@stravica-ai/digital-operator-pa 0.1.58 → 0.1.59
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
|
@@ -181,8 +181,20 @@ export function redactBashCommand(cmd) {
|
|
|
181
181
|
// user:secret@host URL credential (do this BEFORE the KEY=VALUE pass
|
|
182
182
|
// so the scheme:// does not accidentally feed the key regex).
|
|
183
183
|
out = out.replace(/(https?:\/\/[^:/\s@]+):([^@\s'"`]+)@/gi, '$1:<redacted>@');
|
|
184
|
-
// Authorization header value (
|
|
185
|
-
|
|
184
|
+
// Authorization header value (any scheme: Bearer, token, Basic,
|
|
185
|
+
// Digest, or an unknown word; and the raw-value no-scheme form). Three
|
|
186
|
+
// passes handle the single-quoted, double-quoted, and unquoted header
|
|
187
|
+
// forms. The quoted passes consume up to the closing quote so secrets
|
|
188
|
+
// that contain whitespace or inner punctuation (token schemes, Basic
|
|
189
|
+
// base64, Digest comma-separated field lists with inner "quoted"
|
|
190
|
+
// fields) never leak past the scheme word. 0.1.58 only redacted the
|
|
191
|
+
// scheme word for non-Bearer schemes, so `Authorization: token <x>`
|
|
192
|
+
// landed in the log as `Authorization: <redacted> <x>` (Dex's 0.1.58
|
|
193
|
+
// verification). 0.1.59 extends the redaction to the full header
|
|
194
|
+
// value.
|
|
195
|
+
out = out.replace(/'([^'\n]*?Authorization\s*:\s*)[^'\n]+(?=')/gi, (_m, pre) => `'${pre}<redacted>`);
|
|
196
|
+
out = out.replace(/"([^"\n]*?Authorization\s*:\s*)[^"\n]+(?=")/gi, (_m, pre) => `"${pre}<redacted>`);
|
|
197
|
+
out = out.replace(/(Authorization\s*:\s*)[^\s'"`,;)]+(?:\s+[^\s'"`,;)]+)?/gi, '$1<redacted>');
|
|
186
198
|
// --token / --token= and token=
|
|
187
199
|
out = out.replace(/(--?token[\s=]+)([^\s'"`;)]+)/gi, '$1<redacted>');
|
|
188
200
|
// NAME=value (env-style). Match a word boundary that is not preceded
|
package/package.json
CHANGED