fix(security): redact secrets and paths in compression_failure_pairs before storage#1838
Merged
fix(security): redact secrets and paths in compression_failure_pairs before storage#1838
Conversation
…before storage (#1801) Apply redact_sensitive() to compressed_context and failure_reason in log_compression_failure() before truncation and SQLite insert. The function uses two static LazyLock<Regex> patterns: one for known secret prefixes (sk-, AKIA, ghp_, Bearer, etc.) and one for filesystem paths (/home/, /Users/, /tmp/, etc.). regex moved from optional to unconditional dep in zeph-memory since storage-layer sanitization must run regardless of feature flags.
github-actions
bot
added
documentation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Fixes #1801.
Summary
redact_sensitive()function incrates/zeph-memory/src/sqlite/compression_guidelines.rsusing two staticLazyLock<Regex>patterns:SECRET_RE: matches known secret prefixes (sk-, sk_live_, sk_test_, AKIA, ghp_, gho_, -----BEGIN, xoxb-, xoxp-, AIza, ya29., glpat-, hf_, npm_, dckr_pat_) and replaces with[REDACTED]PATH_RE: matches filesystem paths (/home/, /Users/, /root/, /tmp/, /var/) and replaces with[PATH]compressed_contextandfailure_reasoninlog_compression_failure()beforetruncate_field()callsregexmoved from optional to unconditional dep inzeph-memory(storage-layer sanitization must run regardless of feature flags; regex was already a transitive dep)Design notes
zeph-core::redact::scrub_content()was considered but rejected:zeph-corealready depends onzeph-memory, making the reverse dep a circular dependency. The ~30-line inline implementation matches the existing pattern incommunity.rs.Returns
Cow::Borrowedwhen nothing matches (zero-alloc fast path).Limitations (follow-up)
SECRET_REprefixes lack explicit tests (low priority)