fix: prevent sensitive data in server diagnostics #500

Open

anton wants to merge 1 commit from fix/diagnostic-data-exposure into main

anton commented

2026-10-22 17:19:32 +00:00

Owner

Summary

Remove QR polling tokens and upstream URL credentials/query strings from gateway diagnostics without changing request forwarding or HTTP responses.
Stop logging Paddle error-response bodies and raw builder status payloads. Replace public build-log excerpts and arbitrary legacy builder errors with fixed summaries; retain existing private build logs.
Install a shared Sentry before_send scrubber with default PII disabled. Redact known sensitive structured fields, request/response bodies, cookies and user data; strip URL credentials, queries and fragments while retaining useful error categories, status codes and source locations.
Add behavioral regressions for gateway send/read failures and byte-preserving forwarding, the consumed QR-poll race, Paddle failures, builder success/failure/parser/stall paths, and actual outgoing Sentry envelopes. Include apostrophe and adjacent-URL credential-leak cases.

Validation

Passed locally on the final source snapshot with Rust 1.96.1:

RUSTUP_TOOLCHAIN=1.96.1 RUST_TEST_THREADS=2 make test
cargo +1.96.1 clippy --locked -p api -p gateway -p sentry-middleware --all-targets -- -D warnings

The full test target covers workspace tests, CLI installer checks and Python suites. It retains the normal ignored integration tests. All 13 Sentry middleware tests passed.

Also explicitly ran these normally ignored regressions against disposable loopback PostgreSQL, with DIAGNOSTICS_TEST_DATABASE_URL and DATABASE_URL set for their respective commands:

cargo +1.96.1 test --locked -p api --bin api paddle_error_bodies_never_reach_billing_diagnostics -- --ignored --nocapture
cargo +1.96.1 test --locked -p gateway consumed_poll_race_does_not_log_polling_token -- --ignored --nocapture

Both passed. The adjacent-URL regression was observed failing before its focused repair and passing afterward. Final independent security and correctness/minimality re-reviews passed with no blockers. Source hashes were checked against the tested snapshot before publication.

Scope

Diagnostics only: no deployment, WebAuthn behavior, bundle contract, broadcast policy or webhook-retention changes. The Sentry scrubber is defense in depth for known fields and URLs, not a claim of arbitrary-secret detection. Source callers must still avoid emitting opaque secrets in free-form diagnostics.

## Summary - Remove QR polling tokens and upstream URL credentials/query strings from gateway diagnostics without changing request forwarding or HTTP responses. - Stop logging Paddle error-response bodies and raw builder status payloads. Replace public build-log excerpts and arbitrary legacy builder errors with fixed summaries; retain existing private build logs. - Install a shared Sentry `before_send` scrubber with default PII disabled. Redact known sensitive structured fields, request/response bodies, cookies and user data; strip URL credentials, queries and fragments while retaining useful error categories, status codes and source locations. - Add behavioral regressions for gateway send/read failures and byte-preserving forwarding, the consumed QR-poll race, Paddle failures, builder success/failure/parser/stall paths, and actual outgoing Sentry envelopes. Include apostrophe and adjacent-URL credential-leak cases. ## Validation Passed locally on the final source snapshot with Rust 1.96.1: ```sh RUSTUP_TOOLCHAIN=1.96.1 RUST_TEST_THREADS=2 make test cargo +1.96.1 clippy --locked -p api -p gateway -p sentry-middleware --all-targets -- -D warnings ``` The full test target covers workspace tests, CLI installer checks and Python suites. It retains the normal ignored integration tests. All 13 Sentry middleware tests passed. Also explicitly ran these normally ignored regressions against disposable loopback PostgreSQL, with `DIAGNOSTICS_TEST_DATABASE_URL` and `DATABASE_URL` set for their respective commands: ```sh cargo +1.96.1 test --locked -p api --bin api paddle_error_bodies_never_reach_billing_diagnostics -- --ignored --nocapture cargo +1.96.1 test --locked -p gateway consumed_poll_race_does_not_log_polling_token -- --ignored --nocapture ``` Both passed. The adjacent-URL regression was observed failing before its focused repair and passing afterward. Final independent security and correctness/minimality re-reviews passed with no blockers. Source hashes were checked against the tested snapshot before publication. ## Scope Diagnostics only: no deployment, WebAuthn behavior, bundle contract, broadcast policy or webhook-retention changes. The Sentry scrubber is defense in depth for known fields and URLs, not a claim of arbitrary-secret detection. Source callers must still avoid emitting opaque secrets in free-form diagnostics.

anton added 1 commit

2026-10-22 17:19:32 +00:00

fix: prevent sensitive data in server diagnostics 820e6e5b32

This pull request doesn't have enough approvals yet. 0 of 1 approvals granted.

You are not authorized to merge this pull request.

View command line instructions

Checkout

From your project repository, check out a new branch and test the changes.

git fetch -u origin fix/diagnostic-data-exposure:fix/diagnostic-data-exposure

git switch fix/diagnostic-data-exposure

No reviewers

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference

public/platform!500

No description provided.

Rows
Columns