| 16 | static SENSITIVE_GLOBSET: OnceLock<GlobSet> = OnceLock::new(); |
| 17 | |
| 18 | fn sensitive_globset() -> &'static GlobSet { |
| 19 | SENSITIVE_GLOBSET.get_or_init(|| { |
| 20 | use globset::{GlobBuilder, GlobSetBuilder}; |
| 21 | let mut builder = GlobSetBuilder::new(); |
| 22 | let patterns = [ |
| 23 | ".env", |
| 24 | ".env.*", |
| 25 | "**/.env", |
| 26 | "**/.env.*", |
| 27 | "**/*.pem", |
| 28 | "**/*.key", |
| 29 | "**/.ssh/**", |
| 30 | ]; |
| 31 | for pattern in patterns { |
| 32 | if let Ok(glob) = GlobBuilder::new(pattern).build() { |
| 33 | builder.add(glob); |
| 34 | } |
| 35 | } |
| 36 | builder.build().unwrap_or_else(|error| { |
| 37 | log::error!("sensitive_globset build failed: {error} — all file access will require permission"); |
| 38 | match GlobSetBuilder::new().build() { |
| 39 | Ok(globset) => globset, |
| 40 | Err(inner_error) => panic!("empty GlobSet build failed: {inner_error}"), |
| 41 | } |
| 42 | }) |
| 43 | }) |
| 44 | } |
| 45 | |
| 46 | #[derive(Debug, Clone, Serialize, Deserialize)] |
| 47 | #[serde(rename_all = "camelCase")] |