Skip to content

security(logging): redact payment credential fields#75230

Merged
clawsweeper[bot] merged 1 commit into
openclaw:mainfrom
stainlu:security/link-wallet-redaction
May 1, 2026
Merged

security(logging): redact payment credential fields#75230
clawsweeper[bot] merged 1 commit into
openclaw:mainfrom
stainlu:security/link-wallet-redaction

Conversation

@stainlu

@stainlu stainlu commented Apr 30, 2026

Copy link
Copy Markdown
Contributor

Summary

  • Extend default redaction patterns for payment credential field names in JSON fields, URL parameters, CLI flags, and assignments.
  • Add key-aware structured tool-payload redaction so details.structuredContent.sharedPaymentToken and cardNumber are masked even when the raw value has no known token prefix.
  • Document the expanded default logging redaction coverage and add a changelog entry.

Why

Wallet-style MCP tools can return one-time payment credentials as either text or structured content. This keeps the protection generic and key-scoped, avoiding broad card-number scanning while preserving ordinary diagnostics such as amount.

Related: #71211

Tests

  • pnpm test src/logging/redact.test.ts src/agents/pi-embedded-subscribe.tools.test.ts -- --reporter=verbose
  • pnpm exec oxfmt --check --threads=1 src/logging/redact.ts src/logging/redact.test.ts src/agents/pi-embedded-subscribe.tools.ts src/agents/pi-embedded-subscribe.tools.test.ts docs/logging.md docs/gateway/logging.md CHANGELOG.md
  • git diff --check
  • DOCS_I18N_GLOSSARY_BASE=upstream/main pnpm check:docs
  • pnpm check:changed --dry-run --base upstream/main

@openclaw-barnacle openclaw-barnacle Bot added docs Improvements or additions to documentation gateway Gateway runtime agents Agent runtime and tooling size: S labels Apr 30, 2026
@clawsweeper

clawsweeper Bot commented Apr 30, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Codex review: passed for ClawSweeper automerge.

What this changes:

The PR adds payment-credential redaction patterns and a key-aware structured field redaction helper, wires it into tool payload sanitization, and updates focused tests, logging docs, and the changelog.

Automerge follow-up:

No repair lane is needed: the PR is opted into automerge, exact-head checks are green, the branch is mergeable, and the review found no actionable correctness or security findings.

Security review:

Security review cleared: The diff is redaction hardening with tests/docs/changelog only and introduces no new dependencies, workflows, permissions, package resolution changes, lifecycle hooks, downloads, or code execution surfaces.

Review details

Best possible solution:

Land the narrow field-name-scoped redaction hardening via the maintainer-approved automerge path, while leaving the broader raw exec stdout/stderr redaction boundary tracked in #71211.

Do we have a high-confidence way to reproduce the issue?

Yes. Source review on current main gives a high-confidence reproduction path: pass a structured tool result containing details.structuredContent.cardNumber or sharedPaymentToken with bare values, and the existing sanitizer redacts strings without object-key context while default patterns omit those field names.

Is this the best way to solve the issue?

Yes. The PR is the narrowest maintainable fix for this surface because it scopes new masking to explicit payment credential field names and structured keys rather than adding broad card-number scanning that could degrade ordinary diagnostics such as amount.

What I checked:

  • Current main default patterns omit payment credential field names: The built-in defaults on current main cover generic keys, tokens, secrets, passwords, bearer headers, PEM blocks, and known token prefixes, but not card number, CVC/CVV, payment credential, or shared payment token field names. (src/logging/redact.ts:13, b2aac178d6da)
  • Current main structured sanitizer lacks key context: redactStringsDeep currently sends every string through redactToolPayloadText(value) without considering the containing object key, so a bare value under details.structuredContent.cardNumber is not masked by field name. (src/agents/pi-embedded-subscribe.tools.ts:118, b2aac178d6da)
  • PR adds payment credential defaults and field-aware helper: The PR adds payment credential key groups to JSON, URL, CLI, assignment, and structured-field matching, then exports redactSensitiveFieldValue for key-scoped structured masking. (src/logging/redact.ts:13, 5f5f1fadbbd1)
  • PR wires key-aware structured redaction: The object branch now applies redactSensitiveFieldValue(key, child) for direct string children and continues recursive redaction for nested objects and arrays. (src/agents/pi-embedded-subscribe.tools.ts:135, 5f5f1fadbbd1)
  • PR includes focused behavior coverage: Tests cover payment credential JSON fields, assignments, CLI flags, URL query parameters, key-aware structured values, and tool result payload preservation of non-sensitive amount fields. (src/logging/redact.test.ts:101, 5f5f1fadbbd1)
  • Docs and changelog are aligned: The PR documents the expanded default logging redaction coverage and adds a user-facing Security/logging changelog entry with contributor credit. (CHANGELOG.md:29, 5f5f1fadbbd1)

Likely related people:

  • volcano303: Introduced the current Control UI tool-payload redaction path, including deep sanitization for tool args/results and forced tool payload redaction. (role: introduced behavior; confidence: high; commits: f3e8c50df392; files: src/logging/redact.ts, src/agents/pi-embedded-subscribe.tools.ts, src/agents/pi-embedded-subscribe.tools.test.ts)
  • steipete: Recent history and current blame show repeated maintenance of shared logging redaction defaults, bounded regex behavior, URL query secret redaction, and adjacent agent sanitizer code. (role: recent maintainer; confidence: medium; commits: a0023f4978a8, e7432ae01d7d, 52bf20b07d6e; files: src/logging/redact.ts, src/logging/redact.test.ts, src/agents/pi-embedded-subscribe.tools.ts)
  • gavyngong: Recently added default provider token-prefix redaction patterns in the same central redaction files. (role: recent adjacent maintainer; confidence: medium; commits: 0260903f7f71; files: src/logging/redact.ts, src/logging/redact.test.ts)
  • vincentkoc: Recently maintained logging redaction documentation and persisted transcript/file-log redaction surfaces adjacent to the docs touched by this PR. (role: adjacent owner; confidence: medium; commits: 4cba24a4c352, 406ae72fd278, 94f5827c6e1d; files: docs/logging.md, src/logging/redact.ts)

Codex review notes: model gpt-5.5, reasoning high; reviewed against b2aac178d6da.

@clawsweeper clawsweeper Bot mentioned this pull request Apr 30, 2026
Open
@stainlu
stainlu force-pushed the security/link-wallet-redaction branch from 33e1c61 to 5f5f1fa Compare May 1, 2026 05:06
@thewilloftheshadow

thewilloftheshadow commented May 1, 2026

Copy link
Copy Markdown
Member

@clawsweeper automerge

@clawsweeper clawsweeper Bot added the clawsweeper:automerge Maintainer opted this PR into bounded ClawSweeper-reviewed automerge label May 1, 2026
@clawsweeper

clawsweeper Bot commented May 1, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

🦞🦞
ClawSweeper merged this PR after the passing review.

Source: clawsweeper[bot]
Feedback: structured ClawSweeper verdict: pass (sha=5f5f1fadbbd120dfcc98885b9cfd5efa7bee4bfa)
Merge status: merged by ClawSweeper automerge
Merged at: 2026-05-01T05:45:29Z
Merge commit: 84920fa

What merged:

  • The PR adds payment-credential redaction patterns and a key-aware structured field redaction helper, wires it into tool payload sanitization, and updates focused tests, logging docs, and the changelog.

Fixups included:

  • No separate fixup commits were needed after automerge opt-in.

The automerge loop is complete.

@clawsweeper
clawsweeper Bot merged commit 84920fa into openclaw:main May 1, 2026
89 checks passed
@github-actions github-actions Bot mentioned this pull request May 1, 2026
Open
lxe pushed a commit to lxe/openclaw that referenced this pull request May 6, 2026
@stainlu @lxe
security(logging): redact payment credential fields (openclaw#75230)
f3367f6 
Summary:
- The PR adds payment-credential redaction patterns and a key-aware structured field redaction helper, wires it into tool payload sanitization, and updates focused tests, logging docs, and the changelog.

ClawSweeper fixups:
- No separate fixup commits were needed after automerge opt-in.

Validation:
- ClawSweeper review passed for head 5f5f1fa.
- Required merge gates passed before the squash merge.

Prepared head SHA: 5f5f1fa
Review: openclaw#75230 (comment)

Co-authored-by: stainlu <[email protected]>
github-actions Bot pushed a commit to Desicool/openclaw that referenced this pull request May 9, 2026
@stainlu
security(logging): redact payment credential fields (openclaw#75230)
85557c5 
Summary:
- The PR adds payment-credential redaction patterns and a key-aware structured field redaction helper, wires it into tool payload sanitization, and updates focused tests, logging docs, and the changelog.

ClawSweeper fixups:
- No separate fixup commits were needed after automerge opt-in.

Validation:
- ClawSweeper review passed for head 5f5f1fa.
- Required merge gates passed before the squash merge.

Prepared head SHA: 5f5f1fa
Review: openclaw#75230 (comment)

Co-authored-by: stainlu <[email protected]>
@rdevaul rdevaul mentioned this pull request May 10, 2026
Merged
greench-ai pushed a commit to greench-ai/nexisclaw that referenced this pull request May 12, 2026
@stainlu
security(logging): redact payment credential fields (#75230)
c2ee3f2 
Summary:
- The PR adds payment-credential redaction patterns and a key-aware structured field redaction helper, wires it into tool payload sanitization, and updates focused tests, logging docs, and the changelog.

ClawSweeper fixups:
- No separate fixup commits were needed after automerge opt-in.

Validation:
- ClawSweeper review passed for head 5f5f1fadbbd120dfcc98885b9cfd5efa7bee4bfa.
- Required merge gates passed before the squash merge.

Prepared head SHA: 5f5f1fadbbd120dfcc98885b9cfd5efa7bee4bfa
Review: openclaw/openclaw#75230 (comment)

Co-authored-by: stainlu <[email protected]>
markfietje pushed a commit to markfietje/openclaw that referenced this pull request May 20, 2026
@stainlu
security(logging): redact payment credential fields (#75230)
c78f1d6 
Summary:
- The PR adds payment-credential redaction patterns and a key-aware structured field redaction helper, wires it into tool payload sanitization, and updates focused tests, logging docs, and the changelog.

ClawSweeper fixups:
- No separate fixup commits were needed after automerge opt-in.

Validation:
- ClawSweeper review passed for head 5f5f1fadbbd120dfcc98885b9cfd5efa7bee4bfa.
- Required merge gates passed before the squash merge.

Prepared head SHA: 5f5f1fadbbd120dfcc98885b9cfd5efa7bee4bfa
Review: openclaw/openclaw#75230 (comment)

Co-authored-by: stainlu <[email protected]>
github-actions Bot pushed a commit to Desicool/openclaw that referenced this pull request May 24, 2026
@stainlu
security(logging): redact payment credential fields (openclaw#75230)
6b11481 
Summary:
- The PR adds payment-credential redaction patterns and a key-aware structured field redaction helper, wires it into tool payload sanitization, and updates focused tests, logging docs, and the changelog.

ClawSweeper fixups:
- No separate fixup commits were needed after automerge opt-in.

Validation:
- ClawSweeper review passed for head 5f5f1fa.
- Required merge gates passed before the squash merge.

Prepared head SHA: 5f5f1fa
Review: openclaw#75230 (comment)

Co-authored-by: stainlu <[email protected]>
jameslcowan pushed a commit to jameslcowan/openclaw that referenced this pull request Jun 2, 2026
@stainlu
security(logging): redact payment credential fields (openclaw#75230)
dd69974 
Summary:
- The PR adds payment-credential redaction patterns and a key-aware structured field redaction helper, wires it into tool payload sanitization, and updates focused tests, logging docs, and the changelog.

ClawSweeper fixups:
- No separate fixup commits were needed after automerge opt-in.

Validation:
- ClawSweeper review passed for head 5f5f1fa.
- Required merge gates passed before the squash merge.

Prepared head SHA: 5f5f1fa
Review: openclaw#75230 (comment)

Co-authored-by: stainlu <[email protected]>
sablehead pushed a commit to sablehead/openclaw that referenced this pull request Jun 10, 2026
@stainlu
security(logging): redact payment credential fields (openclaw#75230)
9e8b2c1 
Summary:
- The PR adds payment-credential redaction patterns and a key-aware structured field redaction helper, wires it into tool payload sanitization, and updates focused tests, logging docs, and the changelog.

ClawSweeper fixups:
- No separate fixup commits were needed after automerge opt-in.

Validation:
- ClawSweeper review passed for head 5f5f1fa.
- Required merge gates passed before the squash merge.

Prepared head SHA: 5f5f1fa
Review: openclaw#75230 (comment)

Co-authored-by: stainlu <[email protected]>
GusAI40 pushed a commit to GusAI40/openclaw-1 that referenced this pull request Jun 22, 2026
@claude
monitor(upstream): weekly drift 2026-06-22 [merge now]
120b1cf 
26194 drift commits, 222 flagged (security/regression keywords).
Notable: XSS fix (openclaw#83104), PATH injection (openclaw#73264), npm_execpath
injection (openclaw#73262), implicit tool grant fix (openclaw#75055), payment
credential redaction (openclaw#75230), heartbeat regression (openclaw#88970).
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

agents Agent runtime and tooling clawsweeper:automerge Maintainer opted this PR into bounded ClawSweeper-reviewed automerge docs Improvements or additions to documentation gateway Gateway runtime size: S

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

2 participants

@stainlu @thewilloftheshadow