morluto/rea

Fork 0

mirror of https://github.com/morluto/rea.git synced 2026-11-05 06:45:22 +00:00

[PR #1614] [CLOSED] fix(browser): redact escaped declared secrets from scenario text #4702

New issue

Closed

opened 2026-10-31 00:54:09 +00:00 by bsakaguchi · 0 comments

bsakaguchi commented

2026-10-31 00:54:09 +00:00

Owner

📋 Pull Request Information

Original PR: https://github.com/morluto/rea/pull/1614
Author: @guillaume-tesla
Created: 10/10/2026
Status: ❌ Closed

Base: main ← Head: codex/issue-1608-escaped-secret-redaction

📝 Commits (1)

f186f92 fix(browser): redact escaped declared secrets from scenario text

📊 Changes

4 files changed (+115 additions, -2 deletions)

View changed files

📝 docs/browser-scenario-contract.md (+1 -0)
📝 src/browser/BrowserScenario.test.ts (+33 -0)
📝 src/browser/BrowserScenarioSecrets.ts (+17 -2)
📝 src/browser/PlaywrightScenarioArtifacts.test.ts (+64 -0)

📄 Description

Summary

Fixes #1608.

Declared secrets shown by a page can reach DOM and accessibility captures in non-raw spellings. page.content() can serialize &, <, >, and " as HTML entities. Accessibility output can retain the percent or form encoding from a displayed URL.

Text redaction now checks the raw secret plus the standard URI/form spellings already used elsewhere, standard HTML text spellings, and the standard HTML attribute spelling for ". The replacement marker is unchanged. Network byte redaction is unchanged.

Contract

dom and accessibility text removes declared secrets written with standard HTML, percent, or form spellings.
Other encodings remain outside scope, matching the issue report.
No CLI, MCP, schema, catalog, or package changes.

Regression coverage

Direct redaction covers raw, HTML, percent, and form spellings.
DOM and accessibility artifact captures assert that no raw or escaped spelling remains and that the retained digest matches the redacted text.
Existing redaction behavior is unchanged.

Validation

Before the fix, both new focused tests failed; the escaped HTML and percent spellings stayed in the capture.

After the fix:

npm run test:focused -- src/browser/BrowserScenario.test.ts src/browser/PlaywrightScenarioArtifacts.test.ts — 17 passed.
Real Chrome E2E with a local page and fake secrets: clean main leaked SECRET & done and its percent spelling; this branch returned no fake secret spelling and reported redacted DOM and accessibility text. Both retained-text SHA-256 digests were verified.
npm run check — passed.
npm run docs:check — passed.
git diff --check — clean.

Not run: numeric HTML entities, base64, Unicode escapes, Windows, Linux, or other browsers.

_{🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.}

## 📋 Pull Request Information **Original PR:** https://github.com/morluto/rea/pull/1614 **Author:** [@guillaume-tesla](https://github.com/guillaume-tesla) **Created:** 10/10/2026 **Status:** ❌ Closed **Base:** `main` ← **Head:** `codex/issue-1608-escaped-secret-redaction` --- ### 📝 Commits (1) - [`f186f92`](https://github.com/morluto/rea/commit/f186f92c02a853fd8c7f76a5f6a77e5670866461) fix(browser): redact escaped declared secrets from scenario text ### 📊 Changes **4 files changed** (+115 additions, -2 deletions) <details> <summary>View changed files</summary> 📝 `docs/browser-scenario-contract.md` (+1 -0) 📝 `src/browser/BrowserScenario.test.ts` (+33 -0) 📝 `src/browser/BrowserScenarioSecrets.ts` (+17 -2) 📝 `src/browser/PlaywrightScenarioArtifacts.test.ts` (+64 -0) </details> ### 📄 Description ## Summary Fixes #1608. Declared secrets shown by a page can reach DOM and accessibility captures in non-raw spellings. `page.content()` can serialize `&`, `<`, `>`, and `"` as HTML entities. Accessibility output can retain the percent or form encoding from a displayed URL. Text redaction now checks the raw secret plus the standard URI/form spellings already used elsewhere, standard HTML text spellings, and the standard HTML attribute spelling for `"`. The replacement marker is unchanged. Network byte redaction is unchanged. ## Contract - `dom` and `accessibility` text removes declared secrets written with standard HTML, percent, or form spellings. - Other encodings remain outside scope, matching the issue report. - No CLI, MCP, schema, catalog, or package changes. ## Regression coverage - Direct redaction covers raw, HTML, percent, and form spellings. - DOM and accessibility artifact captures assert that no raw or escaped spelling remains and that the retained digest matches the redacted text. - Existing redaction behavior is unchanged. ## Validation Before the fix, both new focused tests failed; the escaped HTML and percent spellings stayed in the capture. After the fix: - `npm run test:focused -- src/browser/BrowserScenario.test.ts src/browser/PlaywrightScenarioArtifacts.test.ts` — 17 passed. - Real Chrome E2E with a local page and fake secrets: clean `main` leaked `SECRET & done` and its percent spelling; this branch returned no fake secret spelling and reported redacted DOM and accessibility text. Both retained-text SHA-256 digests were verified. - `npm run check` — passed. - `npm run docs:check` — passed. - `git diff --check` — clean. Not run: numeric HTML entities, base64, Unicode escapes, Windows, Linux, or other browsers. --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>

bsakaguchi

2026-10-31 00:54:09 +00:00

closed this issue
added the
pull-request
label

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference

morluto/rea#4702

No description provided.

Rows
Columns