Skip to content

Fix ghs_ token regex: rebuild lib/ bundle and add missing hyphen #3932

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
hagould wants to merge 7 commits into
base: main
Choose a base branch
from
+19 −21
Open

Fix ghs_ token regex: rebuild lib/ bundle and add missing hyphen #3932

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
7 commits
Select commit Hold shift + click to select a range
615a713
Fix ghs_ token patterns to support new token format
May 25, 2026
df3ab55
Fix ghs_ regex: add dash to character class [A-Za-z0-9._-]
hpsin May 26, 2026
b53799f
Fix ghs_ regex: add dash to character class [A-Za-z0-9._-]
hpsin May 26, 2026
31e72ce
Rebuild lib/ bundle with correct regex
hagould May 26, 2026
c90844a
Fix prettier formatting
hagould May 26, 2026
eee6a34
Collapse AppInstallationAccess into ServerToServer token type
hagould May 26, 2026
85df3c0
Address review: bound regex, revert scanFileForTokens, restore old-fo…
hagould May 27, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
6 changes: 1 addition & 5 deletions lib/entry-points.js
View file
Open in desktop

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

27 changes: 17 additions & 10 deletions src/artifact-scanner.test.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -23,6 +23,8 @@ test("makeTestToken", (t) => {
t.is(makeTestToken(255).length, 255);
});

const NEW_FORMAT_GHS_TOKEN = "ghs_abc123.def456.ghi789_abc123.def456.ghi789";

test("isAuthToken", (t) => {
// Undefined for strings that aren't tokens
t.is(isAuthToken("some string"), undefined);
Expand All @@ -32,10 +34,8 @@ test("isAuthToken", (t) => {
// Token types for strings that are tokens.
t.is(isAuthToken(`ghp_${makeTestToken()}`), TokenType.PersonalAccessClassic);
t.is(isAuthToken(`ghp_${makeTestToken()}`), TokenType.PersonalAccessClassic);
t.is(
isAuthToken(`ghs_${makeTestToken(255)}`),
TokenType.AppInstallationAccess,
);
t.is(isAuthToken(NEW_FORMAT_GHS_TOKEN), TokenType.ServerToServer);
t.is(isAuthToken(`ghs_${makeTestToken(255)}`), TokenType.ServerToServer);
t.is(
isAuthToken(`github_pat_${makeTestToken(22)}_${makeTestToken(59)}`),
TokenType.PersonalAccessFineGrained,
Expand Down Expand Up @@ -77,19 +77,26 @@ const testTokens = [
{
type: TokenType.ServerToServer,
value: `ghs_${makeTestToken()}`,
checkPattern: "Server-to-Server",
label: "legacy format",
},
{
type: TokenType.Refresh,
value: `ghr_${makeTestToken()}`,
type: TokenType.ServerToServer,
value: NEW_FORMAT_GHS_TOKEN,
checkPattern: "Server-to-Server",
label: "new format",
},
{
type: TokenType.AppInstallationAccess,
value: `ghs_${makeTestToken(255)}`,
type: TokenType.Refresh,
value: `ghr_${makeTestToken()}`,
},
];

for (const { type, value, checkPattern } of testTokens) {
test(`scanArtifactsForTokens detects GitHub ${type} tokens in files`, async (t) => {
for (const { type, value, checkPattern, label } of testTokens) {
const testName = label
? `scanArtifactsForTokens detects GitHub ${type} (${label}) tokens in files`
: `scanArtifactsForTokens detects GitHub ${type} tokens in files`;
test(testName, async (t) => {
const logMessages = [];
const logger = getRecordingLogger(logMessages, { logToConsole: false });
const tempDir = fs.mkdtempSync(path.join(os.tmpdir(), "scanner-test-"));
Expand Down
7 changes: 1 addition & 6 deletions src/artifact-scanner.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -17,7 +17,6 @@ export enum TokenType {
UserToServer = "User-to-Server Token",
ServerToServer = "Server-to-Server Token",
Refresh = "Refresh Token",
AppInstallationAccess = "App Installation Access Token",
}

/** A value of this type associates a token type with its pattern. */
Expand Down Expand Up @@ -55,16 +54,12 @@ const GITHUB_TOKEN_PATTERNS: TokenPattern[] = [
},
{
type: TokenType.ServerToServer,
pattern: /\bghs_[a-zA-Z0-9]{36}\b/g,
pattern: /\bghs_[A-Za-z0-9._-]{36,516}(?![A-Za-z0-9._-])/g,
},
{
type: TokenType.Refresh,
pattern: /\bghr_[a-zA-Z0-9]{36}\b/g,
},
{
type: TokenType.AppInstallationAccess,
pattern: /\bghs_[a-zA-Z0-9]{255}\b/g,
},
];

interface TokenFinding {
Expand Down
Loading