Repository navigation
[sec-bus] redact: match host redaction policies - #17
Merged
senamakel merged 16 commits intoOct 25, 2026
Merged
Conversation
…prompts Add tests for redaction of URL-encoded and base64 secret forms, for JSON sanitization dropping sensitive keys and reporting changes, and for the scored prompt path returning a review tier on oversized input without echoing it. The existing oversized-prompt test now targets the plain scan entry point so both paths are exercised. Auto-committed-on: cuttlefish Co-authored-by: Medulla <medulla@tinyhumans.ai>
Adds a sanitize_json method that walks JSON values, drops entries whose keys look sensitive, and runs string values through the existing bounded pattern registry, returning a content-free tally of the edits made. Oversized prompt scans now return a review tier with an input.oversized rule id instead of failing, and the pattern registry gains base64 and percent-encoding decoding so encoded secrets are still matched. Auto-committed-on: cuttlefish Co-authored-by: Medulla <medulla@tinyhumans.ai>
… validation Add tests asserting that structured argument redaction matches host key lists and redacts nested secret patterns, and that scanning a tool definition rejects non-object JSON. Auto-committed-on: cuttlefish Co-authored-by: Medulla <medulla@tinyhumans.ai>
The replacement closure now borrows the pre-replacement string when computing match context, so offsets stay valid as earlier rules rewrite the buffer. Card validation also drops the issuer prefix check and calls the full validator, letting Luhn and length decide instead of rejecting valid numbers from unlisted issuers. Auto-committed-on: cuttlefish Co-authored-by: Medulla <medulla@tinyhumans.ai>
Clarify the boot diagnostic redaction floor exception for synchronous Sentry and pre-module request logging, and note that the optional host classifier is dropped in favour of the deterministic owner scorer. Also spell out that ScanToolDefinition takes a complete JSON object built by the caller, that oversized ScanPrompt2 input returns review rather than a partial score, and that card detection now requires a valid Luhn checksum with an issued IIN or nearby keyword. Auto-committed-on: cuttlefish Co-authored-by: Medulla <medulla@tinyhumans.ai>
The Validator enum now derives PartialEq and Eq so its variants can be compared directly, which callers need when checking validation results. Auto-committed-on: cuttlefish Co-authored-by: Medulla <medulla@tinyhumans.ai>
Card numbers now require a plausible issuer prefix and a valid Luhn checksum, and the context check no longer bypasses validation, so timestamps and other long digit runs are left untouched. Percent-encoded secret forms are also matched case-insensitively and no longer treat unreserved punctuation as literal. Auto-committed-on: cuttlefish Co-authored-by: Medulla <medulla@tinyhumans.ai>
The assertion for the redacted X-Amz-Signature value expected a 16-character placeholder, but the fixture produces a 17-character string, so the test now matches the actual redaction output. Auto-committed-on: cuttlefish Co-authored-by: Medulla <medulla@tinyhumans.ai>
The context window around a match is now widened to the nearest UTF-8 character boundaries before slicing, so multibyte input no longer panics when the 64-byte window lands mid-character. Percent-encoded forms are also built directly in lowercase instead of lowercasing the whole string afterwards, which avoids mangling any non-ASCII bytes. Auto-committed-on: cuttlefish Co-authored-by: Medulla <medulla@tinyhumans.ai>
The card number validator only accepted numbers starting with 3 through 7, so valid 2-series ranges such as 2221–2720 were rejected. The check now also allows a leading 2 when the second digit falls between 2 and 7. Auto-committed-on: cuttlefish Co-authored-by: Medulla <medulla@tinyhumans.ai>
Add a test asserting that every key in the host approval key set is treated as a sensitive JSON key, and that presigned and canonical variants are recognized as content keys. This guards against regressions where a key silently stops being redacted. Auto-committed-on: cuttlefish Co-authored-by: Medulla <medulla@tinyhumans.ai>
The module docs now state that inputs above the 64 KiB scorer ceiling receive `Review` with `input.oversized` and a zero score, so callers fail closed without attempting a partial scan. Auto-committed-on: cuttlefish Co-authored-by: Medulla <medulla@tinyhumans.ai>
Reformatted expressions and assertions across the redact crate so the code matches rustfmt output, with no behavioural change. Auto-committed-on: cuttlefish Co-authored-by: Medulla <medulla@tinyhumans.ai>
Added an `# Errors` section to `sanitize_json` describing when it returns a content-free error, so callers know the failure modes without reading the implementation. Also replaced a panicking `expect` in the pattern replacement closure with a graceful fallback to an empty string, avoiding a crash if a capture group is unexpectedly absent. Auto-committed-on: cuttlefish Co-authored-by: Medulla <medulla@tinyhumans.ai>
Clarify in the README that structured arguments rely on the host's approval count/type markers, currently 58 entries in the OpenHuman approval table, and reflow the surrounding paragraph so the explanation of embedded string values and credential key matching reads continuously. Auto-committed-on: cuttlefish Co-authored-by: Medulla <medulla@tinyhumans.ai>
Co-authored-by: Medulla <medulla@tinyhumans.ai>
senamakel
merged commit Oct 25, 2026
7c8c24b
into
epic/8369-security-migration
14 of 16 checks passed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Closes #9
Implements redaction parity and prompt-boundary behavior on the TinySecurity migration branch.
Sanitized<T>change report.input.oversizedfor ScanPrompt2 inputs above 64 KiB.Validation:
cargo test --workspace;cargo build --workspace;cargo clippy --workspace --all-targets -- -D warnings;cargo fmt --all -- --check. Redactor package: 58 unit tests, 13 acceptance, 8 corpus, 7 review regressions, and doctests. Sandbox package: 66 tests and doctests.No OpenHuman caller migration or release checksum is included.