Repository navigation
Fix false secret matches in source maps - #655
Conversation
Decode embedded sources separately so escaped quotes cannot combine code into an opaque secret match. Preserve other fields and duplicate keys for scanning.
|
Docker image built, scanned, and smoke-tested in CI. The PR image is local to this run and is not published. |
Keep source contents separate without retaining every source in memory. Split tests to satisfy the standards gate.
|
Docker image built, scanned, and smoke-tested in CI. The PR image is local to this run and is not published. |
Continue scanning after non-string entries and avoid running credential patterns for strings too short to match.
|
Docker image built, scanned, and smoke-tested in CI. The PR image is local to this run and is not published. |
Report an incomplete check when a source map has too many entries, instead of allowing unbounded per-source work.
|
Docker image built, scanned, and smoke-tested in CI. The PR image is local to this run and is not published. |
Bound nested source-map work and report oversized maps. Keep partial findings in the security check and direct scan command.
|
Docker image built, scanned, and smoke-tested in CI. The PR image is local to this run and is not published. |
Report invalid maps as incomplete and preserve metadata findings when a source limit is reached.
|
Docker image built, scanned, and smoke-tested in CI. The PR image is local to this run and is not published. |
Report non-array source content as incomplete and scan decoded source text without treating it as metadata.
|
Docker image built, scanned, and smoke-tested in CI. The PR image is local to this run and is not published. |
Inspect decoded strings in malformed objects and retain detected credentials while marking the scan incomplete.
|
Docker image built, scanned, and smoke-tested in CI. The PR image is local to this run and is not published. |
Keep key-value context for opaque credentials while scanning decoded source strings separately.
|
Docker image built, scanned, and smoke-tested in CI. The PR image is local to this run and is not published. |
Inspect decoded text separately to avoid false positives and retain recognizable findings from incomplete maps.
|
Docker image built, scanned, and smoke-tested in CI. The PR image is local to this run and is not published. |
Avoid treating encoded code as a credential when a keyed value cannot be safely classified.
|
Docker image built, scanned, and smoke-tested in CI. The PR image is local to this run and is not published. |
Retain later findings and exclude incomplete test artifacts from the automatic bundle check.
|
Docker image built, scanned, and smoke-tested in CI. The PR image is local to this run and is not published. |
Apply the test-artifact exclusion to the source maps of compiled tests and specs.
|
Docker image built, scanned, and smoke-tested in CI. The PR image is local to this run and is not published. |
Report scan coverage and confirmed findings separately across CLI, JSON, handoff, and scan comparisons. Keep scanner tests within project gates.
|
Docker image built, scanned, and smoke-tested in CI. The PR image is local to this run and is not published. |
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
Exclude test artifacts by default in the direct scan and allow explicit inclusion. Verify the compiled flag surface.
|
Docker image built, scanned, and smoke-tested in CI. The PR image is local to this run and is not published. |
Detect provider credentials in unfinished JSON strings and treat newly confirmed findings as regressions.
|
Docker image built, scanned, and smoke-tested in CI. The PR image is local to this run and is not published. |
Limit raw fallback to safe credential patterns and avoid counting the same decoded finding twice.
Read string tokens in one pass so unfinished escaped strings cannot stall the build scan.
|
Docker image built, scanned, and smoke-tested in CI. The PR image is local to this run and is not published. |
Decode a valid partial JSON string to retain credential findings, and document the test exclusion scope.
|
Docker image built, scanned, and smoke-tested in CI. The PR image is local to this run and is not published. |
Retain findings before a dangling backslash in an unfinished source-map string.
|
Docker image built, scanned, and smoke-tested in CI. The PR image is local to this run and is not published. |
Distinguish the string-token limit from the number of source entries.
|
Docker image built, scanned, and smoke-tested in CI. The PR image is local to this run and is not published. |
|
Docker image built, scanned, and smoke-tested in CI. The PR image is local to this run and is not published. |
Only treat a new finding as a regression after an incomplete scan, not an ordinary skipped check.
|
Docker image built, scanned, and smoke-tested in CI. The PR image is local to this run and is not published. |
Use a private temporary directory for CI fixtures and separate invalid map reporting from the main scan.
|
Docker image built, scanned, and smoke-tested in CI. The PR image is local to this run and is not published. |
|
Docker image built, scanned, and smoke-tested in CI. The PR image is local to this run and is not published. |
{
"schema": "kit-independent-review/v1",
"repository": "sandstream/kit",
"pull_request": 655,
"base_branch": "main",
"base_tip": "e0317417a862e696b3ce14f5704a298584526c2c",
"base": "58cdbb6d3bc4249a21d5246f31ed2f5f6abc9524",
"head": "71b44ea105747fec78d43af1d544af6b9c2064bc",
"verdict": "pass",
"checks": [
{"area":"correctness","status":"pass","evidence":"Reviewed source-map parsing, incomplete results, test exclusions, and the direct command. The current merge tree retains both documentation changes."},
{"area":"security","status":"pass","evidence":"Isolated tests covered credential findings, incomplete scans, malformed source maps, limits, and test artifacts. Existing non-map and traversal limits are documented."},
{"area":"tests","status":"pass","evidence":"The reviewer ran 144 targeted tests on the merged tree in a network-disabled container. GitHub build-and-test succeeded on the same merged tree, including the full test suite and command contract."},
{"area":"public-hygiene","status":"pass","evidence":"The clean checkout passed git diff --check. GitHub Gitleaks succeeded on the reviewed head."},
{"area":"adr","status":"pass","evidence":"The isolated merged-tree ADR gate checked 8 decisions, including 4 enforced decisions, with no violations or gaps. The GitHub ADR gate also passed."}
],
"limits": [],
"findings": []
} |
Problem
The built-output secret scan can treat escaped source-map code as one opaque credential. This causes a false failure on a generated SvelteKit server source map.
Change
Scan each decoded source-map source separately. Preserve duplicate fields and decode metadata for the scan. Invalid maps, ambiguous keyed values, source maps over 5 MiB, maps with more than 100,000 source entries or string tokens, and maps with excessive nesting produce an explicit incomplete result. The scan retains credentials found before it reached a limit. The command, check summary, JSON output, handoff and scan comparison distinguish an incomplete scan from a confirmed finding.
The direct build scan excludes known test artifact paths, matching the automatic check. Use
--include-teststo include them. The documented path rules do not exclude directories namedtestortests.Existing limits: oversized or unreadable build artifacts other than source maps can still be skipped without an incomplete result. Directory read failures and files beyond the traversal limit can also go unreported. This change does not address those behaviors.
Validation
This changes a security check. Human review is required before merge.