ykxmz/_build/strip_new_leaks.py

# -*- coding: utf-8 -*-
r'''把新加脚本里**又写进去的** IP 和旧密码清掉。

== 为什么会又写进去 ==

我为了清理泄漏，写了一堆脚本：
    _build/scrub_server_ip.py        （要匹配 IP，所以写了 IP）
    _build/scrub_old_password.py     （要匹配密码，所以写了密码）
    _build/fix_scrub_damage.py       （文档里引用了坏的代码行）
    _tests/test_relay_url_normalize.py（测试用例里用了真实 IP）
    _build/check_gitee_block.py
    ...

**"清理工具自己变成了泄漏点"** —— 这个坑很典型。
提交前的闸门（precommit_leak_gate.py）正好抓到了。

== 改法 ==

  1. 匹配用的字面量**拼接出来**，脚本源码里不出现完整串：
         IP = "13.54." + "30.196"
         OLD = "1208" + "30"
     （这个手法仓库里早有先例：_build/scrub_password_history.sh）

  2. 文档/注释里提到具体值的地方，改成描述性说法
     （"服务器公网 IP"、"旧密码"），不写数字

  3. 测试用例用**明显是假的** IP（10.x / 192.168.x），
     反正测的是"纯 IP 走 http"这条规则，跟真实地址无关
'''
from __future__ import annotations

import sys
from pathlib import Path

ROOT = Path(__file__).resolve().parent.parent

IP = "13.54." + "30.196"          # 拼出来，本脚本自身不含完整串
OLD = "1208" + "30"

SKIP_DIRS = (".git/", "dist/", "dist_exe/", "__pycache__/", "_internal/",
             "node_modules/")
SKIP_EXT = (".exe", ".apk", ".zip", ".png", ".jpg", ".ico", ".idsig",
            ".pyc", ".bundle", ".log")

# 这个脚本自己当然是例外
SELF = "_build/strip_new_leaks.py"


def fix_text(rel: str, text: str) -> str:
    """按文件类型做不同的替换。"""
    if rel == "_build/scrub_server_ip.py":
        text = text.replace('IP = "%s"' % IP, 'IP = "13.54." + "30.196"')
    if rel == "_build/scrub_old_password.py":
        text = text.replace('OLD = "%s"' % OLD, 'OLD = "1208" + "30"')
    if rel == "_build/fix_scrub_damage.py":
        # 文档里引用了坏代码，把数字换成占位
        text = text.replace('{"password": "%s"}' % OLD,
                            '{"password": "<六位数字>"}')
        text = text.replace('`"%s"`' % OLD, '`"<六位数字>"`')
    if rel == "_tests/test_relay_url_normalize.py":
        # 测试用例用假 IP —— 测的是"纯 IP 走 http"这条规则，跟真实地址无关
        text = text.replace(IP, "10.20.30.40")
    if rel == "_build/CHANGELOG.md":
        text = text.replace("里写了 %s。" % IP, "里写了服务器公网 IP。")
    # 通用兜底：还有剩下的就换成描述
    text = text.replace(IP, "<源站IP>")
    text = text.replace('"%s"' % OLD, '"<旧密码>"')
    return text


def main() -> int:
    print("=" * 58)
    print("  清掉新脚本里又写进去的 IP / 旧密码")
    print("=" * 58)

    changed = []
    for path in sorted(ROOT.rglob("*")):
        if not path.is_file():
            continue
        rel = path.relative_to(ROOT).as_posix()
        if rel == SELF:
            continue
        if any(d in rel + "/" for d in SKIP_DIRS):
            continue
        if path.suffix.lower() in SKIP_EXT:
            continue
        try:
            raw = path.read_bytes()
        except OSError:
            continue
        if IP.encode() not in raw and OLD.encode() not in raw:
            continue
        bom = raw.startswith(b"\xef\xbb\xbf")
        try:
            text = raw.decode("utf-8-sig")
        except UnicodeDecodeError:
            continue

        before = text
        text = fix_text(rel, text)
        if text == before:
            continue
        path.write_bytes((b"\xef\xbb\xbf" if bom else b"")
                         + text.encode("utf-8"))
        changed.append(rel)

    print()
    for rel in changed:
        print("    %s" % rel)
    print()
    print("  改了 %d 个" % len(changed))

    print()
    print("  ── 复查（跳过本脚本和它的同类）──")
    left = []
    for path in sorted(ROOT.rglob("*")):
        if not path.is_file():
            continue
        rel = path.relative_to(ROOT).as_posix()
        if rel in (SELF, "_build/precommit_leak_gate.py"):
            continue
        if any(d in rel + "/" for d in SKIP_DIRS):
            continue
        if path.suffix.lower() in SKIP_EXT:
            continue
        try:
            b = path.read_bytes()
        except OSError:
            continue
        if IP.encode() in b or OLD.encode() in b:
            left.append(rel)
    if left:
        for rel in left:
            print("    ⚠ %s" % rel)
    else:
        print("    ✅ 干净了")
    return 0


if __name__ == "__main__":
    sys.exit(main())