Repository navigation
fix(logs): mask the whole Bearer credential and unsigned JWTs - #1792
Merged
Merged
Conversation
Patterns run sequentially over the rewritten string and every mask inserts "***", which no pattern's character class accepts. github_token/openai_key/ anthropic_key ran before bearer_token, so "Bearer sk-...<rest>" was masked at the key and bearer stopped at the inserted mask, logging <rest> in clear. The same applied to a key-shaped run after a '-' inside a JWT segment. Run bearer_token, then jwt, before the key-specific patterns. Allow an empty JWT signature segment (alg: none) and drop the trailing \b that made such a token unmatchable, so its payload is masked. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Deploying mcpproxy-docs with
|
| Latest commit: |
46a3fc9
|
| Status: | ✅ Deploy successful! |
| Preview URL: | https://df6f6616.mcpproxy-docs.pages.dev |
| Branch Preview URL: | https://claude-competent-panini-fb07.mcpproxy-docs.pages.dev |
Contributor
📦 Build ArtifactsWorkflow Run: View Run Available Artifacts
How to DownloadOption 1: GitHub Web UI (easiest)
Option 2: GitHub CLI gh run download 40317521543 --repo smart-mcp-proxy/mcpproxy-go
|
|
Codecov Report❌ Patch coverage is
📢 Thoughts on this report? Let us know! |
…ni-fb070b # Conflicts: # internal/logs/sanitizer.go
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Fixes two secret leaks in
internal/logs/sanitizer.gothat were already onmain.1. Bearer suffix leak (pattern order). The patterns run one after another over the rewritten string, and every mask inserts
***, which no pattern's character class accepts.github_token,openai_keyandanthropic_keyran beforebearer_token. So when a Bearer credential started with a known key prefix, the key pattern masked it first, and bearer then stopped at the inserted***:The same thing could happen inside a JWT: a key-shaped run after a
-in a segment got masked beforejwtran, and the payload and signature were logged. The fix runsbearer_token, thenjwt, before the key-specific patterns. A comment above the patterns now states the ordering rule.2. Unsigned JWT (
alg: none).eyJhbGciOiJub25lIn0.eyJzdWIiOiIxIn0.has an empty third segment, and the trailing\bcould never match after a., so the payload was logged in clear. The third segment is now[A-Za-z0-9\-_]*and the trailing\bis gone. The output isheader.***.***.Existing mask formats are unchanged. That includes the tests from #1760, #1761 and #1762. A credential after
Bearernow gets the Bearer mask instead of the key mask.Testing
internal/logs/sanitizer_pattern_order_test.go: Bearer + sk-/sk-proj-/ghp_/sk-ant- suffix, a JWT with a key-shaped run inside it, and an unsigned JWT in four contexts. All of these failed before the fix.go test -race ./internal/logs/passes..github/.golangci.yml) reports 0 issues, both bare and with--build-tags server.🤖 Generated with Claude Code