fix(desktop): harden diagnostics log scrubbing to redact URL credentials - #324
Merged
Merged
Conversation
Add a URL-userinfo redaction pattern to DiagnosticsService.scrub() (and pre-scrub the raw text at the two attachPlayer capture sites, belt-and- suspenders) so a scheme://user:pass@host substring is always redacted before it can reach the bounded diagnostics ring buffer or an exported log file. Signed-off-by: badbread <badbread@users.noreply.github.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Hardens the desktop diagnostics log scrubber (
apps/desktop-flutter/lib/services/diagnostics_service.dart) so URL-embedded credentials are always redacted before capture:scrub()gains a userinfo-redaction pattern (scheme://user:pass@host->scheme://[REDACTED]@host).attachPlayer's two capture sites (player error stream, verbose mpv log stream) now pre-scrub the raw text before handing it tolog(), belt-and-suspenders alongside the scrublog()already applies to every message.This closes a gap where a media-player error or verbose log line that echoes back the URL it was opening could carry an unredacted credential into the bounded diagnostics buffer and, from there, into an exported diagnostics file.
Addresses a privately-reported security advisory (GHSA-rpqp-22wr-p5gh) rather than a public issue — see the repo's private security-advisory process in
SECURITY.md.Verification
Not build-verified — the Flutter desktop client is built on a separate Windows host (winbuild) this session did not have access to; no
flutter analyze/flutter testwas run. The change is a self-contained, minimal edit to one file (a new regex-basedString -> Stringtransform plus two call sites now routing through it) with no new imports or API surface. Please runflutter analyze/ the desktop test suite on winbuild before merging.🤖 Generated with Claude Code