Skip to content

Regex of user's email secret is incorrect #161565

Description

@mustard-mh

Does this issue occur when all extensions are disabled?: Yes

The email telemetry security regex incorrectly treats near everything that includes @xxx as email

IMG (see last two example)
image

const userDataRegexes = [
{ label: 'Google API Key', regex: /AIza[A-Za-z0-9_\\\-]{35}/ },
{ label: 'Slack Token', regex: /xox[pbar]\-[A-Za-z0-9]/ },
{ label: 'Generic Secret', regex: /(key|token|sig|secret|signature|password|passwd|pwd|android:value)[^a-zA-Z0-9]/ },
{ label: 'Email', regex: /@[a-zA-Z0-9-.]+/ } // Regex which matches @*.site
];
// Check for common user data in the telemetry events
for (const secretRegex of userDataRegexes) {
if (secretRegex.regex.test(value)) {
return `<REDACTED: ${secretRegex.label}>`;
}
}

  • VS Code Version: From sources
  • OS Version:

Steps to Reproduce:

  1. Copy regex of email and test it

Metadata

Metadata

Assignees

Labels

insiders-releasedPatch has been released in VS Code Insiders

Type

No type

Projects

No projects

Milestone

Relationships

None yet

Development

No branches or pull requests

Issue actions