mirror of
https://github.com/Studio-Saelix/sencho.git
synced 2026-08-10 02:41:14 +00:00
Anso
f03c9dc7b6
* fix(webhooks): close HMAC timing oracle on trigger reject paths The trigger handler in PR #1177 returned a uniform 404 for every unauthenticated rejection, but only the wrong-signature path computed an HMAC over the request body. The other reject paths (unknown id, disabled webhook, non-paid tier, missing X-Webhook-Signature header, missing rawBody) short-circuited before any HMAC work. Repeated near-rate-limit probes with a large attacker-controlled body could distinguish a valid-and-enabled paid webhook id from the other reject cases through response latency. WebhookService.validateSignature is now constant-time over every input shape: it always runs crypto.createHmac and crypto.timingSafeEqual against fixed-length 32-byte buffers regardless of whether the signature is missing, has the wrong prefix, is malformed hex, or is the wrong length. The trigger handler calls it unconditionally before any reject branch fires, using a stable per-process decoy secret (WebhookService.getDecoySecret) when the webhook does not exist and an empty buffer when the request has no body. Response timing now depends only on the size of the request body, which the attacker already controls and which reveals nothing webhook-specific. Six new tests pin the behaviour: validateSignature is observed firing on the unknown-id and missing-signature paths through a spy assertion, and four direct-call tests confirm validateSignature returns false without throwing for empty, wrong-prefix, malformed-hex, and wrong-length signatures. * fix(safe-log): redact Basic auth and lowercase Windows drive letters The redactSensitiveText helper now covers two cases the prior chain missed: * Authorization: Basic <base64> previously left the base64 payload intact. The existing key/value regex caught only the literal word Basic before stopping at the space. A new Basic\s+[A-Za-z0-9+/=]+ replacement runs before the key/value regex so the credential is scrubbed first. * Windows homedir paths like c:\Users\<user>\... with a lowercase drive letter previously slipped through because the regex required [A-Z]. Changed to [A-Za-z] so both letter cases are covered. Two new tests pin both fixes. * docs(webhooks): document 429, fix shared schema, comply with D27/D31 * Trigger endpoint declares the 429 response that webhookTriggerLimiter can return (500 requests per minute per source IP); both docs/openapi.yaml and the response table in docs/features/webhooks.mdx carry the new row, and a new troubleshooting accordion explains the shared-NAT scenario. * Shared Webhook schema in docs/openapi.yaml extends the action enum to include git-pull and documents the node_id property. The GET list endpoint returns these fields; the prior schema would have failed validation for any git-pull row. * docs/features/webhooks.mdx:7 rewritten from a customer-side role enumeration ("non-admins on a paid tier can view the list but cannot manage it") to a single requirement statement ("Webhooks require a Skipper or Admiral license. Managing webhooks is admin-only.") per CLAUDE.md D27/D31; the prior phrasing was customer-side fence-spec. * Two em dashes in webhook description strings I had touched in the prior OpenAPI sync commit replaced with semicolons per D18.
66 lines
2.6 KiB
TypeScript
66 lines
2.6 KiB
TypeScript
import { describe, expect, it } from 'vitest';
|
|
import { redactSensitiveText } from '../utils/safeLog';
|
|
|
|
describe('redactSensitiveText', () => {
|
|
it('redacts credentials from durable log text', () => {
|
|
const text = redactSensitiveText(
|
|
'connect https://user:pass@example.invalid failed Authorization: Bearer abc.def.ghi token=secret123 password=hunter2',
|
|
);
|
|
|
|
expect(text).toContain('https://[redacted]@example.invalid');
|
|
expect(text).toContain('Authorization: [redacted]');
|
|
expect(text).toContain('token=[redacted]');
|
|
expect(text).toContain('password=[redacted]');
|
|
expect(text).not.toContain('user:pass');
|
|
expect(text).not.toContain('abc.def.ghi');
|
|
expect(text).not.toContain('secret123');
|
|
expect(text).not.toContain('hunter2');
|
|
});
|
|
|
|
it('strips Linux-style homedir usernames while keeping the /home/ prefix', () => {
|
|
const text = redactSensitiveText('compose error reading /home/user-linux/docker/compose.yaml');
|
|
|
|
expect(text).not.toContain('user-linux');
|
|
expect(text).toContain('/home/<user>/docker/compose.yaml');
|
|
});
|
|
|
|
it('strips macOS-style homedir usernames while keeping the /Users/ prefix', () => {
|
|
const text = redactSensitiveText('failed to open /Users/user.macos/Projects/app/.env');
|
|
|
|
expect(text).not.toContain('user.macos');
|
|
expect(text).toContain('/Users/<user>/Projects/app/.env');
|
|
});
|
|
|
|
it('strips Windows-style homedir usernames while preserving the drive letter', () => {
|
|
const text = redactSensitiveText(
|
|
'ENOENT: no such file or directory, open \'D:\\Users\\user.windows\\Sencho\\compose.yaml\'',
|
|
);
|
|
|
|
expect(text).not.toContain('user.windows');
|
|
expect(text).toContain('D:\\Users\\<user>\\Sencho\\compose.yaml');
|
|
});
|
|
|
|
it('strips Windows-style homedir usernames when the drive letter is lowercase', () => {
|
|
const text = redactSensitiveText('failed: c:\\Users\\user.lowercase\\app\\compose.yaml');
|
|
|
|
expect(text).not.toContain('user.lowercase');
|
|
expect(text).toContain('c:\\Users\\<user>\\app\\compose.yaml');
|
|
});
|
|
|
|
it('redacts Basic auth credentials embedded after Authorization header', () => {
|
|
const text = redactSensitiveText(
|
|
'upstream 401: Authorization: Basic dXNlcjpwYXNzd29yZA== rejected by registry',
|
|
);
|
|
|
|
expect(text).not.toContain('dXNlcjpwYXNzd29yZA');
|
|
expect(text).toContain('[redacted]');
|
|
});
|
|
|
|
it('redacts a bare Basic auth scheme without an Authorization header', () => {
|
|
const text = redactSensitiveText('curl error: header Basic c2VjcmV0OnZhbHVl was rejected');
|
|
|
|
expect(text).not.toContain('c2VjcmV0OnZhbHVl');
|
|
expect(text).toContain('Basic [redacted]');
|
|
});
|
|
});
|