feat: stricter validation for expected comments (#1511)

internal/scanner/ast/ast.go

@@ -3,6 +3,7 @@ package ast
 import (
 	"context"
 	"fmt"
+	"regexp"
 	"strings"
 
 	"github.com/rs/zerolog/log"
@@ -15,6 +16,8 @@ import (
 	"github.com/bearer/bearer/internal/scanner/ast/tree"
 )
 
+var ExpectedComment = regexp.MustCompile(`\A[^\w]*bearer:expected\s[\w,]+\z`)
+
 func Parse(
 	ctx context.Context,
 	language language.Language,
@@ -116,7 +119,7 @@ func addExpectedRules(
 		nextExpectedRules := expectedRules
 
 		nodeContent := builder.ContentFor(node)
-		if strings.Contains(nodeContent, "bearer:expected") {
+		if ExpectedComment.Match([]byte(nodeContent)) {
 			rawRuleIDs := strings.Split(nodeContent, "bearer:expected")[1]
 
 			for _, ruleID := range strings.Split(rawRuleIDs, ",") {