t4959: Address 4 review findings in prompt-guard-helper.sh#4967
t4959: Address 4 review findings in prompt-guard-helper.sh#4967alex-solovyev merged 1 commit intomainfrom
Conversation
- Add `key` to credential_exposure detection pattern (inline + YAML) - Add `key` to URL credential sanitization regex - Replace credential-like test literals with PLACEHOLDER_ prefixed values to avoid Gitleaks/secret-scanner false positives - Add test for new key= parameter detection - Short param test already used tracked param (secret=abc), confirmed correct Closes #4959
Summary of ChangesHello, I'm Gemini Code Assist1! I'm currently reviewing this pull request and will post my feedback shortly. In the meantime, here's a summary to help you and other reviewers quickly get up to speed! This pull request enhances the prompt guard helper script and its associated configuration to improve the detection and sanitization of sensitive Highlights
Changelog
Activity
Using Gemini Code AssistThe full guide for Gemini Code Assist can be found on our documentation page, here are some quick tips. Invoking Gemini You can request assistance from Gemini at any point by creating a comment using either
Customization To customize Gemini Code Assist for GitHub experience, repository maintainers can create a configuration file and/or provide a custom code review style guide (such as PEP-8 for Python) by creating and adding files to a Limitations & Feedback Gemini Code Assist may make mistakes. Please leave feedback on any instances where its feedback is incorrect or counter productive. You can react with 👍 and 👎 on @gemini-code-assist comments. If you're interested in giving your feedback about your experience with Gemini Code Assist for GitHub and other Google products, sign up here. You can also get AI-powered code generation, chat, as well as code reviews directly in the IDE at no cost with the Gemini Code Assist IDE Extension. Footnotes
|
|
Caution Review failedPull request was closed or merged during review WalkthroughThese changes address review feedback by adding Changes
Estimated code review effort🎯 2 (Simple) | ⏱️ ~10 minutes Poem
🚥 Pre-merge checks | ✅ 4 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (4 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches
🧪 Generate unit tests (beta)
📝 Coding Plan
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
🔍 Code Quality Report�[0;35m[MONITOR]�[0m Code Review Monitoring Report �[0;34m[INFO]�[0m Latest Quality Status: �[0;34m[INFO]�[0m Recent monitoring activity: 📈 Current Quality Metrics
Generated on: Sun Mar 15 23:33:16 UTC 2026 Generated by AI DevOps Framework Code Review Monitoring |
![gemini-code-assist[bot]](https://avatars.githubusercontent.com/in/956858?s=60&v=4){kind=small}
There was a problem hiding this comment.
Code Review
This pull request successfully addresses several review findings by enhancing credential detection and sanitization. The replacement of test literals with placeholders is a good security practice. The two minor suggestions to improve the consistency of descriptions for the updated detection patterns are valid and have been retained.
| - severity: MEDIUM | ||
| description: "URL query param: api_key/apikey" | ||
| pattern: '[?&](api_key|apikey|api-key)=[^&\s]{8,}' | ||
| description: "URL query param: key/api_key/apikey" |
There was a problem hiding this comment.
To improve clarity and ensure the description perfectly matches the pattern, consider including all variants. The pattern checks for key, api_key, apikey, and api-key, but the description is missing api-key.
description: "URL query param: key/api_key/apikey/api-key"References
- To ensure comprehensive coverage, security detection patterns must include all known variations.
- When applying a fix for a specific pattern, also fix other instances of the same pattern in the file for consistency.
| MEDIUM|credential_exposure|URL query param: secret|[?&]secret=[^&\s]{8,} | ||
| MEDIUM|credential_exposure|URL query param: token|[?&]token=[^&\s]{8,} | ||
| MEDIUM|credential_exposure|URL query param: key|[?&](api_key|apikey|api-key)=[^&\s]{8,} | ||
| MEDIUM|credential_exposure|URL query param: key/api_key|[?&](key|api_key|apikey|api-key)=[^&\s]{8,} |
There was a problem hiding this comment.
For consistency with the pattern and the YAML configuration, it would be best to make this description fully comprehensive. The current description key/api_key is missing apikey and api-key which are present in the regex.
| MEDIUM|credential_exposure|URL query param: key/api_key|[?&](key|api_key|apikey|api-key)=[^&\s]{8,} | |
| MEDIUM|credential_exposure|URL query param: key/api_key/apikey/api-key|[?&](key|api_key|apikey|api-key)=[^& | |
| s]{8,} |
References
- To ensure comprehensive coverage, security detection patterns must include all known variations.
- When applying a fix for a specific pattern, also fix other instances of the same pattern in the file for consistency.
|
1 participant
Summary
keyas standalone credential parameter to detection pattern, sanitization regex, and YAML config — aligning withbuild.txtsection 8.4 which documents?key=as a sensitive URL parametersk_live_,AKIA,SuperSecret123!,eyJhbGci,cs_) withPLACEHOLDER_prefixed values to eliminate Gitleaks/secret-scanner false positiveskey=parameter detectionsecret=abc), no change neededFindings Addressed
key=keyto inline pattern + YAMLkey=keyto sed regexPLACEHOLDER_valueskey=abcsecret=abcin current codeFiles Changed
.agents/scripts/prompt-guard-helper.shkeyto detection + sanitization, placeholder test values, newkey=test.agents/configs/prompt-injection-patterns.yamlkeyto credential_exposure patternVerification
key=detection: exit=2 (WARN on moderate policy) — correctkey=sanitization: value replaced with[REDACTED]— correctsecret=abcshort value: exit=0 (no match) — correctCloses #4959
Summary by CodeRabbit
Bug Fixes
Tests