From fa957ca291faa6cf410caff0af9378aa2057463f Mon Sep 17 00:00:00 2001 From: "google-labs-jules[bot]" <161369871+google-labs-jules[bot]@users.noreply.github.com> Date: Sun, 30 Aug 2026 21:02:25 +0000 Subject: [PATCH] =?UTF-8?q?=F0=9F=9B=A1=EF=B8=8F=20Sentinel:=20[HIGH]=20Fi?= =?UTF-8?q?x=20quoted=20secret=20redaction=20bypass?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- .jules/sentinel.md | 5 +++++ src/core/security/redaction.ts | 3 ++- 2 files changed, 7 insertions(+), 1 deletion(-) diff --git a/.jules/sentinel.md b/.jules/sentinel.md index ba0e09e7..71acfeea 100644 --- a/.jules/sentinel.md +++ b/.jules/sentinel.md @@ -2,3 +2,8 @@ **Vulnerability:** The default dangerous patterns in `SkillParser.extractCommands` (`DEFAULT_DANGEROUS_PATTERNS`) caught `curl ... | sh` but missed `wget ... | sh`, which is an equivalent vector for remote code execution via piped download. Also, variants like `bash`, `zsh`, or `python` were missed. **Learning:** Hardcoded regexes for malicious shell patterns are prone to bypasses if they don't account for common aliases/alternatives (e.g., `wget` instead of `curl`, or `bash`/`zsh` instead of `sh`). **Prevention:** Include broader shell command matching for network downloaders piped to interpreters. + +## 2026-08-30 - Fix Quoted Secret Redaction Bypass +**Vulnerability:** The redaction regex `KV_PATTERN` failed to match and redact quoted secret values (e.g., `password="mysecret"`), potentially leaking credentials in audit logs. +**Learning:** Regular expressions for sanitizing key=value pairs must account for quoted values by explicitly including `"[^"]*"` and `'[^']*'` in the matching group. +**Prevention:** When writing regex for secrets matching, always include patterns for both quoted and unquoted strings to prevent simple bypasses. \ No newline at end of file diff --git a/src/core/security/redaction.ts b/src/core/security/redaction.ts index 4e6483b4..0e099ba0 100644 --- a/src/core/security/redaction.ts +++ b/src/core/security/redaction.ts @@ -105,7 +105,8 @@ const SIMPLE_PATTERNS: Array = [ /\b(?:\d{1,3}\.){3}\d{1,3}\b/g, ]; -const KV_PATTERN = /(\b(?:token|secret|password|api[_-]?key)\b\s*[:=]\s*)([^\s,'"]+)/gi; +const KV_PATTERN = + /(\b(?:token|secret|password|api[_-]?key)\b\s*[:=]\s*)("[^"]*"|'[^']*'|[^\s,'"]+)/gi; const QUERY_PATTERN = /([?&](?:token|secret|password|api_key|apikey)=)([^&\s]+)/gi; compiledPatterns = [...SIMPLE_PATTERNS];