Skip to content

Commit a0023f4

Browse files
steipetesteipete
committed
fix(logging): redact URL query secrets
1 parent 1b581b4 commit a0023f4

3 files changed

Lines changed: 22 additions & 1 deletion

File tree

‎src/logging/diagnostic-support-export.test.ts‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -556,7 +556,7 @@ describe("diagnostic support export", () => {
556556
const cases = [
557557
[
558558
"connect wss://support-user:[email protected]/ws?token=short-token&ok=1",
559-
"connect wss://<redacted>:<redacted>@gateway.example/ws?token=<redacted>",
559+
"connect wss://<redacted>:<redacted>@gateway.example/ws?token=<redacted>&ok=1",
560560
],
561561
[
562562
"connect https://gateway.example/ws?access-token=short-token",

‎src/logging/redact.test.ts‎

Lines changed: 18 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -134,6 +134,24 @@ describe("redactSensitiveText", () => {
134134
expect(output).toBe(input);
135135
});
136136

137+
it("masks sensitive URL query params while preserving non-sensitive params", () => {
138+
const input = "GET /_matrix/client/v3/sync?access_token=abcdef1234567890ghij&since=123";
139+
const output = redactSensitiveText(input, {
140+
mode: "tools",
141+
patterns: defaults,
142+
});
143+
expect(output).toBe("GET /_matrix/client/v3/sync?access_token=abcdef…ghij&since=123");
144+
});
145+
146+
it("treats sensitive URL query param names case-insensitively", () => {
147+
const input = "connect https://gateway.example/ws?Access-Token=short-token&ok=1";
148+
const output = redactSensitiveText(input, {
149+
mode: "tools",
150+
patterns: defaults,
151+
});
152+
expect(output).toBe("connect https://gateway.example/ws?Access-Token=***&ok=1");
153+
});
154+
137155
it("redacts private key blocks", () => {
138156
const input = [
139157
"-----BEGIN PRIVATE KEY-----",

‎src/logging/redact.ts‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -14,6 +14,9 @@ const DEFAULT_REDACT_PATTERNS: string[] = [
1414
// ENV-style assignments. Keep this case-sensitive so diagnostics like
1515
// `Unrecognized key: "llm"` do not lose the actual config key.
1616
String.raw`/\b[A-Z0-9_]*(?:KEY|TOKEN|SECRET|PASSWORD|PASSWD)\b\s*[=:]\s*(["']?)([^\s"'\\]+)\1/g`,
17+
// URL query parameters. Keep this separate from ENV-style assignments so
18+
// lower-case URL secrets stay redacted without hiding config-key diagnostics.
19+
String.raw`/[?&](?:access[-_]?token|auth[-_]?token|hook[-_]?token|refresh[-_]?token|api[-_]?key|client[-_]?secret|token|key|secret|password|pass|passwd|auth|signature)=([^&\s"'<>]+)/gi`,
1720
// JSON fields.
1821
String.raw`"(?:apiKey|token|secret|password|passwd|accessToken|refreshToken)"\s*:\s*"([^"]+)"`,
1922
// CLI flags.

0 commit comments

Comments
 (0)