From fdba9cf9c44eba9ed7d6e9ba7f79cf45bdb70d46 Mon Sep 17 00:00:00 2001 From: Lixi20 Date: Mon, 14 Sep 2026 15:57:05 +0800 Subject: [PATCH] =?UTF-8?q?fix(security):=20=E5=87=AD=E8=AF=81=E6=89=AB?= =?UTF-8?q?=E6=8F=8F=E8=A1=A5=20AI=20=E6=9C=8D=E5=8A=A1=E5=95=86=E5=AF=86?= =?UTF-8?q?=E9=92=A5=E5=BD=A2=E6=80=81=E4=B8=8E=20api=5Fkey=20=E8=B5=8B?= =?UTF-8?q?=E5=80=BC=EF=BC=88ADR-021=EF=BC=89?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit 三仓同构副本同步提交。规则变更与验证记录见 patbond-doc 同名提交及 docs/development/iterations/iteration-4/08-git-workflow-plan.md（决策 G）。 - 新增 AK-ANTHROPIC（sk-ant-）、AK-OPENAI（sk- / sk-proj- / sk-svcacct-） - KEY-ASSIGN 扩至 api[-_]?(key|secret|token) 与 auth[-_]?token - ALLOW 补 x{3,} 验证：本仓 scripts/check-secrets.sh --all 退出 0 零误报；三仓副本 md5 同构 640994c12bfa78b4512e872d709ed685。 Co-Authored-By: Claude Opus 5 (1M context) --- scripts/check-secrets.sh | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) diff --git a/scripts/check-secrets.sh b/scripts/check-secrets.sh index 90299d2..8256a57 100755 --- a/scripts/check-secrets.sh +++ b/scripts/check-secrets.sh @@ -15,7 +15,9 @@ set -u mode="${1:---all}" # 允许清单：行内出现任一形态即放行（${} 注入、占位值、明显示例值） -ALLOW='\$\{[^}]*\}|\{\{[^}]*\}\}|changeme|change[-_]me|your[-_][a-zA-Z0-9_-]+|<[a-zA-Z0-9 ,_.-]+>|placeholder|example|sample|dummy|fake|redacted|\*\*\*' +# 注：x{3,}（xxx / xxxx…）是本项目文档描述凭证形态时的既有占位约定， +# 放行它使「讲解规则的文档」不会被规则自身拦下（如 iteration-4/08 §漏检清单）。 +ALLOW='\$\{[^}]*\}|\{\{[^}]*\}\}|changeme|change[-_]me|your[-_][a-zA-Z0-9_-]+|<[a-zA-Z0-9 ,_.-]+>|placeholder|example|sample|dummy|fake|redacted|\*\*\*|x{3,}' # 内容扫描跳过：本脚本与 hook 自身（含规则文本，非凭证） SKIP_PATHS='(^|/)scripts/(check-secrets\.sh|hooks/pre-commit)$' @@ -29,9 +31,11 @@ RULES=$(cat <<'EOF' AK-AWS - - AKIA[0-9A-Z]{16} AK-QCLOUD - - AKID[0-9A-Za-z]{16,} AK-ALIYUN - - LTAI[0-9A-Za-z]{12,} +AK-ANTHROPIC - - sk-ant-[A-Za-z0-9_-]{16,} +AK-OPENAI - - sk-(proj-|svcacct-)?[A-Za-z0-9]{20,} MINIO-DEFAULT i - minio[-_.]?admin PRIVATE-KEY - - ^[[:space:]]*-----BEGIN [A-Z ]*PRIVATE KEY-----[[:space:]]*$ -KEY-ASSIGN i - (access[-_]?key(_?id)?|secret[-_]?(access[-_]?)?key)["']?[[:space:]]*[:=][[:space:]]*["']?[A-Za-z0-9+/=_-]{8,} +KEY-ASSIGN i - (access[-_]?key(_?id)?|secret[-_]?(access[-_]?)?key|api[-_]?(key|secret|token)|auth[-_]?token)["']?[[:space:]]*[:=][[:space:]]*["']?[A-Za-z0-9+/=_-]{8,} JWT-SECRET i - (jwt[-_.]?secret|signing[-_]?key|token[-_]?secret|hmac[-_]?(key|secret))["']?[[:space:]]*[:=][[:space:]]*["']?[A-Za-z0-9+/=_-]{8,} DB-PASSWORD i \.(ya?ml|properties|toml|conf|ini)(\.sample|\.example)?$ (password|passwd|pwd)["']?[[:space:]]*[:=][[:space:]]*["']?[^[:space:]"'$]{6,} EOF