37 lines
1.2 KiB
Python
37 lines
1.2 KiB
Python
"""Scan tracked content without printing matched credentials."""
|
|
from pathlib import Path
|
|
import re
|
|
import subprocess
|
|
|
|
RULES = {
|
|
"telegram-token": re.compile(r"\b\d{6,12}:[A-Za-z0-9_-]{32,}\b"),
|
|
"private-key": re.compile(r"-----BEGIN (?:OPENSSH |RSA |EC )?PRIVATE KEY-----"),
|
|
}
|
|
|
|
|
|
def main():
|
|
files = subprocess.check_output(["git", "ls-files", "-z"]).decode("utf-8").split("\0")
|
|
violations = []
|
|
for name in filter(None, files):
|
|
path = Path(name)
|
|
if not path.is_file():
|
|
continue
|
|
if path.name.startswith(".env") and not path.name.endswith(".example"):
|
|
violations.append(f"{name}: tracked runtime environment")
|
|
if ".history" in path.parts:
|
|
violations.append(f"{name}: tracked editor history")
|
|
text = path.read_text(encoding="utf-8", errors="replace")
|
|
for rule, pattern in RULES.items():
|
|
for match in pattern.finditer(text):
|
|
line = text.count("\n", 0, match.start()) + 1
|
|
violations.append(f"{name}:{line}: {rule}")
|
|
for violation in violations:
|
|
print(violation)
|
|
if violations:
|
|
raise SystemExit(1)
|
|
print("Tracked secret scan passed")
|
|
|
|
|
|
if __name__ == "__main__":
|
|
main()
|