fix(context): quoted secret assignments + fail-closed revision/body (#62) - #116
Merged
Conversation
…vision/body (#62) Concentrated-review pass on the two most-reopened surfaces found three more gaps: - quoted secret assignments bypassed the raw-string screen: token="secret", JSON "token": "secret", dotenv/shell export TOKEN="…" all returned safe because the value char class excluded quotes and the separator had to abut the key. SENSITIVE_ASSIGNMENT now allows an optional quote around the key and the value. - a pathological revision (e.g. 400 digits) passed the unbounded /^[1-9]\d*$/ regex, parsed to Infinity, and serialized to null. Revision and issue digits are now bounded (<=9), so such a header is malformed — fail closed. - a non-string body was coerced to "" in replaceManagedRevision (and the CLI's `?? ""`), so the CLI exited 0 and silently discarded the original input. A non-string body now throws invalid-managed-body; null/undefined still mean a fresh create. The CLI passes body through so the error surfaces (non-zero exit). Reverse tests: five quoted/dotenv/JSON secret shapes; a 400-digit revision → malformed; non-string bodies → throw (function + CLI). Adapters regenerated. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01KwyFyRC6pepaK6DuMK7YeT
huiyu
added a commit
that referenced
this pull request
Aug 26, 2026
…n (campaign 10, #116) The concentrated review found 3 more gaps on the two most-reopened files (quoted secret assignments, 400-digit revision -> Infinity/null, non-string body coerced to empty). All fixed in #116. 43/43 threads resolved. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01KwyFyRC6pepaK6DuMK7YeT
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Campaign-10 fix #1 — the 3 gaps the concentrated review found (1 blocker, 1 important split in two).
token="secret", JSON"token": "secret", dotenv/shellexport TOKEN="…"all returnedsafe— the value char class excluded quotes and the separator had to abut the key.SENSITIVE_ASSIGNMENTnow allows an optional quote around the key and the value./^[1-9]\d*$/, parsed toInfinity, and serialized tonull. Revision/issue digits are now bounded (≤9) → malformed (fail closed).""inreplaceManagedRevisionand the CLI's?? "", so the CLI exited 0 and silently discarded the input. A non-string body now throwsinvalid-managed-body(non-zero CLI exit);null/undefinedstill mean a fresh create.Verification
test:project-context: 75/75 — five quoted/dotenv/JSON secret shapes, a 400-digit revision → malformed, non-string bodies → throw (function + CLI). Adapters regenerated.🤖 Generated with Claude Code