From 3053351d51dc67debf460e0afb2d0ee60214203e Mon Sep 17 00:00:00 2001 From: ch0412 Date: Fri, 31 Jul 2026 19:39:13 +0900 Subject: [PATCH] feat: add masked token OR condition to rule-based analyzer (#28) --- app/analysis/rules/analyzer.py | 4 ++-- tests/analysis/rules/test_analyzer.py | 15 +++++++++++++++ 2 files changed, 17 insertions(+), 2 deletions(-) diff --git a/app/analysis/rules/analyzer.py b/app/analysis/rules/analyzer.py index 8c490cc..bdaef20 100644 --- a/app/analysis/rules/analyzer.py +++ b/app/analysis/rules/analyzer.py @@ -82,11 +82,11 @@ def analyze_text_with_rules(text: str, traced_url: Optional[str] = None) -> dict matched_rules.append(f"로컬 가드 도메인 룰 매치 ({traced_url})") score += MALICIOUS_DOMAIN_RULE_SCORE - if _RE_ACCOUNT_NUMBER.search(text): + if _RE_ACCOUNT_NUMBER.search(text) or "[ACCOUNT]" in text: matched_rules.append("계좌번호로 추정되는 숫자 패턴 발견") score += ACCOUNT_NUMBER_SCORE - if _RE_CARD_NUMBER.search(text): + if _RE_CARD_NUMBER.search(text) or "[CARD]" in text: matched_rules.append("카드번호로 추정되는 숫자 패턴 발견") score += CARD_NUMBER_SCORE diff --git a/tests/analysis/rules/test_analyzer.py b/tests/analysis/rules/test_analyzer.py index 7afea6f..398cd13 100644 --- a/tests/analysis/rules/test_analyzer.py +++ b/tests/analysis/rules/test_analyzer.py @@ -75,3 +75,18 @@ def test_rule_score_never_exceeds_100(): result = analyze_text_with_rules(text, traced_url="https://scam.ru/phish") assert result["rule_score"] == 100 + +def test_masked_account_token_is_detected(): + """Spring이 마스킹한 [ACCOUNT] 토큰도 계좌번호로 탐지되어야 한다.""" + result = analyze_text_with_rules("입금 계좌 [ACCOUNT] 으로 보내주세요") + + assert result["rule_score"] >= 30 + assert any("계좌번호" in r for r in result["matched_rules"]) + + +def test_masked_card_token_is_detected(): + """Spring이 마스킹한 [CARD] 토큰도 카드번호로 탐지되어야 한다.""" + result = analyze_text_with_rules("카드번호 [CARD] 을 입력해주세요") + + assert result["rule_score"] >= 30 + assert any("카드번호" in r for r in result["matched_rules"])