@flamesshield/rules-engine
Version:
Independent rules engine for security analysis of Firebase
63 lines • 2.38 kB
JavaScript
export class FunctionsEnvSecretsScanner {
constructor(functions, ignoredEnvironmentVariables = []) {
this.functions = functions.map(func => ({ ...func, id: func.name }));
this.ignoredEnvironmentVariables = ignoredEnvironmentVariables;
}
scanForSecrets(functionData) {
let secretsCount = 0;
for (const [key, value] of Object.entries(functionData.environment_variables)) {
const isIgnored = this.ignoredEnvironmentVariables.some(ignored => ignored.function_name === functionData.name &&
ignored.environment_variable === key);
if (!isIgnored) {
// Basic secret detection patterns (can be enhanced with secretlint later)
if (this.containsSecret(value)) {
secretsCount++;
}
}
}
return { secretsCount };
}
containsSecret(value) {
// Basic patterns for common secrets
const secretPatterns = [
/aws_access_key_id/i,
/aws_secret_access_key/i,
/api[_-]?key/i,
/secret[_-]?key/i,
/password/i,
/token/i,
/private[_-]?key/i,
/AKIA[0-9A-Z]{16}/, // AWS Access Key
/sk-[a-zA-Z0-9]{48}/, // OpenAI API Key
/ghp_[a-zA-Z0-9]{36}/, // GitHub Personal Access Token
/xoxb-[0-9]{11,12}-[0-9]{11,12}-[0-9a-zA-Z]{24}/, // Slack Bot Token
/ya29\.[0-9A-Za-z\-_]+/, // Google OAuth2 Token
];
return secretPatterns.some(pattern => pattern.test(value));
}
scan() {
const results = [];
for (const functionData of this.functions) {
const result = this.scanForSecrets(functionData);
results.push({
id: functionData.id,
secretsCount: result.secretsCount
});
}
return results;
}
}
/**
* Create a secrets scanner for Firebase functions
*/
export function createSecretsScanner(functions, ignoredVars = []) {
return new FunctionsEnvSecretsScanner(functions, ignoredVars);
}
/**
* Scan functions for secrets in environment variables
*/
export function scanFunctionsForSecrets(functions, ignoredVars = []) {
const scanner = createSecretsScanner(functions, ignoredVars);
return scanner.scan();
}
//# sourceMappingURL=index.js.map