Skip to content

Commit aa5b08d

Browse files
obviyusobviyus
committed
fix(logging): redact structured authorization codes
1 parent edac90b commit aa5b08d

4 files changed

Lines changed: 15 additions & 11 deletions

File tree

‎extensions/google/transport-stream.test.ts‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -2270,7 +2270,7 @@ describe("google transport stream", () => {
22702270
keyMaterial: "leaked-key-material-value-12345",
22712271
jwt: "leaked-jwt-value-1234567890",
22722272
session: "leaked-session-value-123456",
2273-
code: "VISIBLE_STATUS_CODE",
2273+
code: "code-value-1234567890",
22742274
error: { code: "ERR_VISIBLE_GOOGLE_CODE" },
22752275
oauth: { code: "OPAQUEGOOGLECODE1234567890" },
22762276
providerError: { error: { code: "ERR_VISIBLE_PROVIDER_GOOGLE_CODE" } },
@@ -2292,7 +2292,6 @@ describe("google transport stream", () => {
22922292
.functionResponse as { response: { output: string } };
22932293

22942294
expect(functionResponse.response.output).toContain('"visible":"safe-value"');
2295-
expect(functionResponse.response.output).toContain('"code":"VISIBLE_STATUS_CODE"');
22962295
expect(functionResponse.response.output).toContain('"code":"ERR_VISIBLE_GOOGLE_CODE"');
22972296
expect(functionResponse.response.output).toContain('"code":"ERR_VISIBLE_PROVIDER_GOOGLE_CODE"');
22982297
for (const leakedValue of [
@@ -2302,6 +2301,7 @@ describe("google transport stream", () => {
23022301
"leaked-key-material-value-12345",
23032302
"leaked-jwt-value-1234567890",
23042303
"leaked-session-value-123456",
2304+
"code-value-1234567890",
23052305
"OPAQUEGOOGLECODE1234567890",
23062306
"leaked-signature-value-12345",
23072307
"leaked-cookie-value-123456",

‎src/llm/providers/tool-result-text.test.ts‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -13,7 +13,7 @@ describe("extractToolResultText", () => {
1313
keyMaterial: "key-material-value-1234567890",
1414
jwt: "jwt-value-1234567890",
1515
session: "session-value-1234567890",
16-
code: "VISIBLE_STATUS_CODE",
16+
code: "code-value-1234567890",
1717
error: { code: "ERR_VISIBLE_PROVIDER_CODE" },
1818
oauth: { code: "OPAQUEPROVIDERCODE1234567890" },
1919
providerError: { error: { code: "ERR_VISIBLE_PROVIDER_NESTED_CODE" } },
@@ -38,7 +38,6 @@ describe("extractToolResultText", () => {
3838
expect(text).toContain('"rawSecret":"');
3939
expect(text).toContain('"token":"');
4040
expect(text).toContain('"visible":"safe-value"');
41-
expect(text).toContain('"code":"VISIBLE_STATUS_CODE"');
4241
expect(text).toContain('"code":"ERR_VISIBLE_PROVIDER_CODE"');
4342
expect(text).toContain('"code":"ERR_VISIBLE_PROVIDER_NESTED_CODE"');
4443
expect(text).not.toContain("api-token-value-1234567890");
@@ -48,6 +47,7 @@ describe("extractToolResultText", () => {
4847
expect(text).not.toContain("key-material-value-1234567890");
4948
expect(text).not.toContain("jwt-value-1234567890");
5049
expect(text).not.toContain("session-value-1234567890");
50+
expect(text).not.toContain("code-value-1234567890");
5151
expect(text).not.toContain("OPAQUEPROVIDERCODE1234567890");
5252
expect(text).not.toContain("signature-value-1234567890");
5353
expect(text).not.toContain("cookie-value-1234567890");

‎src/logging/redact.test.ts‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1163,15 +1163,15 @@ describe("redactSecrets", () => {
11631163
invalidRequestStatus: { status: { code: "INVALID_REQUEST" } },
11641164
details: { error: { code: "SYSTEM_RUN_DENIED" } },
11651165
nodeError: { code: "NOT_PAIRED" },
1166-
policyError: { code: "POLICY_DENIED" },
1166+
policyError: { error: { code: "POLICY_DENIED" } },
11671167
invalidRequestDetails: { error: { code: "INVALID_REQUEST" } },
11681168
error: { code: "ERR_ROOTOPAQUECODE1234567890" },
11691169
diagnostic: { error: { code: "ERR_DIAGNOSTIC_TEST" } },
11701170
stabilityBundle: { error: { code: "ERR_STABILITY_TEST" } },
11711171
trajectoryExport: { error: { code: "ERR_TRAJECTORY_TEST" } },
11721172
oauth: { code: "oauth-code-value-1234567890" },
11731173
oauthNestedError: { error: { code: "ERR_OPAQUEOAUTHCODE1234567890" } },
1174-
provider: { code: "PROVIDER_STATUS_CODE" },
1174+
provider: { code: "provider-code-value-1234567890" },
11751175
providerAuth: { code: "provider-auth-code-value-1234567890" },
11761176
providerDetails: { error: { code: "SYSTEM_RUN_DENIED" } },
11771177
providerNestedError: { error: { code: "ERR_PROVIDEROPAQUECODE1234567890" } },
@@ -1188,15 +1188,15 @@ describe("redactSecrets", () => {
11881188
expect(output.invalidRequestStatus.status.code).toBe("INVALID_REQUEST");
11891189
expect(output.details.error.code).toBe("SYSTEM_RUN_DENIED");
11901190
expect(output.nodeError.code).toBe("NOT_PAIRED");
1191-
expect(output.policyError.code).toBe("POLICY_DENIED");
1191+
expect(output.policyError.error.code).toBe("POLICY_DENIED");
11921192
expect(output.invalidRequestDetails.error.code).toBe("INVALID_REQUEST");
11931193
expect(output.error.code).toBe("ERR_ROOTOPAQUECODE1234567890");
11941194
expect(output.diagnostic.error.code).toBe("ERR_DIAGNOSTIC_TEST");
11951195
expect(output.stabilityBundle.error.code).toBe("ERR_STABILITY_TEST");
11961196
expect(output.trajectoryExport.error.code).toBe("ERR_TRAJECTORY_TEST");
11971197
expect(output.oauth.code).not.toBe("oauth-code-value-1234567890");
11981198
expect(output.oauthNestedError.error.code).toBe("ERR_OPAQUEOAUTHCODE1234567890");
1199-
expect(output.provider.code).toBe("PROVIDER_STATUS_CODE");
1199+
expect(output.provider.code).not.toBe("provider-code-value-1234567890");
12001200
expect(output.providerAuth.code).not.toBe("provider-auth-code-value-1234567890");
12011201
expect(output.providerDetails.error.code).toBe("SYSTEM_RUN_DENIED");
12021202
expect(output.providerNestedError.error.code).toBe("ERR_PROVIDEROPAQUECODE1234567890");

‎src/logging/redact.ts‎

Lines changed: 7 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1112,11 +1112,15 @@ function shouldRedactStructuredAuthorizationCode(
11121112
return false;
11131113
}
11141114
const normalizedPath = path.map((part) => part.toLowerCase());
1115-
if (pathEndsWith(normalizedPath, ["error", "code"])) {
1115+
if (
1116+
pathEndsWith(normalizedPath, ["error", "code"]) ||
1117+
pathEndsWith(normalizedPath, ["nodeerror", "code"]) ||
1118+
pathEndsWith(normalizedPath, ["status", "code"]) ||
1119+
pathEndsWith(normalizedPath, ["warnings", "code"])
1120+
) {
11161121
return false;
11171122
}
1118-
const parent = normalizedPath.at(-2) ?? "";
1119-
return parent.includes("oauth") || parent.includes("auth");
1123+
return true;
11201124
}
11211125

11221126
function shouldRedactStructuredPrimitiveField(key: string, path: readonly string[]): boolean {

0 commit comments

Comments
 (0)