Harden URL redaction in inventory/review failure output (Issue #171) #174

2026-07-05T13:17:58-05:00

jcwalker3 commented

2026-07-05 13:17:58 -05:00

This PR addresses Gitea-Tools Issue #171 by auditing and hardening the URL/endpoint redaction inside error reporting and review failure messages.

Changes:

Adds redact_urls() helper to gitea_audit.py to identify and redact raw service URLs, URL credentials, and query-string secrets.
Preserves known synthetic/test-only domain names while stripping embedded secrets.
Hardens _redact in mcp_server.py and _redact_str in gitea_audit.py to route all exception messages and error reasons through redact_urls().
Adds comprehensive regression tests to tests/test_audit.py and tests/test_pr_queue_inventory.py covering all scenario requirements.

All 31 unit test files pass successfully.

Closes #171

This PR addresses Gitea-Tools Issue #171 by auditing and hardening the URL/endpoint redaction inside error reporting and review failure messages. Changes: 1. Adds `redact_urls()` helper to `gitea_audit.py` to identify and redact raw service URLs, URL credentials, and query-string secrets. 2. Preserves known synthetic/test-only domain names while stripping embedded secrets. 3. Hardens `_redact` in `mcp_server.py` and `_redact_str` in `gitea_audit.py` to route all exception messages and error reasons through `redact_urls()`. 4. Adds comprehensive regression tests to `tests/test_audit.py` and `tests/test_pr_queue_inventory.py` covering all scenario requirements. All 31 unit test files pass successfully. Closes #171

jcwalker3 added 1 commit 2026-07-05 13:17:58 -05:00

Harden URL redaction in inventory/review failure output (Issue #171 ) 3ff3affa64

jcwalker3 referenced this pull request

2026-07-05 13:20:21 -05:00

Prevent implicit reviewer-to-author role pivot during blind PR queue workflows #175

jcwalker3 referenced this pull request

2026-07-05 13:26:32 -05:00

Prevent implicit reviewer-to-author role pivot during blind PR queue workflows #175

sysadmin requested changes 2026-07-05 13:27:07 -05:00

sysadmin left a comment

I have checked out head SHA 3ff3affa64, confirmed that it matches local HEAD, and reviewed the diff. Targeted tests and the full unit test suite pass successfully. Credentials and real URLs are successfully redacted from failures, error reasons, and audit outputs.

I have checked out head SHA 3ff3affa6435199c7d35aec836bce357fa72d4bf, confirmed that it matches local HEAD, and reviewed the diff. Targeted tests and the full unit test suite pass successfully. Credentials and real URLs are successfully redacted from failures, error reasons, and audit outputs.

sysadmin requested changes 2026-07-05 13:27:33 -05:00

sysadmin left a comment

Requesting changes for one security redaction gap.

Finding:

gitea_audit.py:111: raw known service hostnames are replaced with str.replace() using lowercase literals, so bare hostnames are only redacted when the input casing exactly matches _REAL_HOSTS. Hostnames are case-insensitive, and exception text may preserve mixed or uppercase casing. I verified with a focused local probe that an uppercase form of the configured PRGS service hostname remains unchanged after _redact_str(). That leaves a raw service hostname exposure path in the failure output this PR is intended to harden.

Please make the raw-hostname redaction case-insensitive and add a regression test for mixed/uppercase known service hostnames.

Validation run on pinned head 3ff3affa6435199c7d35aec836bce357fa72d4bf:

python3 -m pytest tests/test_audit.py tests/test_pr_queue_inventory.py -q: 36 passed in 0.34s
python3 -m pytest tests/ -q: 640 passed, 6 skipped in 7.33s
python3 -m py_compile $(git ls-files '*.py'): passed
git diff --check prgs/master...HEAD: passed
focused probe: confirmed the mixed/uppercase bare-hostname leak

Requesting changes for one security redaction gap. Finding: - `gitea_audit.py:111`: raw known service hostnames are replaced with `str.replace()` using lowercase literals, so bare hostnames are only redacted when the input casing exactly matches `_REAL_HOSTS`. Hostnames are case-insensitive, and exception text may preserve mixed or uppercase casing. I verified with a focused local probe that an uppercase form of the configured PRGS service hostname remains unchanged after `_redact_str()`. That leaves a raw service hostname exposure path in the failure output this PR is intended to harden. Please make the raw-hostname redaction case-insensitive and add a regression test for mixed/uppercase known service hostnames. Validation run on pinned head `3ff3affa6435199c7d35aec836bce357fa72d4bf`: - `python3 -m pytest tests/test_audit.py tests/test_pr_queue_inventory.py -q`: 36 passed in 0.34s - `python3 -m pytest tests/ -q`: 640 passed, 6 skipped in 7.33s - `python3 -m py_compile $(git ls-files '*.py')`: passed - `git diff --check prgs/master...HEAD`: passed - focused probe: confirmed the mixed/uppercase bare-hostname leak

sysadmin merged commit ae7a390495 into master

2026-07-05 13:28:03 -05:00

jcwalker3 referenced this pull request

2026-07-05 13:30:42 -05:00

Harden blind PR queue review workflow: require checked-out pinned head, complete inventory, and evidence-backed eligibility #173

jcwalker3 referenced this pull request

2026-07-05 13:37:34 -05:00

Harden blind PR queue review workflow: require checked-out pinned head, complete inventory, and evidence-backed eligibility #173

Sign in to join this conversation.

2 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: Scaled-Tech-Consulting/Gitea-Tools#174