secretlint / secretlint

Pluggable linting tool to prevent committing credential.
MIT License
805 stars 35 forks source link

GItHub/npm: support CRC32 checksum check #202

Open azu opened 3 years ago

azu commented 3 years ago

Currently, secretlint-rule-{npm/github} does not check CRC32 in tokens.

we want to suport it.

PoC

// https://gist.github.com/kevinyan815/f71b2f5ca3541631abd2e50f3929739b
function toBase62(n) {
    if (n === 0) {
        return '0';
    }
    const digits = '0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz';
    let result = '';
    while (n > 0) {
        result = digits[n % digits.length] + result;
        n = parseInt(n / digits.length, 10);
    }

    return result;
}

//https://stackoverflow.com/a/18639999
const crc32 = function (str) {
    const makeCRCTable = function () {
        var c;
        var crcTable = [];
        for (var n = 0; n < 256; n++) {
            c = n;
            for (var k = 0; k < 8; k++) {
                c = ((c & 1) ? (0xEDB88320 ^ (c >>> 1)) : (c >>> 1));
            }
            crcTable[n] = c;
        }
        return crcTable;
    };
    const crcTable = makeCRCTable();
    let crc = 0 ^ (-1);
    for (let i = 0; i < str.length; i++) {
        crc = (crc >>> 8) ^ crcTable[(crc ^ str.charCodeAt(i)) & 0xFF];
    }
    return (crc ^ (-1)) >>> 0;
};

console.log(toBase62(crc32("qkJaB6MffYVzZXWqmcoF49yrUxP3wf")).padStart(6, "0")); // "0LsakP"

Minimal implementation for CRC32.

TODO

Reference

Originally posted by @azu in https://github.com/secretlint/secretlint/issues/200#issuecomment-926610476

azu commented 1 year ago

alexgorbatchev/crc: Blazingly fast CRC implementations for node.js and browser