fix: block temporary AWS credentials in URL DLP

[lpcox]

Summary

• address GHSA-vq7w-x3cf-76wp by extending AWS access-key URL DLP detection from AKIA to both AKIA and ASIA
• block temporary AWS STS access-key IDs commonly issued through GitHub Actions OIDC federation from being exfiltrated in outbound URLs
• add regression coverage proving both long-lived AKIA and temporary ASIA formats are detected
• update the documented AWS DLP coverage

Security impact

Before this change, an ASIA-prefixed temporary AWS access-key ID could bypass the Squid URL DLP ACL even though equivalent AKIA credentials were blocked. The generated POSIX ERE now matches (AKIA|ASIA)[0-9A-Z]{16} without broadening unrelated credential patterns.

Validation

• npm test -- --runTestsByPath src/dlp.test.ts src/squid-config-dlp.test.ts --runInBand — 37 tests passed
• npm run type-check — passed
• changed-file ESLint — 0 errors (2 pre-existing non-literal RegExp warnings in src/dlp.test.ts)
• commit hooks — full lint completed with 0 errors; build passed

[github-actions]

✅ Coverage Check Passed

Overall Coverage

Metric	Base	PR	Delta
Lines	93.33%	93.33%	➡️ +0.00%
Statements	91.91%	91.92%	📈 +0.01%
Functions	90.67%	90.67%	➡️ +0.00%
Branches	85.75%	85.75%	➡️ +0.00%

📁 Per-file Coverage Changes (4 files)

File	Lines (Before → After)	Statements (Before → After)
src/nvx/one-shot-adapter.ts	83.4% → 82.9% (-0.56%)	80.7% → 80.2% (-0.52%)
src/enclave/host-executor-server.ts	90.3% → 90.3% (+0.00%)	88.8% → 89.1% (+0.31%)
src/domain-matchers.ts	98.1% → 98.2% (+0.04%)	98.1% → 98.2% (+0.04%)
src/log-directory-setup.ts	96.8% → 100.0% (+3.18%)	96.9% → 100.0% (+3.13%)

---

Coverage comparison generated by scripts/ci/compare-coverage.ts

[Copilot]

🔵 Needs a closer look

Case-insensitive matching introduces benign-URL false positives that require maintainer acceptance.

1 open finding

• Case-insensitive AWS regex causes false-positive DLP blocks · New

What changed in this PR

Extends AWF’s URL credential filtering to detect temporary AWS access-key IDs.

Changes:

• Adds ASIA detection alongside AKIA.
• Adds regression coverage for temporary keys.
• Updates documented AWS credential coverage.

File	Description
src/​types/​security-options.ts	Documents both AWS prefixes.
src/​squid-config-dlp.test.ts	Checks the expanded generated ACL.
src/​dlp.ts	Extends the AWS credential pattern.
src/​dlp.test.ts	Tests both AWS key formats.

🧠 Review effort: Max

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[lpcox]

@copilot address review feedback

[Copilot]

@copilot address review feedback

Made the AWS DLP ACL case-sensitive, kept uppercase AKIA/ASIA detection, and added regression tests for the lowercase false-positive URLs. Targeted tests and type-check pass. Commit: 77f13cb.

[github-actions]

✅ Copilot review passed with no inline comments.

@lpcox Add the ready-for-aw label to this PR to trigger agentic CI smoke tests.