b/g], ['Google API key', /\bAIza[0-9A-Za-z_-]{30,}\b/g], ['Slack token', /\bxox[baprs]-[0-9A-Za-z-]{20,}\b/g], ['Discord webhook', /https?:\/\/(?:discord(?:app)?\.com)\/api\/webhooks\/\d{17,20}\/[A-Za-z0-9._-]{20,}/gi], @@ -70,7 +70,7 @@ export function redact(text, options = {}) { const octet = '(?:25[0-5]|2[0-4]\\d|1\\d\\d|[1-9]?\\d)'; countReplace('IPv4 address', new RegExp(`\\b${octet}(?:\\.${octet}){3}\\b`, 'g'), () => '[IP ADDRESS]'); } - countReplace('Credential assignment', /["']?\b(password|passwd|api[_-]?key|access[_-]?token|client[_-]?secret|aws_secret_access_key|secret|token)\b["']?\s*([:=])\s*(?:"[^"\r\n]*"|'[^'\r\n]*'|[^\s,;"'`]+)/gi, + countReplace('Credential assignment', /["']?\b(password|passwd|api[_-]?key|access[_-]?token|client[_-]?secret|aws_secret_access_key|aws_session_token|secret|token)\b["']?\s*([:=])\s*(?:"[^"\r\n]*"|'[^'\r\n]*'|[^\s,;"'`]+)/gi, (...args) => `${args[1]}${args[2]}[REDACTED]`); countReplace('Discord webhook', /https?:\/\/(?:discord(?:app)?\.com)\/api\/webhooks\/\d{17,20}\/[A-Za-z0-9._-]{20,}/gi, () => '[REDACTED WEBHOOK]'); return { text: output, counts }; diff --git a/test/core.test.js b/test/core.test.js index abccb5c..8220ab6 100644 --- a/test/core.test.js +++ b/test/core.test.js @@ -32,6 +32,15 @@ test('redacts common credentials, emails, and user profile paths', () => { assert.equal(result.counts['Authorization token'], 1); }); +test('redacts temporary AWS access keys and session-token assignments', () => { + const input = 'AWS_ACCESS_KEY_ID=ASIA1234567890ABCDEF\naws_session_token=temporary-session-secret-123'; + const result = redact(input); + + assert.doesNotMatch(result.text, /ASIA1234567890ABCDEF|temporary-session-secret-123/); + assert.equal(result.counts['AWS access key'], 1); + assert.equal(result.counts['Credential assignment'], 1); +}); + test('redacts webhook URLs and JSON-style apiKey assignments', () => { const input = [ 'https://discord.com/api/webhooks/123456789012345678/abcdefghijklmnopQRSTUVwx',