You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
{{ message }}
Repository navigation
Commit d8ef2e5
Browse filesBrowse the repository at this point in the historyBrowse files
* chore(release): 3.4.0
Stamps [Unreleased] as [3.4.0], bumps the version files and uv.lock, and
synchronizes the current-release references across README.md and docs/**.
Minor rather than patch: #119 changes the snippet, detailed report, dataflow
trace and description that every consumer of a finding reads, and adds the
`redact` rule-metadata key. Also records the socketdev 3.5.0 -> 3.6.0 lockfile
bump from #117, which merged without a changelog entry.
* fix(redaction): treat plain-text-password as logic, not a credential
The rule that fragment names matches password *handling* -- assigning request
input to a password field, or comparing against one -- so its match is an
expression rather than a literal. Running the literal pass on it reduced
`user.password = request.form.get('password')` to a row of asterisks, which is
the rule's main pattern and leaves nothing to act on. It belongs with
`hardcoded-ip` and the password-policy rules, which the same comment already
excludes for the same reason. A comparison against a hardcoded value is the one
shape it covers that carries a credential, and that is what the `hardcoded-*`
rules are for.
Also folds a duplicated TestRedactMessage class into one. The second definition
shadowed the first, so two message tests never ran.
* fix(redaction): serve both shapes of the password-logic rule
Dropping plain-text-password from the credential fragments fixed the
over-masking but opened a hole: one of that rule's patterns is a comparison
against a hardcoded string, and no hardcoded-* rule matches that shape, so
`if user.password == "hunter2"` went into the facts file verbatim. Confirmed
by scanning a file with exactly that line.
The fragment goes back, and the over-masking is fixed where it belongs. An
assigned value that calls something is an expression, not a bare credential, so
it skips the unquoted fallback and the literal pass masks just the quoted parts.
`user.password = request.form.get('password')` keeps its expression, the
comparison value is masked, and a bare value with a trailing comment is still
masked whole so a short credential cannot be partly revealed.
* fix(redaction): bind the right operator and mask trailing comments
Three defects in the unquoted-assignment fallback, found by working through the
shapes the credential rules actually produce.
A call matched anywhere in the value skipped masking entirely, so
`password: hunter2 # see get_secret()` kept the credential. The check is now
anchored: only a value that opens with a call is treated as an expression.
The first operator on the line bound, so a type annotation won over the
assignment after it and `password: str = "..."` was starred out whole rather
than reaching the literal pass -- ordinary Python and TypeScript. The last
operator now binds, and operators covered by a string literal are skipped so
the `:` in `url = "https://..."` cannot bind either. That needs the literal
spans, which one regex cannot express, so _split_assignment walks the matches.
Masking the value left a comment beside it holding the plaintext, as in
`password = get_secret() # real value is hunter2`. Text after an unquoted
comment marker is now masked too.
Also stops measuring an unquoted value together with whatever follows it.
`password: hunter2 # plain comment` is long enough for a partial reveal even
though `hunter2` is not, and it was rendering as `password: hunt...ment`.
* fix(redaction): take the comment off first and mask per statement
Two ways a credential stayed in the part of the line the value search never
looked at.
A comment can hold an operator later in the line than the real one. Because the
comment was masked after the operator was chosen, that one bound and the value
in front of it was left in the head: `password = hunter2 # see x = y` kept
hunter2. The comment now comes off before anything else reads the line.
A line can also carry more than one statement, and only one operator binds per
statement, so `a = hunter2; password = x` masked the second value and left the
first. Masking now runs per statement, split on separators outside string
literals.
* fix(redaction): measure literal spans over the snippet, not per line
A literal can open on one line and close on another. Spans were computed per
line, so a marker on a literal's second line read as a comment and the rest of
that line was starred -- dropping the closing quote, after which the literal
pass no longer matched and the opening line's value survived.
Spans are now measured once over the whole snippet and consulted by absolute
position. Two things fall out of that.
A snippet is a slice of a file, so a literal can also never close. The quoted
value branch deferred to the literal pass, which never matches an unterminated
literal, so `password = "hunter2` was left untouched. It now defers only when
the quote opens a span the pass can find, and masks the value whole otherwise.
A multi-line literal body was measured as one value, so the head-and-tail
reveal exposed the start of its first line. Each line of such a body is now
masked whole, with the line breaks kept so the snippet still shows where the
literal begins and ends.
* fix(redaction): recognize string prefixes and interpolated bodies
A prefixed opener such as r""" or f""" was not read as opening a literal, so
the opening line was starred and its quotes were removed. Later lines were
still measured against the original spans, which said they were inside a
literal, so nothing masked them and the final literal pass no longer matched.
The prefix is now part of the opener check.
That alone left a partial reveal: literal text around an interpolation inflates
the body past the reveal threshold, so f"{b}_SuperSecret123!" showed 123!. An
interpolated body is masked whole, on the same reasoning as a multi-line one --
it is a block of content, not a single opaque value.
* fix(redaction): do not defer on a spurious empty-literal match
An unterminated triple-quoted value still produces a literal match: the engine
backtracks past the triple alternative and reads the first two quotes as an
empty string. That match was enough to send the value to the masking pass,
which then covered only those two quotes, so the credential stayed in the
snippet. Affects bare and prefixed openers alike.
Deferring now requires a span that starts at the quote and holds both
delimiters, which an empty match cannot satisfy. _STRING_LITERAL also gained
triple-quoted alternatives so a terminated block matches once with its real
body rather than as an empty string followed by a second literal.
* fix(redaction): fail safe when string state is lost, and fuzz the invariant
A generated-snippet sweep found three gaps the hand-written cases did not,
all of them the same thing: masking depends on knowing where string literals
start and end, and a truncated snippet can make that unknowable.
An unterminated literal is not reached by the assignment fallback when the
value sits in a comparison or a call argument, so it went to the masking pass,
which cannot match it. A quote outside every matched span now marks the rest of
the line as literal content.
An unclosed triple-quoted block does not simply fail to match -- its first two
quotes match as an empty string and the third pairs with any stray quote later,
producing one long span that hides a real assignment on a later line. An odd
count of triple delimiters now masks from the opener to the end.
A " or ' literal cannot hold a raw newline in any language these rules cover,
so a match that does is the same pairing artifact rather than a literal. Those
spans are discarded; backticks and triple quotes keep theirs.
tests/test_secret_redaction_fuzz.py generates the combinations rather than
listing them, and asserts no credential survives, none is partly revealed, and
non-credential snippets come through unchanged. 2,000,000 generated cases pass;
20,000 run in CI in about a second.
* fix(redaction): mask to the end of a snippet once string state is lost
Bugbot found that a credential on a continuation line survived, and extending
the fuzzer to put the secret after the line break -- it had only ever put it
before -- found a second case immediately.
Both are the same thing: masking that stops at the opening line. Where a
literal opens and its end is unknowable, everything after is inside it as far
as any reader can tell, so masking now runs to the end of the snippet rather
than the end of the line. The two ways state is lost -- a quote no surviving
span covers, and an odd number of triple delimiters -- are handled together
instead of separately.
The second case was the opposite failure. Masking an unquoted value whole
destroyed the opening quote of a literal that continued past the line, so the
snippet-wide pass afterwards no longer matched and the rest of the literal was
left alone. Such a value is now masked only up to the opener, and the pass
takes the literal itself.
Both generators put the secret on either side of a line break, so the shape is
covered from here on. 1,000,000 generated cases pass.
* fix(redaction): fail closed on ambiguous credential syntax
0 commit comments