[GH-ISSUE #171] fix(application): redact child PIDs in process sample command text #119

New issue

Closed

opened 2026-10-15 18:21:18 +00:00 by bsakaguchi · 0 comments

bsakaguchi commented

2026-10-15 18:21:18 +00:00

Owner

Originally created by @morluto on GitHub (Jul 14, 2026).
Original GitHub issue: https://github.com/morluto/rea/issues/171

Problem

In normalizeProcessSamples (src/application/ProcessNormalization.ts), each sample command is normalized by calling normalizeProcessText with the overall rootPid.

command: normalizeProcessText(sample.command, scenario, "<no-temporary-root>", rootPid)

When normalization rules enable pids, this only redacts the root PID across all rows. Child and grandchild process IDs that appear in command lines (for example, scripts that pass own/peer PIDs as arguments) are not redacted.

Impact

Captured process command text can leak non-root PIDs.
Cross-run process comparisons can become unstable because those PIDs are run-specific.
The behavior appears inconsistent with other sample fields where pid/parent_pid/process_group_id/session_id are all normalized.

Repro

Build a scenario with defaults (parseProcessScenario({ approved: true, executable: "/bin/true", working_directory: "/tmp" })).
Call normalizeProcessSamples with root 101 and sample commands containing other PIDs.

const samples = [
  { at_ms: 0, pid: 101, parent_pid: 0, process_group_id: 101, session_id: 101, command: "root 101" },
  { at_ms: 10, pid: 202, parent_pid: 101, process_group_id: 101, session_id: 101, command: "child 202" },
];
const out = normalizeProcessSamples(samples, scenario, 101);
out[1].command; // currently "child 202", expected to redact PID token

Expected

Each command containing any process identifier in scope should use per-sample PID redaction (or this should be explicitly documented as root-only redaction).

Originally created by @morluto on GitHub (Jul 14, 2026). Original GitHub issue: https://github.com/morluto/rea/issues/171 ### Problem In `normalizeProcessSamples` (`src/application/ProcessNormalization.ts`), each sample command is normalized by calling `normalizeProcessText` with the overall `rootPid`. ```ts command: normalizeProcessText(sample.command, scenario, "<no-temporary-root>", rootPid) ``` When normalization rules enable `pids`, this only redacts the root PID across all rows. Child and grandchild process IDs that appear in command lines (for example, scripts that pass own/peer PIDs as arguments) are not redacted. ### Impact - Captured process command text can leak non-root PIDs. - Cross-run process comparisons can become unstable because those PIDs are run-specific. - The behavior appears inconsistent with other sample fields where `pid`/`parent_pid`/`process_group_id`/`session_id` are all normalized. ### Repro 1. Build a scenario with defaults (`parseProcessScenario({ approved: true, executable: "/bin/true", working_directory: "/tmp" })`). 2. Call `normalizeProcessSamples` with root `101` and sample commands containing other PIDs. ```ts const samples = [ { at_ms: 0, pid: 101, parent_pid: 0, process_group_id: 101, session_id: 101, command: "root 101" }, { at_ms: 10, pid: 202, parent_pid: 101, process_group_id: 101, session_id: 101, command: "child 202" }, ]; const out = normalizeProcessSamples(samples, scenario, 101); out[1].command; // currently "child 202", expected to redact PID token ``` ### Expected Each command containing any process identifier in scope should use per-sample PID redaction (or this should be explicitly documented as root-only redaction).

bsakaguchi

2026-10-15 18:21:18 +00:00