57 lines
1.7 KiB
Bash
57 lines
1.7 KiB
Bash
|
#!/usr/bin/env bash
|
||
|
|
# Fails the build if a production bundle contains anything that should only
|
||
|
|
# ever exist server-side.
|
||
|
|
#
|
||
|
|
# Why this exists: the storefront used to send provider payment credentials
|
||
|
|
# from the browser - an `authorization-key` header, a `userid-value` header,
|
||
|
|
# and a hardcoded partner ID literal compiled into the bundle. That code is
|
||
|
|
# gone (FH-1.3), and this check is what stops it coming back. A credential in
|
||
|
|
# a JS bundle is not a leak you can revoke quietly; it is published.
|
||
|
|
#
|
||
|
|
# Usage:
|
||
|
|
# npm run build && scripts/ci/scan-bundle.sh [dist-dir]
|
||
|
|
|
||
|
|
set -euo pipefail
|
||
|
|
|
||
|
|
DIST="${1:-dist}"
|
||
|
|
|
||
|
|
if [[ ! -d "$DIST" ]]; then
|
||
|
|
echo "scan-bundle: '$DIST' does not exist - build first" >&2
|
||
|
|
exit 2
|
||
|
|
fi
|
||
|
|
|
||
|
|
# Each entry is "label|extended-regex". Keep patterns specific: a pattern that
|
||
|
|
# fires on ordinary code trains people to ignore this check.
|
||
|
|
PATTERNS=(
|
||
|
|
"provider auth header|authorization-key"
|
||
|
|
"provider user header|userid-value"
|
||
|
|
"hardcoded partner id|web-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}"
|
||
|
|
"oauth client secret|client_secret[\"']?[[:space:]]*[:=]"
|
||
|
|
"private key block|BEGIN (RSA |EC |OPENSSH )?PRIVATE KEY"
|
||
|
|
"aws access key|AKIA[0-9A-Z]{16}"
|
||
|
|
"telegram bot token|[0-9]{8,10}:AA[0-9A-Za-z_-]{33}"
|
||
|
|
)
|
||
|
|
|
||
|
|
failed=0
|
||
|
|
|
||
|
|
for entry in "${PATTERNS[@]}"; do
|
||
|
|
label="${entry%%|*}"
|
||
|
|
pattern="${entry#*|}"
|
||
|
|
|
||
|
|
if matches="$(grep -rIlE "$pattern" "$DIST" 2>/dev/null)"; then
|
||
|
|
if [[ -n "$matches" ]]; then
|
||
|
|
echo "FAIL: $label found in the built bundle" >&2
|
||
|
|
echo "$matches" | sed 's/^/ /' >&2
|
||
|
|
failed=1
|
||
|
|
fi
|
||
|
|
fi
|
||
|
|
done
|
||
|
|
|
||
|
|
if [[ $failed -ne 0 ]]; then
|
||
|
|
echo >&2
|
||
|
|
echo "A credential reached the browser bundle. Move it behind the API." >&2
|
||
|
|
exit 1
|
||
|
|
fi
|
||
|
|
|
||
|
|
echo "scan-bundle: clean ($DIST)"
|