deepline 0.3.286 → 0.3.288

package/dist/bundling-sources/shared_libs/security/secret-redaction.ts

@@ -6,7 +6,6 @@ type SecretRedactionOptions = {
   keyPolicy?: 'strict' | 'public-result';
   /** Replace sample cursor values with a non-capability-bearing placeholder. */
   placeholderContinuationValues?: boolean;
-  redactJsonStrings?: boolean;
 };
 
 const SENSITIVE_KEY_PATTERNS = [
@@ -400,83 +399,12 @@ function maybeRedactString(value: string, options: SecretRedactionOptions) {
     : redacted.replace(HIGH_ENTROPY_VALUE_PATTERN, REDACTED_VALUE);
 }
 
-function parseJsonContainerText(value: unknown): unknown {
-  if (typeof value !== 'string') return value;
-  const trimmed = value.trim();
-  if (!trimmed.startsWith('{') && !trimmed.startsWith('[')) return value;
-  try {
-    return JSON.parse(value);
-  } catch {
-    return value;
-  }
-}
-
-function jsonStringContainsSecrets(
-  value: string,
-  options: SecretRedactionOptions,
-  parentKey?: string,
-  path: readonly string[] = [],
-): boolean {
-  // Inspect parsed values, but never reserialize SQL text and round its numeric literals.
-  const parsed = parseJsonContainerText(value);
-  if (!parsed || typeof parsed !== 'object') return false;
-  const pending = [
-    {
-      value: parsed,
-      parentKey,
-      path: [...path],
-    },
-  ];
-  const textOptions = { ...options, redactJsonStrings: false };
-  while (pending.length > 0) {
-    const current = pending.pop()!;
-    const sourceIsArray = Array.isArray(current.value);
-    for (const [key, rawItem] of Object.entries(current.value)) {
-      const item = parseJsonContainerText(rawItem);
-      const parentKey = sourceIsArray ? current.parentKey : key;
-      if (
-        !sourceIsArray &&
-        options.keyPolicy === 'public-result' &&
-        isPublicResultSafeTokenKey(key, current.path, item) &&
-        (!item || typeof item !== 'object')
-      ) {
-        if (
-          typeof item === 'string' &&
-          maybeRedactString(item, textOptions) !== item
-        )
-          return true;
-        continue;
-      }
-      if (!sourceIsArray && shouldRedactKey(key)) return true;
-      if (item && typeof item === 'object') {
-        pending.push({
-          value: item,
-          parentKey,
-          path: sourceIsArray ? current.path : [...current.path, key],
-        });
-      } else if (
-        typeof item === 'string' &&
-        redactSecretsInValue(item, parentKey, textOptions) !== item
-      ) {
-        return true;
-      }
-    }
-  }
-  return false;
-}
-
 export function redactSecretsInValue<T>(
   value: T,
   parentKey?: string,
   options: SecretRedactionOptions = {},
 ): T {
   if (typeof value === 'string') {
-    if (
-      options.redactJsonStrings &&
-      jsonStringContainsSecrets(value, options, parentKey)
-    ) {
-      return REDACTED_VALUE as T;
-    }
     if (hasExplicitSecretValue(value, options)) {
       return REDACTED_VALUE as T;
     }
@@ -519,15 +447,8 @@ export function redactSecretsInValue<T>(
   const redactNestedValue = (
     item: unknown,
     itemParentKey: string | undefined,
-    path: readonly string[],
   ): unknown => {
     if (typeof item !== 'string') return item;
-    if (
-      options.redactJsonStrings &&
-      jsonStringContainsSecrets(item, options, itemParentKey, path)
-    ) {
-      return REDACTED_VALUE;
-    }
     if (hasExplicitSecretValue(item, options)) {
       return REDACTED_VALUE;
     }
@@ -552,15 +473,7 @@ export function redactSecretsInValue<T>(
         (!item || typeof item !== 'object')
       ) {
         const redacted =
-          typeof item === 'string'
-            ? options.redactJsonStrings &&
-              jsonStringContainsSecrets(item, options, itemParentKey, [
-                ...current.path,
-                key,
-              ])
-              ? REDACTED_VALUE
-              : maybeRedactString(item, options)
-            : item;
+          typeof item === 'string' ? maybeRedactString(item, options) : item;
         (current.target as Record<string, unknown>)[key] =
           options.placeholderContinuationValues &&
           isPublicResultCursorKey(key, current.path) &&
@@ -589,7 +502,6 @@ export function redactSecretsInValue<T>(
       (current.target as Record<string, unknown>)[key] = redactNestedValue(
         item,
         itemParentKey,
-        sourceIsArray ? current.path : [...current.path, key],
       );
     }
   }