[rudycelekli]

Bug

The log sanitizer's jwt regex accepts any non-empty third segment ([A-Za-z0-9\-_]+), but its mask function always takes the last four characters with parts[2][len(parts[2])-4:]. A JWT-shaped string with a 1–3 character signature panics with slice bounds out of range inside SecretSanitizer.Write, which zap does not recover. The process logging the line crashes.

Trigger

Any log message or field containing, for example:

eyJhbGciOiJub25lIn0.eyJzdWIiOiIxIn0.x

This can come from upstream tool output, an error body echoed into a log, or a test or unsigned token. The result is panic: runtime error: slice bounds out of range [-3:].

Fix

When the signature is shorter than four characters, mask it fully (<header>.***.***) instead of slicing.

This touches the same jwt block that #1760 moves. Whichever lands second needs a trivial rebase.

Test

TestSanitizer_JWTShortSignatureDoesNotPanic runs signatures of length 1, 2 and 3 through sanitizeString, recovers any panic, and checks that the payload is masked.

Commands run

• CGO_ENABLED=0 go test -count=1 ./internal/logs: ok
• Without the fix, the new test fails on all three inputs with panicked: runtime error: slice bounds out of range [-3:], [-2:] and [-1:].
• gofmt -l on the edited files: no output

[codecov-commenter]

⚠️ Please install the to ensure uploads and comments are reliably processed by Codecov.

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!

[Dumbris]

Rebased onto main after #1760 moved the jwt block (as you predicted): the short-signature guard now sits in the moved block, nothing else changed. Verified the test fails on main and passes here, with race tests and CI lint clean. Will merge once CI is green.

[Dumbris]

Verified: the new test panics on main (slice bounds out of range for a 1-3 char signature) and passes here; race tests and CI lint for internal/logs clean on top of #1760 and #1762. The one red job, Unit Tests (shuffle), fails in internal/server TestTPAFetchLifecycle (refresh-cycle count), unrelated to this change and green on main.

[Dumbris]

Merged. Thank you, @rudycelekli! A JWT-shaped string with a one-to-three character signature, anywhere in a log line (including upstream tool output), used to panic inside the log sanitizer and take the process down. It is now masked without slicing.

Contributions like this are what keep MCPProxy moving, and they matter a lot to the project.

One small ask, only if you feel like it: a short public note about your change (a tweet, a LinkedIn post, a line in a community you are part of) helps more people discover MCPProxy. No pressure at all, and I would be glad to repost it.