From ca9d210d8c7a83921cd79f154b82505bb93f0102 Mon Sep 17 00:00:00 2001 From: Doxa Maps Date: Wed, 30 Sep 2026 22:22:09 +0000 Subject: [PATCH] Universal-props gate: the planted token sample is assembled at runtime, not committed as a literal The TOK-LITERAL self-test planted a string shaped like a real Mapbox token, which is itself what the rule forbids and reads as a leaked credential to any secret scan. The sample is now built at runtime from plainly fake parts ('example', 'not-a-token') in the same pk. + base64url + tail shape, so the self-test still proves the rule fires, and no token-shaped literal is left in the tree. --- internal/check-universal-props.mjs | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/internal/check-universal-props.mjs b/internal/check-universal-props.mjs index 7ddfcc953..7d4dc4026 100644 --- a/internal/check-universal-props.mjs +++ b/internal/check-universal-props.mjs @@ -167,13 +167,18 @@ const run = (rule, src) => rule.test ? rule.test(src) : [...src.matchAll(rule.re const lineOf = (src, idx) => src.slice(0, idx).split('\n').length // ── self-test: every rule must see a planted violation ───────────────────────────────────────── +// The TOK-LITERAL sample is ASSEMBLED HERE, never written as one literal: a committed string shaped like a +// real Mapbox token is itself what that rule forbids, and reads as a leaked credential to any secret scan. +// It is plainly fake ('example, not a token'), yet shaped like one: pk. + base64url JSON + . + a tail, which +// is all the rule's regex looks for, so the self-test still proves the rule fires. +const FAKE_TOKEN = 'pk.' + Buffer.from('{"u":"example","note":"not-a-token"}').toString('base64url') + '.' + 'x'.repeat(22) const PLANTED = ` map.setStyle(isDark ? 'mapbox://styles/mapbox/dark-v11' : 'x') const m2 = new gl.Map({ container: el, style: 'mapbox://styles/mapbox/light-v11' }) const p = new mapboxgl.Popup() useMapInstance({ container: el, provider: 'mapbox' }) const tk = window.DOXA_TOKEN - const t = 'pk.eyJ1IjoiZXhhbXBsZSIsImEiOiJjbGFudGVkIn0' + const t = '${FAKE_TOKEN}' n.toLocaleString('en-US') const r = await fetch(base + '/api/people-groups/list?fields=slug') const dsm = new DataSourceManager({ locale: 'en' })