Tighten audit match boundaries

Require the exact Authorization key and a non-empty Windows username so generic map keys and profiles-directory prose remain public-safe.

Author: VladimirBrejcha

public-source-release-audit/scripts/check_current_source.rb

@@ -18,7 +18,7 @@
           root(?:(?:/|\\/)|(?![A-Za-z0-9._-]))
         )
         |
-        [A-Za-z]:[\\/]{1,2}(?i:Users)[\\/]{1,2}[^\\/\r\n]+(?:[\\/]{1,2}|$)
+        [A-Za-z]:[\\/]{1,2}(?i:Users)[\\/]{1,2}[A-Za-z0-9._-]+(?:[\\/]{1,2}|(?=["'\s,;:)\]\}]|\z))
       )
     }x
   ],
@@ -29,7 +29,7 @@
   ],
   [
     "bearer credential",
-    /["']?Authorization["']?\s*(?::|=>)\s*["']?Bearer\s+[A-Za-z0-9._~+\/=:-]{16,}/i
+    /(?<![A-Za-z0-9_.-])(?<authorization_quote>["']?)Authorization\k<authorization_quote>(?![A-Za-z0-9_.-])\s*(?::|=>)\s*["']?Bearer\s+[A-Za-z0-9._~+\/=:-]{16,}/i
   ],
   [
     "GitHub token",

public-source-release-audit/tests/test_check_current_source.rb

@@ -237,10 +237,12 @@ def test_ignored_local_files_are_outside_the_release_candidate
 
   def test_unrelated_home_directory_and_web_route_do_not_match_user_homes
     with_repo do |repo|
+      windows_profiles = "C:" + "\\Users\\"
       stage(repo, "paths.txt", [
         "/tmp/home/.local/bin/tool",
         "https://example.invalid/home/user/profile",
-        "https://example.invalid/login?next=/home/user/profile"
+        "https://example.invalid/login?next=/home/user/profile",
+        "Windows stores profiles under #{windows_profiles} by default."
       ].join("\n"))
 
       stdout, stderr, status = run_checker(repo)
@@ -250,6 +252,18 @@ def test_unrelated_home_directory_and_web_route_do_not_match_user_homes
     end
   end
 
+  def test_similar_bearer_map_key_is_not_authorization
+    with_repo do |repo|
+      value = "Bearer " + ("a" * 24)
+      stage(repo, "map.json", "{\"NotAuthorization\":\"#{value}\"}\n")
+
+      stdout, stderr, status = run_checker(repo)
+
+      assert status.success?, stderr
+      assert_includes stdout, "current public-source check passed"
+    end
+  end
+
   def test_home_assignment_is_still_detected
     with_repo do |repo|
       home = "/" + "home/example/private.txt"