DeCentN2Madness/aia-website
1
0 Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix(deploy): avoid source guard self-match

Browse Source
This commit is contained in:
DeCentN2Madness committed 2026-11-05 13:29:38 -07:00
1 parent 81492125f4
commit 475dd3379b
2 files changed
+4 -2
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

www/tools/deploy.mjs
+3 -1
View File
@@ -69,7 +69,9 @@ export async function releaseManifest(dist, sourceCommit) {
} }
publicPath(child); publicPath(child);
const bytes = await fs.readFile(path.join(dist, child)); const bytes = await fs.readFile(path.join(dist, child));
if (bytes.includes(Buffer.from('PRIVATE KEY-----'))) fail(`Private-key material in artifact: ${child}`); // Build the sentinel in memory so this guardrail can itself be included in
// the server-validated source snapshot without looking like a PEM body.
if (bytes.includes(Buffer.from(['PRIVATE', ' KEY-----'].join('')))) fail(`Private-key material in artifact: ${child}`);
files[child] = { sha256: sha256(bytes), size: bytes.length }; files[child] = { sha256: sha256(bytes), size: bytes.length };
} }
} }
www/tools/phase10-artifact-verify.mjs
+1 -1
View File
@@ -92,7 +92,7 @@ function unsafeSignals(html, allowApprovedFormA = false) {
if (/<script\b[^>]*\bsrc=["'][^"']*(?:jotform|googletagmanager|google-analytics|doubleclick)/i.test(html)) signals.push('active vendor tracking/form script'); if (/<script\b[^>]*\bsrc=["'][^"']*(?:jotform|googletagmanager|google-analytics|doubleclick)/i.test(html)) signals.push('active vendor tracking/form script');
if (!allowApprovedFormA && /data-(?:form|forms)-mode=["']live["']/i.test(html)) signals.push('live form mode'); if (!allowApprovedFormA && /data-(?:form|forms)-mode=["']live["']/i.test(html)) signals.push('live form mode');
if (/api\.azinstitute4autism\.com/i.test(html)) signals.push('production API origin'); if (/api\.azinstitute4autism\.com/i.test(html)) signals.push('production API origin');
if (/AIza[0-9A-Za-z_-]{20,}|-----BEGIN (?:RSA|OPENSSH|EC) PRIVATE KEY-----|(?:api[_-]?key|secret|password)\s*[:=]/i.test(html)) signals.push('credential-like content'); if (/AIza[0-9A-Za-z_-]{20,}|-----BEGIN (?:RSA|OPENSSH|EC) PRIVATE\sKEY-----|(?:api[_-]?key|secret|password)\s*[:=]/i.test(html)) signals.push('credential-like content');
return signals; return signals;
} }