From 91aeca04402afa4d29ad7061928ce8193fc7ba9d Mon Sep 17 00:00:00 2001 From: Diego Rodrigues de Sa e Souza Date: Wed, 26 Aug 2026 10:59:26 -0300 Subject: [PATCH] fix(security): redact NVIDIA_API_KEY at the log sink in the ad-hoc diag script (#11639) Merged via /merge-batch (2026-08-26, v3.8.51). Validado no worktree combinado. --- scripts/ad-hoc/nvidia-startswith-diag.ts | 23 ++++++++++++++++++----- 1 file changed, 18 insertions(+), 5 deletions(-) diff --git a/scripts/ad-hoc/nvidia-startswith-diag.ts b/scripts/ad-hoc/nvidia-startswith-diag.ts index 8baa647c7d..4d8bc1931a 100644 --- a/scripts/ad-hoc/nvidia-startswith-diag.ts +++ b/scripts/ad-hoc/nvidia-startswith-diag.ts @@ -19,12 +19,20 @@ */ const KEY = process.env.NVIDIA_API_KEY ?? ""; -const BASE_URL = process.env.NVIDIA_BASE_URL || "https://integrate.api.nvidia.com/v1/chat/completions"; +const BASE_URL = + process.env.NVIDIA_BASE_URL || "https://integrate.api.nvidia.com/v1/chat/completions"; const MODEL = process.env.NVIDIA_MODEL || "openai/gpt-oss-120b"; // Neutralize CR/LF before logging so env-derived values (NVIDIA_MODEL, etc.) -// cannot forge extra log lines (S5145 log injection). -const line = (s = "") => console.log(String(s).replace(/[\r\n]+/g, " ")); +// cannot forge extra log lines (S5145 log injection). Also strip any raw +// occurrence of the API key so an upstream error/response that echoes it +// back (e.g. inside err.stack or a validation result) never reaches the +// terminal in clear text (js/clear-text-logging, CWE-312/532). +const line = (s = "") => { + let out = String(s).replace(/[\r\n]+/g, " "); + if (KEY) out = out.split(KEY).join("[REDACTED]"); + console.log(out); +}; const hr = () => line("─".repeat(72)); function show(label: string, value: unknown) { @@ -52,8 +60,13 @@ async function partA() { }); line(" ✅ validateProviderApiKey retornou (sem crash):"); show("resultado", result); - if (typeof (result as any)?.error === "string" && (result as any).error.includes("startsWith")) { - line(" ⚠️ A mensagem de erro contém 'startsWith' → crash CAPTURADO dentro do try/catch da validação."); + if ( + typeof (result as any)?.error === "string" && + (result as any).error.includes("startsWith") + ) { + line( + " ⚠️ A mensagem de erro contém 'startsWith' → crash CAPTURADO dentro do try/catch da validação." + ); } } catch (err: any) { line(" ❌ validateProviderApiKey LANÇOU (crash não tratado):");