fix(core): redact secrets and PII from diagnostic output - #600
Closed
rayhanadev wants to merge 1 commit into
Closed
Conversation
Diagnostic messages can embed source fragments (e.g. string literals via stringifyExpressionSnippet), so a hardcoded API key, token, or email in a user's code could be echoed to the terminal / JSON report and POSTed to the score API. Scrub message/help in cleanDiagnosticMessage — the single point every diagnostic flows through — using a high-precision detector for known credential formats, credentialed URLs, private keys, JWTs, emails, and unprefixed high-entropy tokens. Local output and the upload now share the same scrubbed text. Addresses #598. Co-authored-by: Cursor <cursoragent@cursor.com>
Contributor
|
React Doctor found 6 files changed in this pull request, but none matched the files covered by its enabled checks. Scope: 6 files changed on Generated by React Doctor. Questions? Contact founders@million.dev. |
![devin-ai-integration[bot]](https://avatars.githubusercontent.com/in/811515?s=60&v=4){kind=small}
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Closes the privacy gap behind #598. react-doctor's diagnostic
message/helpstrings can embed fragments of the user's source (e.g. string literals echoed viastringifyExpressionSnippetin rules likeno-initialize-state). Those strings are printed to the terminal, written to the--jsonreport, and POSTed to the score API (https://www.react.doctor/api/score) by default. So a hardcoded API key, token, connection string, or email in someone's code could be echoed locally and transmitted off-machine.This adds a high-precision redactor and applies it at
cleanDiagnosticMessageinparse-output.ts— the single point every diagnostic flows through — so the terminal, the JSON report, and the score upload all share the same scrubbed text. react-doctor should never echo or transmit a user's secrets, even locally (CI logs, screen shares, pasted output).What gets redacted (→
<redacted>)ghp_/gho_/github_pat_), GitLab (glpat-), Slack (xox…), Stripe (sk_live_/pk_live_…), OpenAI (sk-…), Google (AIza…/ya29.…)scheme://user:pass@host→scheme://<redacted>@host, host kept)Bearer <token>(keyword kept, token masked)Patterns are intentionally narrow — ordinary identifiers, short captions, and
line:columnnoise are left untouched, so normal diagnostics stay readable.Why redact instead of strip the fields
Investigated the server side in
react-review: scoring (summarizeScore,calculateDoctorScore) and analytics (Axiom) only useplugin/rule/severity— nevermessage/help. But the doctor-CLI ingest does persistmessage/helpto S3 and render them in the dashboard's diagnostics list. Stripping the fields would have required a coordinated, deploy-ordered server schema change and would have gutted the dashboard. Redacting keeps the fields valid and useful while removing the sensitive content, in one repo, with no server coordination.Test plan
pnpm typecheckpnpm test— 1418 pass; the only failure is the pre-existing environmentalunref-stdin-liveTTY probe (unrelated to these files)pnpm lintpnpm format:checkpnpm smoke:json-reportpackages/core/tests/redact-sensitive-text.test.tscovering each detector, false-positive guards, and idempotencyMade with Cursor
Note
Medium Risk
Security-sensitive output path with regex heuristics that could over-redact rare long tokens, but scope is limited to diagnostic text and is well tested.
Overview
Adds
redactSensitiveTextand runs it on every diagnosticmessage/helpincleanDiagnosticMessage(oxlint parse path), so echoed source literals cannot leak API keys, tokens, JWTs, PEM keys, credentialed URLs, Bearer values, emails, or long high-entropy strings to the terminal,--json, or the score API.Detectors are ordered (structured secrets first, then a ≥32-char generic token sweep with letter+digit guards) and replace matches with
<redacted>while keeping normal diagnostic prose readable.GENERIC_SECRET_MIN_LENGTH_CHARSis exported from core; the helper is re-exported from@react-doctor/core, with unit tests covering each pattern, false positives, and idempotency. Patch changeset included.Reviewed by Cursor Bugbot for commit 9f52803. Bugbot is set up for automated code reviews on this repo. Configure here.