mirror of
https://github.com/diegosouzapw/OmniRoute.git
synced 2026-09-14 10:52:17 +03:00
c93d4542bb
#12620 landed first and fixed GHSA-qv45-56jc-4wmj by adding RAW_CREDENTIAL_PATTERNS to error.ts and importing them from upstreamErrorPassthrough.ts. This branch fixes the same class differently, by splitting error.ts into errorSanitization.ts + errorPathRedaction.ts. Kept this branch's split. Its STRONG_CREDENTIAL_TOKEN already covered sk-/sk_ (with a lookbehind and an embedded-prefix variant that catches sk-proj-…), plus Slack xox-, AWS AKIA/ASIA, github_pat_/ghp_/glpat- and three-segment JWTs — a strictly wider vocabulary than the three patterns #12620 introduced. The one shape #12620 carried and this set did not is Google's AIza…, now added here with the same bounded quantifier its siblings use. Verified against #12620's own suites rather than by inspection: 48/48 across error-sanitizer-sk-key-qv45, bifrost-relay-response-leak-9m72, search-baseurl-client-override-3f8g and search-baseurl-ssrf-guard — including that suite's anti-drift assertion (for every body the passthrough layer refuses as leaky, the fallback sanitizer must not return it unchanged). This branch's own 21 test files: 259/259. typecheck:core clean.