security: harden shared library boundaries

internal/cipolicy/workflow_policy_test.go

@@ -0,0 +1,24 @@
+package cipolicy_test
+
+import (
+	"os/exec"
+	"path/filepath"
+	"runtime"
+	"testing"
+)
+
+func TestWorkflowPolicyRegressionSuite(t *testing.T) {
+	t.Parallel()
+
+	_, file, _, ok := runtime.Caller(0)
+	if !ok {
+		t.Fatal("resolve test source path")
+	}
+	repoRoot := filepath.Clean(filepath.Join(filepath.Dir(file), "..", ".."))
+	cmd := exec.CommandContext(t.Context(), "bash", "scripts/ci/check-workflow-secrets_test.sh")
+	cmd.Dir = repoRoot
+	output, err := cmd.CombinedOutput()
+	if err != nil {
+		t.Fatalf("workflow policy regression suite failed: %v\n%s", err, output)
+	}
+}

pkg/logging/sanitize.go

@@ -1,3 +1,23 @@
+// Copyright (c) 2025 Kapu
+//
+// Permission is hereby granted, free of charge, to any person obtaining a copy
+// of this software and associated documentation files (the "Software"), to deal
+// in the Software without restriction, including without limitation the rights
+// to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+// copies of the Software, and to permit persons to whom the Software is
+// furnished to do so, subject to the following conditions:
+//
+// The above copyright notice and this permission notice shall be included in
+// all copies or substantial portions of the Software.
+//
+// THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+// IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+// FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+// AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+// LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+// OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+// SOFTWARE.
+
 package logging
 
 import (
@@ -7,15 +27,6 @@ import (
 	"strings"
 )
 
-type sanitizeHandler struct {
-	inner slog.Handler
-}
-
-func newSanitizeHandler(inner slog.Handler) *sanitizeHandler {
-	return &sanitizeHandler{inner: inner}
-}
-
-// 민감 키 리스트 (case-insensitive 매칭)
 var (
 	bearerTokenRegex = regexp.MustCompile(`(?i)\b(bearer\s+)[A-Za-z0-9._~+/=-]+`)
 	querySecretRegex = regexp.MustCompile(`(?i)([?&;](?:key|api_key|apikey|token|password|pwd|passwd|client_secret|secret|private_key|secret_key)=)[^&\s]+`)
@@ -24,14 +35,16 @@ var (
 const (
 	tokenAPIKey        = "api_key"
 	tokenAPIKeyCompact = "apikey"
+	tokenPrivateKey    = "private_key"
+	tokenSecretKey     = "secret_key"
 )
 
 // querySecretTokens는 querySecretRegex가 매치할 수 있는 키 이름 집합으로,
 // 정규식 실행 전 싼 substring pre-check 게이트에 쓰인다. 정규식이 매치하는
 // 입력은 반드시 이 토큰 중 하나를 case-insensitive로 포함하므로 게이트는 안전하다.
 var querySecretTokens = []string{
 	"key", tokenAPIKey, tokenAPIKeyCompact, "token", "password", "pwd", "passwd",
-	"client_secret", "secret", "private_key", "secret_key",
+	"client_secret", "secret", tokenPrivateKey, tokenSecretKey,
 }
 
 var sensitiveExactKeys = map[string]struct{}{
@@ -46,8 +59,8 @@ var sensitiveExactKeys = map[string]struct{}{
 	"client_secret":    {},
 	tokenAPIKey:        {},
 	tokenAPIKeyCompact: {},
-	"private_key":      {},
-	"secret_key":       {},
+	tokenPrivateKey:    {},
+	tokenSecretKey:     {},
 	"authorization":    {},
 	"auth_header":      {},
 	"cookie":           {},
@@ -248,9 +261,25 @@ var secretLikePrefixes = []string{
 	"eyj",
 }
 
+var secretLikeExactValues = map[string]struct{}{
+	"access-token":  {},
+	"access_token":  {},
+	"api-key":       {},
+	tokenAPIKey:     {},
+	"private-key":   {},
+	tokenPrivateKey: {},
+	"refresh-token": {},
+	"refresh_token": {},
+	"secret-key":    {},
+	tokenSecretKey:  {},
+}
+
 const secretLikeMinLen = 24
 
 func isSecretLikeValue(v string) bool {
+	if _, ok := secretLikeExactValues[strings.ToLower(strings.TrimSpace(v))]; ok {
+		return true
+	}
 	if hasSecretLikePrefix(v) {
 		return true
 	}

pkg/logging/sanitize_handler.go

@@ -0,0 +1,11 @@
+package logging
+
+import "log/slog"
+
+type sanitizeHandler struct {
+	inner slog.Handler
+}
+
+func newSanitizeHandler(inner slog.Handler) *sanitizeHandler {
+	return &sanitizeHandler{inner: inner}
+}

pkg/logging/sanitize_literal_secret_test.go

@@ -0,0 +1,38 @@
+package logging
+
+import (
+	"strings"
+	"testing"
+)
+
+func TestSanitizeKey_LiteralSecretNamesAreMasked(t *testing.T) {
+	t.Parallel()
+
+	for _, value := range []string{
+		"secret-key",
+		tokenSecretKey,
+		"api-key",
+		tokenAPIKey,
+		"private-key",
+		tokenPrivateKey,
+		"access-token",
+		"access_token",
+		"refresh-token",
+		"refresh_token",
+		" SECRET-KEY ",
+		"Api_Key",
+	} {
+		value := value
+		t.Run(value, func(t *testing.T) {
+			t.Parallel()
+
+			output := keyFieldOutput(t, "key", value)
+			if strings.Contains(output, value) {
+				t.Fatalf("literal secret value %q leaked in output: %s", value, output)
+			}
+			if !strings.Contains(output, "***REDACTED***") {
+				t.Fatalf("literal secret value %q was not redacted: %s", value, output)
+			}
+		})
+	}
+}