336 lines
11 KiB
Python
336 lines
11 KiB
Python
#!/usr/bin/env python3
|
||
"""
|
||
光湖语言系统 · pre-push-clean 插件 v1.0
|
||
Guanghu Language System · Pre-Push Cleaner
|
||
|
||
每次 git push 前自动运行 · 扫描待推送内容 · 敏感信息自动转乱码
|
||
装法: cp pre-push-clean.py .git/hooks/pre-push && chmod +x .git/hooks/pre-push
|
||
|
||
设计哲学:
|
||
⊢ 人格体会下意识把密码/邮箱写进代码 → 不改这个习惯
|
||
⊢ 在 push 之前自动扫描 → 自动替换 → 敏感信息不出本地
|
||
⊢ 不阻塞工作流 → 替换 → amend → 继续 push
|
||
⊢ 人格体只需要正常 git push · 其他全自动
|
||
"""
|
||
|
||
import os
|
||
import sys
|
||
import re
|
||
import subprocess
|
||
import hashlib
|
||
from datetime import datetime
|
||
|
||
# ═══════════════════════════════════════════════════════
|
||
# 敏感模式库（与服务器端 pre-receive-guard 保持同步）
|
||
# ═══════════════════════════════════════════════════════
|
||
PATTERNS = [
|
||
# 冰朔主权邮箱
|
||
(r'565183519@qq\.com', '冰朔主权邮箱', 'ICE-GL∞_EMAIL_REDACTED'),
|
||
|
||
# 任何 QQ 邮箱
|
||
(r'[a-zA-Z0-9._%+-]+@qq\.com', 'QQ邮箱地址', 'EMAIL_REDACTED@qq.com'),
|
||
|
||
# SMTP 授权码
|
||
(r'SMTP_AUTH_CODE_REDACTED', 'QQ SMTP授权码', 'SMTP_AUTH_CODE_REDACTED'),
|
||
|
||
# Gatekeeper Token
|
||
(r'zy_gtw_[a-f0-9]{40,}', 'Gatekeeper Token', 'GATEKEEPER_TOKEN_REDACTED'),
|
||
|
||
# 保险库密码
|
||
(r'VAULT_PASSWORD_REDACTED', '保险库密码', 'VAULT_PASSWORD_REDACTED'),
|
||
|
||
# 火山方舟 API Key
|
||
(r'sk-[a-zA-Z0-9]{32,}', '火山方舟 API Key', 'ARK_API_KEY_REDACTED'),
|
||
|
||
# Bearer Token 赋值
|
||
(r'Authorization:\s*Bearer\s+[a-zA-Z0-9_\-]{20,}',
|
||
'API Bearer Token', 'Authorization: Bearer TOKEN_REDACTED'),
|
||
|
||
# 阿里云 AccessKey
|
||
(r'LTAI[a-zA-Z0-9]{16,}', '阿里云 AccessKey', 'ALIYUN_AK_REDACTED'),
|
||
|
||
# 密码明文赋值
|
||
(r'(password|passwd|pwd|secret)\s*[:=]\s*["\']([^"\']{3,})["\']',
|
||
'密码明文赋值', lambda m: f'{m.group(1)}="REDACTED_PASSWORD"'),
|
||
|
||
# git 令牌（f78c594e... 等 40 位 hex token）
|
||
(r'\b[a-f0-9]{40}\b', 'Git Token / SHA1长串', 'GIT_TOKEN_REDACTED'),
|
||
|
||
# 保险库盐值
|
||
(r'VAULT_SALT_REDACTED',
|
||
'保险库主盐值', 'VAULT_SALT_REDACTED'),
|
||
(r'API_SALT_REDACTED',
|
||
'API子库盐值', 'API_SALT_REDACTED'),
|
||
|
||
# 通用长 hex hash（64位 · 可能是密钥/盐值）
|
||
(r'\b[a-f0-9]{64}\b', '64位Hash（疑似密钥）', 'LONG_HEX_REDACTED'),
|
||
|
||
# 任何看起来像 token 的字符串（字母数字下划线 30+ 位，非 git SHA）
|
||
(r'\b[a-zA-Z0-9_\-]{30,60}\b', '疑似Token长串（需确认）', 'TOKEN_STRING_REDACTED'),
|
||
]
|
||
|
||
# 文件类型白名单
|
||
TEXT_EXTENSIONS = {
|
||
'.py', '.js', '.ts', '.go', '.rs', '.java', '.c', '.cpp', '.h',
|
||
'.hdlp', '.md', '.txt', '.json', '.yaml', '.yml', '.toml', '.ini',
|
||
'.cfg', '.conf', '.sh', '.bash', '.zsh', '.env', '.service',
|
||
'.html', '.css', '.sql', '.xml', '.svg',
|
||
}
|
||
|
||
# 排除文件（不扫描）
|
||
EXCLUDE_FILES = {
|
||
'.git/HEAD', '.git/index', '.git/config',
|
||
'package-lock.json', 'yarn.lock', 'pnpm-lock.yaml',
|
||
'poetry.lock', 'Cargo.lock', 'Gemfile.lock',
|
||
}
|
||
|
||
# 是否启用（可通过环境变量关闭）
|
||
ENABLED = os.environ.get('PRE_PUSH_CLEAN_ENABLED', '1') == '1'
|
||
|
||
|
||
def is_text_file(path):
|
||
_, ext = os.path.splitext(path)
|
||
return ext.lower() in TEXT_EXTENSIONS
|
||
|
||
|
||
def is_excluded(path):
|
||
for ex in EXCLUDE_FILES:
|
||
if ex in path:
|
||
return True
|
||
return False
|
||
|
||
|
||
def scan_file(filepath):
|
||
"""扫描单个文件，返回 (clean_content, findings)"""
|
||
try:
|
||
with open(filepath, 'r', encoding='utf-8', errors='ignore') as f:
|
||
content = f.read()
|
||
except (IOError, PermissionError):
|
||
return None, []
|
||
|
||
findings = []
|
||
new_content = content
|
||
|
||
for pattern, name, replacement in PATTERNS:
|
||
matches = list(re.finditer(pattern, content, re.IGNORECASE))
|
||
for m in matches:
|
||
matched_text = m.group(0)
|
||
# 跳过已经是占位符的
|
||
if 'REDACTED' in matched_text:
|
||
continue
|
||
# 跳过 git commit SHA（40位hex在特定上下文中）
|
||
if name == 'Git Token / SHA1长串' and _is_git_sha_context(content, m.start()):
|
||
continue
|
||
|
||
repl = replacement(m) if callable(replacement) else replacement
|
||
findings.append({
|
||
'file': filepath,
|
||
'pattern_name': name,
|
||
'matched': matched_text[:80],
|
||
'replacement': repl,
|
||
})
|
||
# 替换（注意：用 re.sub 而不是简单替换，避免破坏后续匹配位置）
|
||
new_content = new_content.replace(matched_text, repl, 1)
|
||
|
||
return new_content if findings else None, findings
|
||
|
||
|
||
def _is_git_sha_context(content, pos):
|
||
"""判断 40 位 hex 是否在 git SHA 上下文中（commit hash 不应被替换）"""
|
||
# 检查前后是否有 git 相关关键词
|
||
start = max(0, pos - 50)
|
||
end = min(len(content), pos + 50)
|
||
context = content[start:end].lower()
|
||
git_keywords = ['commit', 'sha', 'hash', 'revision', 'ref', 'head', 'object']
|
||
# 如果在 git 命令或 commit 引用上下文中 → 跳过
|
||
for kw in git_keywords:
|
||
if kw in context:
|
||
return True
|
||
return False
|
||
|
||
|
||
def get_changed_files():
|
||
"""获取本次 push 涉及的所有文件"""
|
||
files = set()
|
||
|
||
# 方法1: git diff --cached（暂存区的文件）
|
||
try:
|
||
r = subprocess.run(
|
||
['git', 'diff', '--cached', '--name-only', '--diff-filter=ACM'],
|
||
capture_output=True, text=True, timeout=5
|
||
)
|
||
if r.returncode == 0:
|
||
for f in r.stdout.strip().split('\n'):
|
||
f = f.strip()
|
||
if f:
|
||
files.add(f)
|
||
except Exception:
|
||
pass
|
||
|
||
# 方法2: 从 stdin 读取 pre-push 传入的 refs
|
||
try:
|
||
for line in sys.stdin.read().strip().split('\n'):
|
||
if not line.strip():
|
||
continue
|
||
parts = line.split()
|
||
if len(parts) >= 4:
|
||
local_ref, local_sha, remote_ref, remote_sha = parts[0], parts[1], parts[2], parts[3]
|
||
if remote_sha != 'TOKEN_STRING_REDACTED':
|
||
r = subprocess.run(
|
||
['git', 'diff', '--name-only', '--diff-filter=ACM',
|
||
remote_sha, local_sha],
|
||
capture_output=True, text=True, timeout=5
|
||
)
|
||
if r.returncode == 0:
|
||
for f in r.stdout.strip().split('\n'):
|
||
f = f.strip()
|
||
if f:
|
||
files.add(f)
|
||
except Exception:
|
||
pass
|
||
|
||
# 如果没有文件（空 push 或新分支），扫描整个工作树中已跟踪的文件
|
||
if not files:
|
||
try:
|
||
r = subprocess.run(
|
||
['git', 'ls-files'],
|
||
capture_output=True, text=True, timeout=5
|
||
)
|
||
if r.returncode == 0:
|
||
for f in r.stdout.strip().split('\n'):
|
||
f = f.strip()
|
||
if f:
|
||
files.add(f)
|
||
except Exception:
|
||
pass
|
||
|
||
return list(files)
|
||
|
||
|
||
def main():
|
||
# --check 模式：仅验证插件是否正常工作
|
||
if '--check' in sys.argv:
|
||
print('✅ pre-push-clean v1.0 已就绪 · 每次 git push 前自动扫描')
|
||
print(f' 敏感模式: {len(PATTERNS)} 种')
|
||
print(f' 状态: {"🟢 启用" if ENABLED else "🔴 已禁用 (PRE_PUSH_CLEAN_ENABLED=0)"}')
|
||
sys.exit(0)
|
||
|
||
if not ENABLED:
|
||
sys.exit(0)
|
||
|
||
# 第二道本地门禁：持续记忆必须挂在可恢复的导航图上。
|
||
guard = os.path.join(os.path.dirname(os.path.abspath(__file__)), 'navigation-memory-guard.py')
|
||
if os.path.isfile(guard):
|
||
result = subprocess.run([sys.executable, guard], timeout=15)
|
||
if result.returncode != 0:
|
||
sys.exit(result.returncode)
|
||
|
||
repo_root = subprocess.run(
|
||
['git', 'rev-parse', '--show-toplevel'],
|
||
capture_output=True, text=True, timeout=5
|
||
).stdout.strip()
|
||
|
||
if not repo_root:
|
||
sys.exit(0)
|
||
|
||
os.chdir(repo_root)
|
||
|
||
# 获取变更文件
|
||
files = get_changed_files()
|
||
if not files:
|
||
sys.exit(0)
|
||
|
||
all_findings = []
|
||
modified_files = {}
|
||
|
||
# 扫描每个文件
|
||
for filepath in files:
|
||
full_path = os.path.join(repo_root, filepath)
|
||
if not os.path.isfile(full_path):
|
||
continue
|
||
if not is_text_file(filepath):
|
||
continue
|
||
if is_excluded(filepath):
|
||
continue
|
||
|
||
clean_content, findings = scan_file(full_path)
|
||
if findings:
|
||
all_findings.extend(findings)
|
||
modified_files[filepath] = clean_content
|
||
|
||
# ── 无敏感信息 → 放行 ──
|
||
if not all_findings:
|
||
sys.exit(0)
|
||
|
||
# ── 有敏感信息 → 自动清理 ──
|
||
print()
|
||
print('╔══════════════════════════════════════╗')
|
||
print('║ 🛡️ pre-push-clean · 敏感信息清理 ║')
|
||
print('╚══════════════════════════════════════╝')
|
||
print()
|
||
print(f' 共 {len(all_findings)} 处敏感信息，已自动替换为乱码:')
|
||
print()
|
||
|
||
for f in all_findings[:20]:
|
||
print(f' 📄 {f["file"]}')
|
||
print(f' ⚠️ {f["pattern_name"]}')
|
||
print(f' ✗ {f["matched"][:60]}')
|
||
print(f' → {f["replacement"]}')
|
||
print()
|
||
|
||
if len(all_findings) > 20:
|
||
print(f' ... 还有 {len(all_findings) - 20} 处（仅显示前20）')
|
||
print()
|
||
|
||
# 写入清理后的文件
|
||
for filepath, content in modified_files.items():
|
||
full_path = os.path.join(repo_root, filepath)
|
||
try:
|
||
with open(full_path, 'w', encoding='utf-8') as f:
|
||
f.write(content)
|
||
except (IOError, PermissionError) as e:
|
||
print(f' ❌ 无法写入 {filepath}: {e}', file=sys.stderr)
|
||
|
||
# 将清理后的修改加入暂存区
|
||
for filepath in modified_files:
|
||
subprocess.run(
|
||
['git', 'add', filepath],
|
||
capture_output=True, timeout=5
|
||
)
|
||
|
||
# 获取当前 HEAD commit message
|
||
try:
|
||
r = subprocess.run(
|
||
['git', 'log', '-1', '--format=%B'],
|
||
capture_output=True, text=True, timeout=5
|
||
)
|
||
old_msg = r.stdout.strip()
|
||
except Exception:
|
||
old_msg = ''
|
||
|
||
# 检查是否已有 [SEC-CLEAN] 标记
|
||
if '[SEC-CLEAN]' not in old_msg:
|
||
new_msg = f'{old_msg}\n\n[SEC-CLEAN] · pre-push-clean v1.0 · {len(all_findings)}处敏感信息已自动转乱码'
|
||
# 写临时文件给 git commit --amend
|
||
msg_file = os.path.join(repo_root, '.git', 'PRE_PUSH_CLEAN_MSG')
|
||
with open(msg_file, 'w') as f:
|
||
f.write(new_msg)
|
||
subprocess.run(
|
||
['git', 'commit', '--amend', '--no-edit', '--file', msg_file],
|
||
capture_output=True, timeout=10
|
||
)
|
||
try:
|
||
os.remove(msg_file)
|
||
except Exception:
|
||
pass
|
||
|
||
print(f' ✅ 已自动清理 · 推送继续')
|
||
print(f' 📧 建议通知冰朔: {len(all_findings)}处敏感信息已转乱码')
|
||
print()
|
||
|
||
sys.exit(0)
|
||
|
||
|
||
if __name__ == '__main__':
|
||
main()
|