fix(mitm): mask bare "Bearer <token>" header values in the inspector - #4358
Merged
Merged
Conversation
sanitizeHeaders() masks header *values* — it calls maskSecret("Bearer
<token>") with the "authorization:" key already stripped. The BEARER regex
was anchored to a literal "authorization:" prefix, so it never fired on those
values; tokens shorter than the sk-(16+)/opaque-(40+) thresholds then leaked
verbatim into the Traffic Inspector buffer (Hard Rule #12).
Found by the AgentBridge live capture: a 'Bearer sk-secret-TESTE' request
header showed up unmasked in /api/tools/traffic-inspector/requests. Real Google
OAuth tokens are long enough to be caught by LONG_TOKEN, but the Bearer pattern
must mask regardless of length.
Re-anchor BEARER to a standalone \bBearer\s+<token> (still ReDoS-safe:
bounded char class, no nested quantifiers). Masks both bare 'Bearer <token>'
header values and 'authorization: Bearer <token>' raw lines; existing cases
(sk-/ak-/pk- keys, short keys, no-secret strings) unchanged.
Tests: bare Bearer value, short opaque Bearer, realistic Google OAuth Bearer,
plus an authorization:-prefixed regression.
Contributor
|
Warning You have reached your daily quota limit. Please wait up to 24 hours and I will start processing your requests again! |
|
You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard. |
diegosouzapw
added a commit
that referenced
this pull request
Jun 20, 2026
Merged
tkgo11
pushed a commit
to tkgo11/OmniRoute
that referenced
this pull request
Sep 23, 2026
…iegosouzapw#4358) sanitizeHeaders() masks header *values* — it calls maskSecret("Bearer <token>") with the "authorization:" key already stripped. The BEARER regex was anchored to a literal "authorization:" prefix, so it never fired on those values; tokens shorter than the sk-(16+)/opaque-(40+) thresholds then leaked verbatim into the Traffic Inspector buffer (Hard Rule diegosouzapw#12). Found by the AgentBridge live capture: a 'Bearer sk-secret-TESTE' request header showed up unmasked in /api/tools/traffic-inspector/requests. Real Google OAuth tokens are long enough to be caught by LONG_TOKEN, but the Bearer pattern must mask regardless of length. Re-anchor BEARER to a standalone \bBearer\s+<token> (still ReDoS-safe: bounded char class, no nested quantifiers). Masks both bare 'Bearer <token>' header values and 'authorization: Bearer <token>' raw lines; existing cases (sk-/ak-/pk- keys, short keys, no-secret strings) unchanged. Tests: bare Bearer value, short opaque Bearer, realistic Google OAuth Bearer, plus an authorization:-prefixed regression.
tkgo11
pushed a commit
to tkgo11/OmniRoute
that referenced
this pull request
Sep 23, 2026
…post-lote drift) (diegosouzapw#4370) Concurrent-session PRs (diegosouzapw#4355/diegosouzapw#4364/diegosouzapw#4363/diegosouzapw#4358/diegosouzapw#4332) added a new conditional after diegosouzapw#4338 ratcheted to 1895; release fast-path doesn't run check:complexity. Measured 1896.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Security fix surfaced by the AgentBridge live capture (the #4285/#4299 validation on the lab VPS): a request header
Authorization: Bearer sk-secret-TESTEshowed up unmasked in/api/tools/traffic-inspector/requests.Root cause:
sanitizeHeaders()masks header values — it callsmaskSecret("Bearer <token>")with theauthorization:key already stripped. But theBEARERregex was anchored to a literalauthorization:prefix, so it never fired on bare header values. Tokens shorter than thesk-(16+) / opaque-(40+) thresholds then leaked verbatim (Hard Rule #12).Real Google OAuth tokens are long enough to be caught by
LONG_TOKEN, so the practical risk was low — but theBearerpattern must mask regardless of token length/shape.Fix: re-anchor
BEARERto a standalone\bBearer\s+<token>. Still ReDoS-safe (bounded char class, no nested quantifiers). Masks bothBearer <token>header values andauthorization: Bearer <token>raw lines.Test Plan
mitm-masksecrets.test.ts— +4: bareBearervalue, short opaqueBearer, realistic Google OAuthBearer, and anauthorization:-prefixed regressioncli-output.test.ts(the othermaskSecretconsumer) greentypecheck:coreclean, lint cleansecret-vazou? falsein the inspector on the next deploy (maskSecrets compiles into.next)Follow-up to #4285 (Traffic Inspector capture) — same lab-VPS validation that found it.