forked from Gitlink/gitlink-cli
59 lines
3.5 KiB
Go
59 lines
3.5 KiB
Go
package compliance
|
|
|
|
import "regexp"
|
|
|
|
// allRules returns the complete set of scan rules grouped by module.
|
|
func allRules() map[string][]scanRule {
|
|
return map[string][]scanRule{
|
|
"secrets": secretRules(),
|
|
"exposure": exposureRules(),
|
|
"vocab": vocabRules(),
|
|
}
|
|
}
|
|
|
|
func compileRE(expr string) *regexp.Regexp {
|
|
return regexp.MustCompile(expr)
|
|
}
|
|
|
|
// ----- secrets (S-001 ~ S-010) -----
|
|
func secretRules() []scanRule {
|
|
return []scanRule{
|
|
{SID("001"), "high", compileRE(`(?i)access_token|private_token`), "Token 作为 URL 查询参数泄露风险", nil},
|
|
{SID("002"), "critical", compileRE(`(?i)password\s*[:=]\s*"[^"]+"`), "硬编码密码", nil},
|
|
{SID("003"), "critical", compileRE(`(?i)api[_-]?key\s*[:=]\s*"[a-zA-Z0-9_-]{8,}"`), "硬编码 API Key", nil},
|
|
{SID("004"), "critical", compileRE(`BEGIN.*PRIVATE KEY`), "私钥文件内容", []string{"*"}},
|
|
{SID("005"), "high", compileRE(`token\s*[:=]\s*"[A-Za-z0-9+/=_-]{32,}"`), "长 Token 硬编码", nil},
|
|
{SID("006"), "high", compileRE(`(?i)secret\s*[:=]\s*"[^"]{8,}"`), "Secret 硬编码", nil},
|
|
{SID("008"), "medium", compileRE(`(?i)(fmt|log)\.(Print|Debug|Info).*[Tt]oken`), "Debug 输出可能泄露 Token", []string{"*.go"}},
|
|
{SID("010"), "high", compileRE(`(?i)(mongodb|mysql|postgres|redis)://[^@]*@`), "数据库连接串含凭据", nil},
|
|
}
|
|
}
|
|
|
|
// ----- exposure (P-001 ~ E-005) -----
|
|
func exposureRules() []scanRule {
|
|
return []scanRule{
|
|
{PID("001"), "low", compileRE(`[a-zA-Z0-9._%+-]+@[a-zA-Z0-9.-]+\.[a-zA-Z]{2,}`), "邮箱地址泄露", nil},
|
|
{PID("002"), "low", compileRE(`\b1[3-9]\d{9}\b`), "手机号泄露", nil},
|
|
{EID("001"), "medium", compileRE(`\b(10\.\d+\.\d+\.\d+|172\.(1[6-9]|2\d|3[01])\.\d+\.\d+|192\.168\.\d+\.\d+)\b`), "内网 IP 暴露", nil},
|
|
{EID("002"), "low", compileRE(`(localhost|127\.0\.0\.1):\d+`), "本地开发地址残留", nil},
|
|
{EID("003"), "low", compileRE(`\b\w+\.(local|internal|test)\b`), "内部域名暴露", nil},
|
|
}
|
|
}
|
|
|
|
// ----- vocab (C-001 ~ C-006) -----
|
|
func vocabRules() []scanRule {
|
|
return []scanRule{
|
|
{CID("001"), "high", compileRE(`军|部队|军区|武装|国防|武器|弹药|导弹|雷达|舰艇|战机|潜艇|航母|核武器|火箭军|军事基地|作战指挥|军事演习|战备|动员令|驻地|番号`), "军事相关敏感词汇", nil},
|
|
{CID("002"), "high", compileRE(`中央委员会|国务院|中央军委|部委|党政机关|机要局|保密局|国家安全|公安内网|政务内网|红头文件|绝密|机密文件|内参|机要文件`), "党政机关敏感词汇", nil},
|
|
{CID("003"), "medium", compileRE(`内部系统|内部平台|内网地址|专网|涉密|非密|脱密|密码机|加密机|堡垒机|入侵检测|安全监测`), "内部系统标识泄露", nil},
|
|
{CID("004"), "medium", compileRE(`反洗钱|征信系统|个人隐私数据|数据出境|跨境传输|敏感个人信息|涉密数据|关键信息基础设施|网络安全等级|等保|密评|商用密码`), "监管合规敏感词", nil},
|
|
{CID("005"), "low", compileRE(`内部代号|项目代号|内部项目|未公开|NDA|保密协议|客户名录|内部API|私有接口|内部对接`), "组织内部敏感信息", nil},
|
|
{CID("006"), "medium", compileRE(`国密|SM2|SM3|SM4|SM9|密码卡|防火墙设备|入侵防御|WAF|DLP|上网行为|日志审计|终端管控`), "安全产品/密码学敏感词", nil},
|
|
}
|
|
}
|
|
|
|
func SID(num string) string { return "S-" + num }
|
|
func PID(num string) string { return "P-" + num }
|
|
func EID(num string) string { return "E-" + num }
|
|
func CID(num string) string { return "C-" + num }
|