83 lines
3.0 KiB
Python
Executable File
83 lines
3.0 KiB
Python
Executable File
#!/usr/bin/env python3
|
||
"""轻量、零依赖的 Git 暂存/推送密钥扫描器。"""
|
||
from __future__ import annotations
|
||
|
||
import argparse
|
||
import os
|
||
import re
|
||
import subprocess
|
||
import sys
|
||
from pathlib import Path
|
||
|
||
FORBIDDEN_PATH = re.compile(
|
||
r"(^|/)(\.env(?:\..*)?|secrets?/|.*\.(?:pem|key|p12|pfx))$", re.I
|
||
)
|
||
ASSIGNMENT = re.compile(
|
||
r"\b(?:[A-Z][A-Z0-9_]*(?:API_KEY|TOKEN|SECRET|PASSWORD|PRIVATE_KEY|ACCESS_KEY|CLIENT_SECRET)|"
|
||
r"(?:api[_-]?key|token|secret|password|private[_-]?key|access[_-]?key|client[_-]?secret))"
|
||
r"\s*[:=]\s*['\"]([^'\"\r\n]{16,})['\"]",
|
||
re.I,
|
||
)
|
||
BEARER = re.compile(r"\bBearer\s+([A-Za-z0-9_\-]{20,})", re.I)
|
||
PROVIDER = re.compile(r"\b(?:sk|rk|ghp|github_pat|AIza)[A-Za-z0-9_\-]{16,}\b", re.I)
|
||
PLACEHOLDER = re.compile(r"(?:^|[^a-z])(xxx|example|your[_-]?|replace|changeme|dummy|redacted|<[^>]+>|\.\.\.)(?:$|[^a-z])", re.I)
|
||
|
||
|
||
def run_git(*args: str) -> bytes:
|
||
return subprocess.check_output(["git", *args])
|
||
|
||
|
||
def looks_real(value: str) -> bool:
|
||
return not PLACEHOLDER.search(value)
|
||
|
||
|
||
def scan_text(text: str) -> list[tuple[int, str]]:
|
||
hits: list[tuple[int, str]] = []
|
||
for line_no, line in enumerate(text.splitlines(), 1):
|
||
if not line.startswith("+") or line.startswith("+++"):
|
||
continue
|
||
for pattern, kind in ((ASSIGNMENT, "疑似明文密钥赋值"), (BEARER, "疑似 Bearer 令牌"), (PROVIDER, "疑似服务商令牌")):
|
||
for match in pattern.finditer(line):
|
||
value = match.group(1) if match.lastindex else match.group(0)
|
||
if looks_real(value):
|
||
hits.append((line_no, kind))
|
||
break
|
||
return hits
|
||
|
||
|
||
def main() -> int:
|
||
os.chdir(Path(__file__).resolve().parents[1])
|
||
parser = argparse.ArgumentParser()
|
||
parser.add_argument("--staged", action="store_true")
|
||
parser.add_argument("--range")
|
||
args = parser.parse_args()
|
||
|
||
if args.staged:
|
||
raw_names = run_git("diff", "--staged", "--name-only", "-z")
|
||
names = [n.decode("utf-8", "replace") for n in raw_names.split(b"\0") if n]
|
||
patch = run_git("diff", "--staged", "--no-ext-diff", "--unified=0").decode("utf-8", "replace")
|
||
elif args.range:
|
||
names = run_git("diff", "--name-only", args.range).decode("utf-8", "replace").splitlines()
|
||
patch = run_git("diff", "--no-ext-diff", "--unified=0", args.range).decode("utf-8", "replace")
|
||
else:
|
||
parser.error("choose --staged or --range")
|
||
|
||
failures = []
|
||
for name in names:
|
||
if FORBIDDEN_PATH.search(name):
|
||
failures.append(f"禁止提交本地密钥路径: {name}")
|
||
for line_no, kind in scan_text(patch):
|
||
failures.append(f"{kind}（补丁行 {line_no}）")
|
||
|
||
if failures:
|
||
print("\n密钥保护已阻止本次 Git 操作：", file=sys.stderr)
|
||
for failure in failures:
|
||
print(f"- {failure}", file=sys.stderr)
|
||
print("移除密钥，改用苍耳本机仓库外的环境变量/密钥文件后再试。", file=sys.stderr)
|
||
return 1
|
||
return 0
|
||
|
||
|
||
if __name__ == "__main__":
|
||
raise SystemExit(main())
|