mirror of
https://github.com/affaan-m/ECC.git
synced 2026-10-14 20:25:26 +02:00
haelyra
fb1429a08c
Also reject scanner errors, terminate regex options, match actual private-key headers, and verify actual rg invocation and findings.
90 lines
2.8 KiB
Bash
90 lines
2.8 KiB
Bash
#!/usr/bin/env bash
|
|
set -euo pipefail
|
|
|
|
# ECC Codex Git Hook: pre-commit
|
|
# Blocks commits that add high-signal secrets.
|
|
|
|
if [[ "${ECC_SKIP_GIT_HOOKS:-0}" == "1" || "${ECC_SKIP_PRECOMMIT:-0}" == "1" ]]; then
|
|
printf '[ECC pre-commit] WARNING: hook bypassed via env (ECC_SKIP_*=1)\n' >&2
|
|
exit 0
|
|
fi
|
|
|
|
# NOTE: file-based disables (.ecc-hooks-disable) were removed — a malicious
|
|
# repo could ship that file and silently turn off secret scanning exactly
|
|
# where it is most needed. Use the env bypass above (audible warning) instead.
|
|
|
|
if ! git rev-parse --is-inside-work-tree >/dev/null 2>&1; then
|
|
exit 0
|
|
fi
|
|
|
|
staged_files="$(git diff --cached --name-only --diff-filter=ACMR || true)"
|
|
if [[ -z "$staged_files" ]]; then
|
|
exit 0
|
|
fi
|
|
|
|
has_findings=0
|
|
|
|
scan_added_lines() {
|
|
local file="$1"
|
|
local name="$2"
|
|
local regex="$3"
|
|
local added_lines
|
|
local hits
|
|
|
|
added_lines="$(git diff --cached -U0 -- "$file" | awk '/^\+\+\+ /{next} /^\+/{print substr($0,2)}')"
|
|
if [[ -z "$added_lines" ]]; then
|
|
return 0
|
|
fi
|
|
|
|
if ! command -v rg >/dev/null 2>&1; then
|
|
printf '[ECC pre-commit] ripgrep (rg) is required for secret scanning; install it and ensure it is on PATH when Git runs the hook.\n' >&2
|
|
exit 1
|
|
fi
|
|
|
|
if hits="$(printf '%s\n' "$added_lines" | rg -n --pcre2 -- "$regex" 2>/dev/null)"; then
|
|
printf '\n[ECC pre-commit] Potential secret detected (%s) in %s\n' "$name" "$file" >&2
|
|
printf '%s\n' "$hits" | head -n 3 >&2
|
|
has_findings=1
|
|
else
|
|
local scan_status=$?
|
|
if [[ "$scan_status" -ne 1 ]]; then
|
|
printf '[ECC pre-commit] Secret scanner failed (rg exit %s) for %s; commit blocked because scanning could not complete.\n' "$scan_status" "$file" >&2
|
|
exit 1
|
|
fi
|
|
fi
|
|
}
|
|
|
|
while IFS= read -r file; do
|
|
[[ -z "$file" ]] && continue
|
|
|
|
case "$file" in
|
|
*.png|*.jpg|*.jpeg|*.gif|*.svg|*.pdf|*.zip|*.gz|*.lock|pnpm-lock.yaml|package-lock.json|yarn.lock|bun.lockb)
|
|
continue
|
|
;;
|
|
esac
|
|
|
|
scan_added_lines "$file" "OpenAI key" 'sk-[A-Za-z0-9]{20,}'
|
|
scan_added_lines "$file" "GitHub classic token" 'ghp_[A-Za-z0-9]{36}'
|
|
scan_added_lines "$file" "GitHub fine-grained token" 'github_pat_[A-Za-z0-9_]{20,}'
|
|
scan_added_lines "$file" "AWS access key" 'AKIA[0-9A-Z]{16}'
|
|
scan_added_lines "$file" "private key block" '-----BEGIN (RSA |EC |OPENSSH |DSA |ENCRYPTED )?PRIVATE KEY-----'
|
|
scan_added_lines "$file" "generic credential assignment" "(?i)\\b(api[_-]?key|secret|password|token)\\b\\s*[:=]\\s*['\\\"][^'\\\"]{12,}['\\\"]"
|
|
done <<< "$staged_files"
|
|
|
|
if [[ "$has_findings" -eq 1 ]]; then
|
|
cat >&2 <<'EOF'
|
|
|
|
[ECC pre-commit] Commit blocked to prevent secret leakage.
|
|
Fix:
|
|
1) Remove secrets from staged changes.
|
|
2) Move secrets to env vars or secret manager.
|
|
3) Re-stage and commit again.
|
|
|
|
Temporary bypass (not recommended):
|
|
ECC_SKIP_PRECOMMIT=1 git commit ...
|
|
EOF
|
|
exit 1
|
|
fi
|
|
|
|
exit 0
|