Repository navigation
fix(app-restart): mask quoted secrets with spaces whole; add Pwd and Credential (follow-up to #403) - #406
Merged
Conversation
…Credential to the secret words Follow-up to #403. Each argument is masked before it is quoted for display; the executed argv is untouched (tested). Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
… forks, real-launch argv test Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Follow-up to #403.
Direct lane (changes to
project-bin/)What changed and why: #403 review found that a quoted secret with spaces still showed everything after its first word, for
--constant "Mod.ApiKey=two words"and--db-password 'two words'(the quoted-flag case leaked before #403 too).mask()inproject-bin/app-restart.shnow masks each argument before quoting it for display, so the whole quoted value goes.PwdandCredentialjoin the secret words (PassphraseandClientSecretwere already covered byPassandSecret). An env assignment at the start of a--cmdstring (DB_PASSWORD=x ./mxcli run ...) keeps the whole command visible, only the value masked, also on the refusal message. Display path only: the executed argv is untouched, and a real-launch test proves the started app receives the raw argv (a stub app records its argv). Known over-mask kept, not widened: the word match is a substring, soMonkey(Key) andTurkeymask too; a new test pins it.Impact
project-bin/app-restart.sh,tests/wave2/test-app-restart.sh,CHANGELOG.md. No shared helper touched; independent of other open PRs. No new tools.mask()call including bash start: master about 53 ms, first version of this PR about 590 ms, now about 56 ms (sed forks only for arguments holding a secret word, found by a bash glob). Once per restart.Categorisation: kind: fix; lane: Direct; size: small (3 files); regression risk: low (display only); toolkit: mxcli-project-toolkit.
Field evidence: found in review of #403 (
reviews/403.md); the leaking inputs were reproduced against master'smask().tests/wave2/test-app-restart.shPASS=96 FAIL=0 on the branch (macOS, no-opsetsidshim on PATH). The new cases run against master'smask()give PASS=88 FAIL=8.CHANGELOG.mdline appended, creditedRemaining known leak: a secret whose name has no secret word (e.g.
Mod.Salt=x), and a value containing an embedded quote character inside a quoted secret.🤖 Generated with Claude Code