58 lines
1.9 KiB
JavaScript
58 lines
1.9 KiB
JavaScript
|
#!/usr/bin/env node
|
||
|
|
// ═══════════════════════════════════════════════════════════════════════════
|
||
|
|
// Vertical Slice: Secrets i kod blockeras (S-004) v2
|
||
|
|
// Med Policy Registry och Runtime Trace v2
|
||
|
|
// ═══════════════════════════════════════════════════════════════════════════
|
||
|
|
|
||
|
|
import { AgentRuntimeV3 } from './agent-runtime-v3.mjs';
|
||
|
|
|
||
|
|
/**
|
||
|
|
* EOS Policy för secrets med Policy Registry-integration
|
||
|
|
*/
|
||
|
|
function checkSecretsPolicy(task) {
|
||
|
|
const hasFiles = task.files && task.files.length > 0;
|
||
|
|
|
||
|
|
if (hasFiles) {
|
||
|
|
const secretPatterns = [
|
||
|
|
/password\s*[:=]\s*["'][^"']+["']/i,
|
||
|
|
/secret\s*[:=]\s*["'][^"']+["']/i,
|
||
|
|
/token\s*[:=]\s*["'][^"']+["']/i,
|
||
|
|
/api[_-]?key\s*[:=]\s*["'][^"']+["']/i,
|
||
|
|
/aws_access_key_id\s*[:=]\s*["'][^"']+["']/i,
|
||
|
|
/private[_-]?key/i,
|
||
|
|
/-----BEGIN\s+(RSA\s+)?PRIVATE\s+KEY-----/,
|
||
|
|
/AKIA[0-9A-Z]{16}/
|
||
|
|
];
|
||
|
|
|
||
|
|
for (const file of task.files) {
|
||
|
|
for (const pattern of secretPatterns) {
|
||
|
|
if (pattern.test(file.content)) {
|
||
|
|
return {
|
||
|
|
passed: false,
|
||
|
|
policyId: 'POL-SEC-002',
|
||
|
|
rule: 'no-hardcoded-secrets',
|
||
|
|
reason: `Hemlighet hittad i ${file.path} enligt EOS Policy POL-SEC-002`,
|
||
|
|
severity: 'CRITICAL',
|
||
|
|
action: 'STOP',
|
||
|
|
evidence: {
|
||
|
|
file: file.path,
|
||
|
|
pattern: pattern.toString()
|
||
|
|
}
|
||
|
|
};
|
||
|
|
}
|
||
|
|
}
|
||
|
|
}
|
||
|
|
}
|
||
|
|
|
||
|
|
return { passed: true };
|
||
|
|
}
|
||
|
|
|
||
|
|
class AgentRuntimeSecretsSliceV2 extends AgentRuntimeV3 {
|
||
|
|
constructor(task) {
|
||
|
|
super(task);
|
||
|
|
this.policies = [checkSecretsPolicy];
|
||
|
|
}
|
||
|
|
}
|
||
|
|
|
||
|
|
export { AgentRuntimeSecretsSliceV2, checkSecretsPolicy };
|