mirror of
https://github.com/rcourtman/Pulse.git
synced 2026-05-22 03:02:35 +00:00
e0edbaf7d0
The Telegram bot token redaction had an off-by-one bug: it searched for the next "/" starting from the "/bot" position, which found the "/" in "/bot" itself (offset 0) instead of the next "/" after the token. Result: tokens were not properly redacted and the URL got corrupted with duplicated path segments, potentially leaking secrets to logs/API responses. Fix: search from idx+4 (after "/bot") and handle edge cases where there's no trailing slash (token at end of URL or before query string). Added 20 comprehensive test cases covering: - No secrets (passthrough) - Telegram bot tokens (various patterns) - Query parameter secrets (token, apikey, api_key, key, secret, password) - Multiple parameters and edge cases |
||
|---|---|---|
| .. | ||
| agentbinaries | ||
| agentupdate | ||
| alerts | ||
| api | ||
| auth | ||
| config | ||
| crypto | ||
| discovery | ||
| dockeragent | ||
| errors | ||
| hostagent | ||
| hostmetrics | ||
| logging | ||
| mdadm | ||
| metrics | ||
| mock | ||
| models | ||
| monitoring | ||
| notifications | ||
| sensors | ||
| ssh/knownhosts | ||
| system | ||
| tempproxy | ||
| types | ||
| updates | ||
| utils | ||
| websocket | ||