feat(poc/diagnostics): add diagnostics-redaction spike
Proof-of-concept proving the diagnostics-redaction exit criterion from
docs/architecture/proof-of-concept-plan.md §2:
"Password and identity-secret samples are redacted."
Full coverage of the audit-report test matrix in
docs/security/diagnostic-redaction-audit-report.md §4
(REDACT-TC-001..010), plus two sanity tests.
The spike ships:
- RedactionPolicy: typed catalogue of regex rules
(identity-base64-blob, password-kv, ts3server-url-password,
authorization-bearer, linux/windows/macos user-path) with
optional capture-group narrowing.
- Structured-field redaction keyed on case-insensitive name
substrings (password, secret, token, ...).
- Bundle-level switches: chat and channel tree excluded by
default per audit-report §5.
- KnownSecretRegistry: literal-substring scrub for secrets the
host application has already loaded into memory (defense in
depth that regexes alone cannot guarantee — closes the gap
behind REDACT-TC-002).
- Length cap (MAX_PROTOCOL_STRING_LEN = 256) with truncation
marker for REDACT-TC-009.
- UTF-8 preserved in non-sensitive fields per REDACT-TC-010 /
ADR-008.
Test suite (12/12 PASS on 2026-05-13):
REDACT-TC-001 server password in connection data
REDACT-TC-002 identity secret in storage error (via KnownSecretRegistry)
REDACT-TC-003 server URL with password field
REDACT-TC-004 chat text excluded by default
REDACT-TC-005 channel name with Unicode excluded by default
REDACT-TC-006 nickname with Unicode preserved in safe field
REDACT-TC-007 local file path user segment minimized
REDACT-TC-008 mixed sensitive bundle (whole-bundle JSON scan)
REDACT-TC-009 long hostile protocol string truncated
REDACT-TC-010 multilingual safe text preserved
+ known-secret literal scrub
+ empty registered secret ignored
Out of scope: tracing-subscriber integration, diagnostic export
file format, memory/core dumps, performance, adversarial regex
evasion beyond trivial cases. These belong to chanora_diagnostics.
Authority: PoC plan §2, docs/security/diagnostic-redaction-audit-report.md,
SRS-093, SysRS-152/154/155.
Not product code; not promoted into chanora_diagnostics.
This commit is contained in:
EdisonJwa
+190
@@ -0,0 +1,190 @@
|
|||||||
|
# This file is automatically @generated by Cargo.
|
||||||
|
# It is not intended for manual editing.
|
||||||
|
version = 4
|
||||||
|
|
||||||
|
[[package]]
|
||||||
|
name = "aho-corasick"
|
||||||
|
version = "1.1.4"
|
||||||
|
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||||
|
checksum = "ddd31a130427c27518df266943a5308ed92d4b226cc639f5a8f1002816174301"
|
||||||
|
dependencies = [
|
||||||
|
"memchr",
|
||||||
|
]
|
||||||
|
|
||||||
|
[[package]]
|
||||||
|
name = "diagnostics-redaction-spike"
|
||||||
|
version = "0.1.0"
|
||||||
|
dependencies = [
|
||||||
|
"indoc",
|
||||||
|
"once_cell",
|
||||||
|
"regex",
|
||||||
|
"serde",
|
||||||
|
"serde_json",
|
||||||
|
"thiserror",
|
||||||
|
]
|
||||||
|
|
||||||
|
[[package]]
|
||||||
|
name = "indoc"
|
||||||
|
version = "2.0.7"
|
||||||
|
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||||
|
checksum = "79cf5c93f93228cf8efb3ba362535fb11199ac548a09ce117c9b1adc3030d706"
|
||||||
|
dependencies = [
|
||||||
|
"rustversion",
|
||||||
|
]
|
||||||
|
|
||||||
|
[[package]]
|
||||||
|
name = "itoa"
|
||||||
|
version = "1.0.18"
|
||||||
|
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||||
|
checksum = "8f42a60cbdf9a97f5d2305f08a87dc4e09308d1276d28c869c684d7777685682"
|
||||||
|
|
||||||
|
[[package]]
|
||||||
|
name = "memchr"
|
||||||
|
version = "2.8.0"
|
||||||
|
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||||
|
checksum = "f8ca58f447f06ed17d5fc4043ce1b10dd205e060fb3ce5b979b8ed8e59ff3f79"
|
||||||
|
|
||||||
|
[[package]]
|
||||||
|
name = "once_cell"
|
||||||
|
version = "1.21.4"
|
||||||
|
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||||
|
checksum = "9f7c3e4beb33f85d45ae3e3a1792185706c8e16d043238c593331cc7cd313b50"
|
||||||
|
|
||||||
|
[[package]]
|
||||||
|
name = "proc-macro2"
|
||||||
|
version = "1.0.106"
|
||||||
|
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||||
|
checksum = "8fd00f0bb2e90d81d1044c2b32617f68fcb9fa3bb7640c23e9c748e53fb30934"
|
||||||
|
dependencies = [
|
||||||
|
"unicode-ident",
|
||||||
|
]
|
||||||
|
|
||||||
|
[[package]]
|
||||||
|
name = "quote"
|
||||||
|
version = "1.0.45"
|
||||||
|
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||||
|
checksum = "41f2619966050689382d2b44f664f4bc593e129785a36d6ee376ddf37259b924"
|
||||||
|
dependencies = [
|
||||||
|
"proc-macro2",
|
||||||
|
]
|
||||||
|
|
||||||
|
[[package]]
|
||||||
|
name = "regex"
|
||||||
|
version = "1.12.3"
|
||||||
|
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||||
|
checksum = "e10754a14b9137dd7b1e3e5b0493cc9171fdd105e0ab477f51b72e7f3ac0e276"
|
||||||
|
dependencies = [
|
||||||
|
"aho-corasick",
|
||||||
|
"memchr",
|
||||||
|
"regex-automata",
|
||||||
|
"regex-syntax",
|
||||||
|
]
|
||||||
|
|
||||||
|
[[package]]
|
||||||
|
name = "regex-automata"
|
||||||
|
version = "0.4.14"
|
||||||
|
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||||
|
checksum = "6e1dd4122fc1595e8162618945476892eefca7b88c52820e74af6262213cae8f"
|
||||||
|
dependencies = [
|
||||||
|
"aho-corasick",
|
||||||
|
"memchr",
|
||||||
|
"regex-syntax",
|
||||||
|
]
|
||||||
|
|
||||||
|
[[package]]
|
||||||
|
name = "regex-syntax"
|
||||||
|
version = "0.8.10"
|
||||||
|
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||||
|
checksum = "dc897dd8d9e8bd1ed8cdad82b5966c3e0ecae09fb1907d58efaa013543185d0a"
|
||||||
|
|
||||||
|
[[package]]
|
||||||
|
name = "rustversion"
|
||||||
|
version = "1.0.22"
|
||||||
|
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||||
|
checksum = "b39cdef0fa800fc44525c84ccb54a029961a8215f9619753635a9c0d2538d46d"
|
||||||
|
|
||||||
|
[[package]]
|
||||||
|
name = "serde"
|
||||||
|
version = "1.0.228"
|
||||||
|
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||||
|
checksum = "9a8e94ea7f378bd32cbbd37198a4a91436180c5bb472411e48b5ec2e2124ae9e"
|
||||||
|
dependencies = [
|
||||||
|
"serde_core",
|
||||||
|
"serde_derive",
|
||||||
|
]
|
||||||
|
|
||||||
|
[[package]]
|
||||||
|
name = "serde_core"
|
||||||
|
version = "1.0.228"
|
||||||
|
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||||
|
checksum = "41d385c7d4ca58e59fc732af25c3983b67ac852c1a25000afe1175de458b67ad"
|
||||||
|
dependencies = [
|
||||||
|
"serde_derive",
|
||||||
|
]
|
||||||
|
|
||||||
|
[[package]]
|
||||||
|
name = "serde_derive"
|
||||||
|
version = "1.0.228"
|
||||||
|
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||||
|
checksum = "d540f220d3187173da220f885ab66608367b6574e925011a9353e4badda91d79"
|
||||||
|
dependencies = [
|
||||||
|
"proc-macro2",
|
||||||
|
"quote",
|
||||||
|
"syn",
|
||||||
|
]
|
||||||
|
|
||||||
|
[[package]]
|
||||||
|
name = "serde_json"
|
||||||
|
version = "1.0.149"
|
||||||
|
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||||
|
checksum = "83fc039473c5595ace860d8c4fafa220ff474b3fc6bfdb4293327f1a37e94d86"
|
||||||
|
dependencies = [
|
||||||
|
"itoa",
|
||||||
|
"memchr",
|
||||||
|
"serde",
|
||||||
|
"serde_core",
|
||||||
|
"zmij",
|
||||||
|
]
|
||||||
|
|
||||||
|
[[package]]
|
||||||
|
name = "syn"
|
||||||
|
version = "2.0.117"
|
||||||
|
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||||
|
checksum = "e665b8803e7b1d2a727f4023456bbbbe74da67099c585258af0ad9c5013b9b99"
|
||||||
|
dependencies = [
|
||||||
|
"proc-macro2",
|
||||||
|
"quote",
|
||||||
|
"unicode-ident",
|
||||||
|
]
|
||||||
|
|
||||||
|
[[package]]
|
||||||
|
name = "thiserror"
|
||||||
|
version = "2.0.18"
|
||||||
|
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||||
|
checksum = "4288b5bcbc7920c07a1149a35cf9590a2aa808e0bc1eafaade0b80947865fbc4"
|
||||||
|
dependencies = [
|
||||||
|
"thiserror-impl",
|
||||||
|
]
|
||||||
|
|
||||||
|
[[package]]
|
||||||
|
name = "thiserror-impl"
|
||||||
|
version = "2.0.18"
|
||||||
|
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||||
|
checksum = "ebc4ee7f67670e9b64d05fa4253e753e016c6c95ff35b89b7941d6b856dec1d5"
|
||||||
|
dependencies = [
|
||||||
|
"proc-macro2",
|
||||||
|
"quote",
|
||||||
|
"syn",
|
||||||
|
]
|
||||||
|
|
||||||
|
[[package]]
|
||||||
|
name = "unicode-ident"
|
||||||
|
version = "1.0.24"
|
||||||
|
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||||
|
checksum = "e6e4313cd5fcd3dad5cafa179702e2b244f760991f45397d14d4ebf38247da75"
|
||||||
|
|
||||||
|
[[package]]
|
||||||
|
name = "zmij"
|
||||||
|
version = "1.0.21"
|
||||||
|
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||||
|
checksum = "b8848ee67ecc8aedbaf3e4122217aff892639231befc6a1b58d29fff4c2cabaa"
|
||||||
@@ -0,0 +1,28 @@
|
|||||||
|
[package]
|
||||||
|
name = "diagnostics-redaction-spike"
|
||||||
|
version = "0.1.0"
|
||||||
|
edition = "2021"
|
||||||
|
publish = false
|
||||||
|
description = "Chanora PoC: diagnostic redaction policy + redactor covering REDACT-TC-001..010 from the diagnostic redaction audit report."
|
||||||
|
|
||||||
|
# Not product code. See docs/architecture/proof-of-concept-plan.md §4.
|
||||||
|
# Authority: docs/security/diagnostic-redaction-audit-report.md,
|
||||||
|
# SRS-093 / SysRS-152/154/155, SDD §5 redaction notes.
|
||||||
|
|
||||||
|
[lib]
|
||||||
|
name = "diagnostics_redaction_spike"
|
||||||
|
path = "src/lib.rs"
|
||||||
|
|
||||||
|
[[bin]]
|
||||||
|
name = "diagnostics-redaction-cli"
|
||||||
|
path = "src/main.rs"
|
||||||
|
|
||||||
|
[dependencies]
|
||||||
|
regex = "1"
|
||||||
|
once_cell = "1"
|
||||||
|
thiserror = "2"
|
||||||
|
serde = { version = "1", features = ["derive"] }
|
||||||
|
serde_json = "1"
|
||||||
|
|
||||||
|
[dev-dependencies]
|
||||||
|
indoc = "2"
|
||||||
@@ -0,0 +1,79 @@
|
|||||||
|
# Diagnostics Redaction Spike
|
||||||
|
|
||||||
|
Chanora proof-of-concept. **Not product code.**
|
||||||
|
|
||||||
|
| Field | Value |
|
||||||
|
|---|---|
|
||||||
|
| PoC name | `diagnostics-redaction-spike` |
|
||||||
|
| PoC plan | [`docs/architecture/proof-of-concept-plan.md`](../../docs/architecture/proof-of-concept-plan.md) §2 |
|
||||||
|
| Purpose | Prove redaction of secrets before logs or diagnostic export |
|
||||||
|
| Exit criterion | "Password and identity-secret samples are redacted" |
|
||||||
|
| Authority | `docs/security/diagnostic-redaction-audit-report.md` §2 + §4 + §5; SRS-093, SysRS-152/154/155, SDD §5 |
|
||||||
|
|
||||||
|
## What it proves
|
||||||
|
|
||||||
|
- A typed `RedactionPolicy` carrying:
|
||||||
|
- regex-driven rules (with optional capture-group narrowing so the
|
||||||
|
rule can scrub a value while keeping the surrounding context);
|
||||||
|
- structured-field redaction keyed on case-insensitive name
|
||||||
|
substrings (`password`, `secret`, `token`, …);
|
||||||
|
- bundle-level switches (chat / channel tree default to *excluded*).
|
||||||
|
- A `Redactor` that applies the policy to free text and to a typed
|
||||||
|
`DiagnosticBundle`.
|
||||||
|
- A `KnownSecretRegistry` for *literal* scrubbing — the strongest
|
||||||
|
defence when the host has already loaded the actual secret value
|
||||||
|
into memory. This is what closes the gap that regexes alone cannot
|
||||||
|
fully cover (REDACT-TC-002).
|
||||||
|
- A length cap (`MAX_PROTOCOL_STRING_LEN`) so hostile / oversized
|
||||||
|
protocol strings cannot grow the diagnostic surface
|
||||||
|
(REDACT-TC-009).
|
||||||
|
- UTF-8 preservation for benign multilingual text (REDACT-TC-010 /
|
||||||
|
ADR-008).
|
||||||
|
|
||||||
|
## Coverage of the audit-report test matrix
|
||||||
|
|
||||||
|
All ten REDACT-TC-001..010 entries are covered (see `VERIFICATION.md`).
|
||||||
|
|
||||||
|
## Layout
|
||||||
|
|
||||||
|
```text
|
||||||
|
diagnostics-redaction-spike/
|
||||||
|
src/
|
||||||
|
lib.rs # crate root, re-exports, REDACTION_MARKER
|
||||||
|
policy.rs # RedactionRule, RedactionPolicy, default policy
|
||||||
|
redactor.rs # Redactor, KnownSecretRegistry
|
||||||
|
bundle.rs # DiagnosticBundle DTO + bundle-level redaction
|
||||||
|
main.rs # diagnostics-redaction-cli driver
|
||||||
|
tests/
|
||||||
|
redaction.rs # 12 tests; REDACT-TC-001..010 + sanity
|
||||||
|
Cargo.toml
|
||||||
|
```
|
||||||
|
|
||||||
|
## Reproduce
|
||||||
|
|
||||||
|
Requires Rust stable (developed against 1.95).
|
||||||
|
|
||||||
|
```bash
|
||||||
|
cargo test
|
||||||
|
echo 'INFO password=hunter2 path=/home/alice/x' | cargo run --bin diagnostics-redaction-cli
|
||||||
|
```
|
||||||
|
|
||||||
|
## Scope boundaries
|
||||||
|
|
||||||
|
- **Not a `tracing` layer.** Production code in `chanora_diagnostics`
|
||||||
|
will wire the redactor as a `tracing-subscriber` layer to enforce
|
||||||
|
redaction at write-time, not via post-processing. The mechanism
|
||||||
|
here is the same; the integration surface is not.
|
||||||
|
- **No diagnostic bundle file format.** The spike only redacts the
|
||||||
|
in-memory struct; the actual export format (zip / json-lines / etc.)
|
||||||
|
is owned by `chanora_diagnostics`.
|
||||||
|
- **No threat-model coverage of memory dumps, core dumps, or kernel
|
||||||
|
logs.** That is `docs/security/threat-model.md` territory.
|
||||||
|
- **No language-aware redaction.** The Unicode policy is "preserve
|
||||||
|
multilingual text in non-sensitive fields; do not introspect it."
|
||||||
|
- **No PII discovery.** This is a deny-list redactor; it does not
|
||||||
|
attempt to detect previously-unknown secrets by entropy heuristics.
|
||||||
|
|
||||||
|
## Verification log
|
||||||
|
|
||||||
|
See `VERIFICATION.md` in this directory.
|
||||||
@@ -0,0 +1,104 @@
|
|||||||
|
# Verification record — `diagnostics-redaction-spike`
|
||||||
|
|
||||||
|
## Result
|
||||||
|
|
||||||
|
PASS. The PoC exit criterion (from
|
||||||
|
`docs/architecture/proof-of-concept-plan.md` §2: "Password and
|
||||||
|
identity-secret samples are redacted") is met, with full coverage of
|
||||||
|
REDACT-TC-001..010 from
|
||||||
|
`docs/security/diagnostic-redaction-audit-report.md` §4.
|
||||||
|
|
||||||
|
## Environment
|
||||||
|
|
||||||
|
| Field | Value |
|
||||||
|
|---|---|
|
||||||
|
| Date | 2026-05-13 |
|
||||||
|
| Host OS | Linux (Arch, kernel 7.0.5-arch1-1, x86_64) |
|
||||||
|
| Rust toolchain | stable 1.95.0 |
|
||||||
|
| `regex` | 1 |
|
||||||
|
| `serde` / `serde_json` | 1 |
|
||||||
|
| `once_cell` | 1 |
|
||||||
|
|
||||||
|
## Reproduction
|
||||||
|
|
||||||
|
```bash
|
||||||
|
cargo test
|
||||||
|
printf 'INFO password=hunter2 path=/home/milkice/x\n' \
|
||||||
|
| cargo run --bin diagnostics-redaction-cli
|
||||||
|
```
|
||||||
|
|
||||||
|
## Test run
|
||||||
|
|
||||||
|
```
|
||||||
|
running 12 tests
|
||||||
|
test known_secret_is_scrubbed_even_when_no_regex_matches ... ok
|
||||||
|
test redact_tc_005_channel_name_with_unicode_excluded_by_default ... ok
|
||||||
|
test redact_tc_006_nickname_with_unicode_preserved_in_safe_field ... ok
|
||||||
|
test redact_tc_002_identity_secret_in_storage_error ... ok
|
||||||
|
test redact_tc_010_multilingual_safe_text_preserved ... ok
|
||||||
|
test redact_tc_009_long_hostile_protocol_string_truncated ... ok
|
||||||
|
test redact_tc_007_local_file_paths_user_segment_minimized ... ok
|
||||||
|
test empty_registered_secret_is_ignored ... ok
|
||||||
|
test redact_tc_004_chat_text_excluded_by_default ... ok
|
||||||
|
test redact_tc_008_diagnostic_bundle_with_mixed_sensitive_fields ... ok
|
||||||
|
test redact_tc_001_server_password_in_connection_data ... ok
|
||||||
|
test redact_tc_003_server_url_with_password_field ... ok
|
||||||
|
|
||||||
|
test result: ok. 12 passed; 0 failed; 0 ignored; 0 measured;
|
||||||
|
0 filtered out; finished in 0.01s
|
||||||
|
```
|
||||||
|
|
||||||
|
## CLI run
|
||||||
|
|
||||||
|
Input:
|
||||||
|
|
||||||
|
```text
|
||||||
|
INFO connect host=cn.teamspeak.app password=hunter2 nickname=Chanora
|
||||||
|
DEBUG identity=MG0DAgeAAgEgAiAIXJBlj1hQbaH0Eq0DuLlCmH8bl+veTAO2k9EQjEYSgIgNnImcmKo7ls5mExb6skfK2Twu54aeDr0OP1ITsC50CIA8M5nmDBn
|
||||||
|
ERROR open /home/milkice/.local/share/chanora/db failed
|
||||||
|
NOTICE CHANORA_LITERAL_DEMO_SECRET seen on bus
|
||||||
|
```
|
||||||
|
|
||||||
|
Output:
|
||||||
|
|
||||||
|
```text
|
||||||
|
INFO connect host=cn.teamspeak.app password=[REDACTED] nickname=Chanora
|
||||||
|
DEBUG identity=[REDACTED]
|
||||||
|
ERROR open /home/[REDACTED]/.local/share/chanora/db failed
|
||||||
|
NOTICE [REDACTED] seen on bus
|
||||||
|
```
|
||||||
|
|
||||||
|
- Password: redacted (rule `password-kv`).
|
||||||
|
- Base64-ish identity blob: redacted (rule `identity-base64-blob`).
|
||||||
|
- Linux home-username segment: redacted (rule `linux-home-path`); the
|
||||||
|
rest of the path is preserved.
|
||||||
|
- Pre-registered literal secret: redacted via
|
||||||
|
`KnownSecretRegistry`, demonstrating the SS-AUD-003 defence-in-depth.
|
||||||
|
- Non-secret tokens (`host=`, `nickname=`, `INFO`, `ERROR`, …) all
|
||||||
|
flow through unchanged.
|
||||||
|
|
||||||
|
## Audit-matrix coverage
|
||||||
|
|
||||||
|
| Audit ID | Test | Result |
|
||||||
|
|---|---|---|
|
||||||
|
| REDACT-TC-001 (server password in connection data) | `redact_tc_001_server_password_in_connection_data` | PASS |
|
||||||
|
| REDACT-TC-002 (identity secret in storage error) | `redact_tc_002_identity_secret_in_storage_error` | PASS — uses `KnownSecretRegistry`. |
|
||||||
|
| REDACT-TC-003 (URL with password field) | `redact_tc_003_server_url_with_password_field` | PASS — only the password value is redacted. |
|
||||||
|
| REDACT-TC-004 (chat text in export) | `redact_tc_004_chat_text_excluded_by_default` | PASS — default policy excludes. |
|
||||||
|
| REDACT-TC-005 (Unicode channel name) | `redact_tc_005_channel_name_with_unicode_excluded_by_default` | PASS — default policy excludes. |
|
||||||
|
| REDACT-TC-006 (Unicode nickname) | `redact_tc_006_nickname_with_unicode_preserved_in_safe_field` | PASS — preserved in non-sensitive extras. |
|
||||||
|
| REDACT-TC-007 (local file path) | `redact_tc_007_local_file_paths_user_segment_minimized` | PASS — username segment redacted on Linux/Windows/macOS path shapes. |
|
||||||
|
| REDACT-TC-008 (mixed sensitive bundle) | `redact_tc_008_diagnostic_bundle_with_mixed_sensitive_fields` | PASS — whole-bundle JSON scanned for plaintext. |
|
||||||
|
| REDACT-TC-009 (long hostile protocol string) | `redact_tc_009_long_hostile_protocol_string_truncated` | PASS — `MAX_PROTOCOL_STRING_LEN = 256` cap with truncation marker. |
|
||||||
|
| REDACT-TC-010 (multilingual safe text) | `redact_tc_010_multilingual_safe_text_preserved` | PASS — Chinese / Japanese / Korean / Latin-diacritic text preserved verbatim. |
|
||||||
|
|
||||||
|
## What this spike does NOT validate
|
||||||
|
|
||||||
|
- Integration as a `tracing` layer (production code will own this).
|
||||||
|
- Diagnostic export *file format* (zip / json-lines / archive layout).
|
||||||
|
- Mobile-platform path shapes (`/data/data/<pkg>/` on Android,
|
||||||
|
iOS app-group containers).
|
||||||
|
- Memory / core dumps.
|
||||||
|
- Performance under sustained high-volume logging.
|
||||||
|
- Adversarial regex evasion beyond the trivial cases exercised.
|
||||||
|
- Process-level review of the audit report (SS-AUD-007 style sign-off).
|
||||||
@@ -0,0 +1,96 @@
|
|||||||
|
//! Structured diagnostic bundle and the redaction pass over it.
|
||||||
|
//!
|
||||||
|
//! Mirrors `docs/security/diagnostic-redaction-audit-report.md` §5
|
||||||
|
//! "Export Bundle Contents". Fields default to safe values; sensitive
|
||||||
|
//! categories are excluded by default.
|
||||||
|
|
||||||
|
use serde::{Deserialize, Serialize};
|
||||||
|
|
||||||
|
use crate::redactor::Redactor;
|
||||||
|
use crate::REDACTION_MARKER;
|
||||||
|
|
||||||
|
/// Raw bundle assembled by the application before redaction. The
|
||||||
|
/// caller MUST pass this through `Redactor::redact_bundle` before any
|
||||||
|
/// disk write or user-visible export.
|
||||||
|
#[derive(Debug, Clone, Serialize, Deserialize, Default)]
|
||||||
|
pub struct DiagnosticBundle {
|
||||||
|
pub app_version: String,
|
||||||
|
pub build_number: String,
|
||||||
|
pub platform_info: String,
|
||||||
|
pub connection_state: String,
|
||||||
|
pub server_address: Option<String>,
|
||||||
|
pub channel_tree: Vec<String>,
|
||||||
|
pub chat_history: Vec<String>,
|
||||||
|
pub log_lines: Vec<String>,
|
||||||
|
pub audio_device_names: Vec<String>,
|
||||||
|
/// Free-form extras keyed by field name. Sensitive field names
|
||||||
|
/// (matched against `RedactionPolicy::redact_field_substrings`)
|
||||||
|
/// are redacted wholesale; everything else flows through
|
||||||
|
/// `redact_text` for value-level scrubbing.
|
||||||
|
pub extras: std::collections::BTreeMap<String, String>,
|
||||||
|
}
|
||||||
|
|
||||||
|
/// Final, redacted bundle suitable for export. Produced by
|
||||||
|
/// `Redactor::redact_bundle`. The shape is intentionally the same
|
||||||
|
/// type so callers can re-serialize as JSON without conversion.
|
||||||
|
pub type RedactedBundle = DiagnosticBundle;
|
||||||
|
|
||||||
|
impl Redactor {
|
||||||
|
/// Apply the redaction policy to `bundle`, returning a copy safe
|
||||||
|
/// for export.
|
||||||
|
pub fn redact_bundle(&self, bundle: &DiagnosticBundle) -> RedactedBundle {
|
||||||
|
let policy = self.policy();
|
||||||
|
|
||||||
|
let chat_history = if policy.include_chat {
|
||||||
|
bundle
|
||||||
|
.chat_history
|
||||||
|
.iter()
|
||||||
|
.map(|m| self.redact_text(m))
|
||||||
|
.collect()
|
||||||
|
} else {
|
||||||
|
// Chat is excluded by default (audit report §5 / REDACT-TC-004).
|
||||||
|
Vec::new()
|
||||||
|
};
|
||||||
|
|
||||||
|
let channel_tree = if policy.include_channel_tree {
|
||||||
|
bundle
|
||||||
|
.channel_tree
|
||||||
|
.iter()
|
||||||
|
.map(|c| self.redact_text(c))
|
||||||
|
.collect()
|
||||||
|
} else {
|
||||||
|
Vec::new()
|
||||||
|
};
|
||||||
|
|
||||||
|
let mut redacted_extras = std::collections::BTreeMap::new();
|
||||||
|
for (k, v) in &bundle.extras {
|
||||||
|
if self.is_sensitive_field(k) {
|
||||||
|
redacted_extras.insert(k.clone(), REDACTION_MARKER.to_string());
|
||||||
|
} else {
|
||||||
|
redacted_extras.insert(k.clone(), self.redact_text(v));
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
RedactedBundle {
|
||||||
|
app_version: bundle.app_version.clone(),
|
||||||
|
build_number: bundle.build_number.clone(),
|
||||||
|
// Platform info gets a soft scrub (paths, usernames).
|
||||||
|
platform_info: self.redact_text(&bundle.platform_info),
|
||||||
|
connection_state: self.redact_text(&bundle.connection_state),
|
||||||
|
server_address: bundle.server_address.as_ref().map(|s| self.redact_text(s)),
|
||||||
|
channel_tree,
|
||||||
|
chat_history,
|
||||||
|
log_lines: bundle
|
||||||
|
.log_lines
|
||||||
|
.iter()
|
||||||
|
.map(|l| self.redact_text(l))
|
||||||
|
.collect(),
|
||||||
|
audio_device_names: bundle
|
||||||
|
.audio_device_names
|
||||||
|
.iter()
|
||||||
|
.map(|d| self.redact_text(d))
|
||||||
|
.collect(),
|
||||||
|
extras: redacted_extras,
|
||||||
|
}
|
||||||
|
}
|
||||||
|
}
|
||||||
@@ -0,0 +1,31 @@
|
|||||||
|
//! Chanora PoC — diagnostics redaction spike.
|
||||||
|
//!
|
||||||
|
//! Authority:
|
||||||
|
//! * `docs/architecture/proof-of-concept-plan.md` §2 — Diagnostics
|
||||||
|
//! redaction spike. Exit criterion: "Password and identity-secret
|
||||||
|
//! samples are redacted."
|
||||||
|
//! * `docs/security/diagnostic-redaction-audit-report.md` — policy
|
||||||
|
//! in §2, surfaces in §3, test matrix REDACT-TC-001..010 in §4,
|
||||||
|
//! bundle policy in §5.
|
||||||
|
//! * SRS-093 / SysRS-152 / SysRS-154 / SysRS-155 — software-level
|
||||||
|
//! redaction obligations for logs and diagnostic exports.
|
||||||
|
//!
|
||||||
|
//! Production code will own this redactor inside the `chanora_diagnostics`
|
||||||
|
//! crate and wire it as a `tracing` layer. The PoC is the same shape in
|
||||||
|
//! miniature: a typed policy, a redactor that applies it to free text
|
||||||
|
//! and to structured diagnostic bundles, plus an explicit list of
|
||||||
|
//! known-literal secrets the host application can register at runtime.
|
||||||
|
|
||||||
|
pub mod bundle;
|
||||||
|
pub mod policy;
|
||||||
|
pub mod redactor;
|
||||||
|
|
||||||
|
pub use bundle::{DiagnosticBundle, RedactedBundle};
|
||||||
|
pub use policy::{RedactionPolicy, RedactionRule};
|
||||||
|
pub use redactor::{KnownSecretRegistry, Redactor};
|
||||||
|
|
||||||
|
/// The replacement string used for redacted segments.
|
||||||
|
///
|
||||||
|
/// Chosen distinctly so audit tests can grep for either presence
|
||||||
|
/// (correct redaction occurred) or absence (no leak).
|
||||||
|
pub const REDACTION_MARKER: &str = "[REDACTED]";
|
||||||
@@ -0,0 +1,30 @@
|
|||||||
|
//! CLI driver — accepts mixed sensitive input on stdin, prints the
|
||||||
|
//! redacted version on stdout, and prints a summary on stderr.
|
||||||
|
|
||||||
|
use std::io::Read;
|
||||||
|
use std::process::ExitCode;
|
||||||
|
|
||||||
|
use diagnostics_redaction_spike::Redactor;
|
||||||
|
|
||||||
|
fn main() -> ExitCode {
|
||||||
|
let mut input = String::new();
|
||||||
|
if std::io::stdin().read_to_string(&mut input).is_err() {
|
||||||
|
eprintln!("failed to read stdin");
|
||||||
|
return ExitCode::from(1);
|
||||||
|
}
|
||||||
|
|
||||||
|
let redactor = Redactor::with_default_policy();
|
||||||
|
|
||||||
|
// The host application would normally register live secrets here
|
||||||
|
// (e.g. as the secure-storage layer materialises them).
|
||||||
|
// For the CLI demo, register a fixed plaintext so the audience
|
||||||
|
// can see literal scrubbing work.
|
||||||
|
redactor
|
||||||
|
.known_secrets()
|
||||||
|
.register("CHANORA_LITERAL_DEMO_SECRET");
|
||||||
|
|
||||||
|
let out = redactor.redact_text(&input);
|
||||||
|
println!("{out}");
|
||||||
|
eprintln!("--- redaction applied; rules in policy: {} ---", redactor.policy().rules.len());
|
||||||
|
ExitCode::SUCCESS
|
||||||
|
}
|
||||||
@@ -0,0 +1,153 @@
|
|||||||
|
//! Redaction policy: the catalogue of patterns and structural rules
|
||||||
|
//! the redactor applies.
|
||||||
|
|
||||||
|
use once_cell::sync::Lazy;
|
||||||
|
use regex::Regex;
|
||||||
|
|
||||||
|
/// A single regex-driven rule.
|
||||||
|
#[derive(Debug, Clone)]
|
||||||
|
pub struct RedactionRule {
|
||||||
|
pub id: &'static str,
|
||||||
|
pub description: &'static str,
|
||||||
|
pub pattern: Regex,
|
||||||
|
/// If `Some(n)`, the rule replaces capture-group `n` rather than
|
||||||
|
/// the whole match. Useful for "ts3server://host?password=XXXX"
|
||||||
|
/// where the host should be preserved but `XXXX` redacted.
|
||||||
|
pub redact_group: Option<usize>,
|
||||||
|
}
|
||||||
|
|
||||||
|
impl RedactionRule {
|
||||||
|
pub fn new(
|
||||||
|
id: &'static str,
|
||||||
|
description: &'static str,
|
||||||
|
pattern: &str,
|
||||||
|
) -> Self {
|
||||||
|
Self {
|
||||||
|
id,
|
||||||
|
description,
|
||||||
|
pattern: Regex::new(pattern).expect("static rule regex must compile"),
|
||||||
|
redact_group: None,
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
pub fn new_group(
|
||||||
|
id: &'static str,
|
||||||
|
description: &'static str,
|
||||||
|
pattern: &str,
|
||||||
|
group: usize,
|
||||||
|
) -> Self {
|
||||||
|
Self {
|
||||||
|
id,
|
||||||
|
description,
|
||||||
|
pattern: Regex::new(pattern).expect("static rule regex must compile"),
|
||||||
|
redact_group: Some(group),
|
||||||
|
}
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
/// The full redaction policy.
|
||||||
|
#[derive(Debug, Clone)]
|
||||||
|
pub struct RedactionPolicy {
|
||||||
|
pub rules: Vec<RedactionRule>,
|
||||||
|
|
||||||
|
/// Structured-field redaction: any key whose lower-cased name
|
||||||
|
/// contains one of these substrings is fully redacted in
|
||||||
|
/// diagnostic bundles. Mirrors the bundle policy in
|
||||||
|
/// `diagnostic-redaction-audit-report.md` §5.
|
||||||
|
pub redact_field_substrings: Vec<&'static str>,
|
||||||
|
|
||||||
|
/// Bundle-level: include chat messages? Audit-report default = No.
|
||||||
|
pub include_chat: bool,
|
||||||
|
|
||||||
|
/// Bundle-level: include channel tree details?
|
||||||
|
pub include_channel_tree: bool,
|
||||||
|
}
|
||||||
|
|
||||||
|
/// Hard upper bound on protocol-string lengths kept in diagnostics.
|
||||||
|
///
|
||||||
|
/// REDACT-TC-009 ("long hostile protocol string"): truncate or safely
|
||||||
|
/// escape. The PoC truncates with a clear marker.
|
||||||
|
pub const MAX_PROTOCOL_STRING_LEN: usize = 256;
|
||||||
|
|
||||||
|
impl RedactionPolicy {
|
||||||
|
/// The default policy used by the PoC. Mirrors the audit-report
|
||||||
|
/// catalogue. Production code (`chanora_diagnostics`) will own the
|
||||||
|
/// canonical version of this list.
|
||||||
|
pub fn default_policy() -> Self {
|
||||||
|
Self {
|
||||||
|
rules: DEFAULT_RULES.clone(),
|
||||||
|
redact_field_substrings: vec![
|
||||||
|
"password",
|
||||||
|
"secret",
|
||||||
|
"private_key",
|
||||||
|
"private-key",
|
||||||
|
"identity_key",
|
||||||
|
"identity-key",
|
||||||
|
"token",
|
||||||
|
"credential",
|
||||||
|
"passphrase",
|
||||||
|
],
|
||||||
|
include_chat: false,
|
||||||
|
include_channel_tree: false,
|
||||||
|
}
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
static DEFAULT_RULES: Lazy<Vec<RedactionRule>> = Lazy::new(|| {
|
||||||
|
vec![
|
||||||
|
// Identity secret as it appears in `tsclientlib` style:
|
||||||
|
// long base64-ish run preceded by a known marker.
|
||||||
|
// We err on the side of catching base64 blobs >= 64 chars.
|
||||||
|
RedactionRule::new(
|
||||||
|
"identity-base64-blob",
|
||||||
|
"Long base64-like run; matches identity secrets and tokens.",
|
||||||
|
r"\b[A-Za-z0-9+/]{64,}={0,2}\b",
|
||||||
|
),
|
||||||
|
// `password = "..."` / `password: "..."` / `password=...`
|
||||||
|
// Captures the value in group 1 so the *key* name is kept.
|
||||||
|
// The value excludes separators commonly found in URL query
|
||||||
|
// strings and config lines (`& , ; " whitespace`).
|
||||||
|
RedactionRule::new_group(
|
||||||
|
"password-kv",
|
||||||
|
"key=value style password assignment.",
|
||||||
|
r#"(?i)\b(?:password|passwd|pass|pwd)\s*[:=]\s*"?([^"\s,;&]+)"?"#,
|
||||||
|
1,
|
||||||
|
),
|
||||||
|
// ts3server://host?password=XXXX&...
|
||||||
|
RedactionRule::new_group(
|
||||||
|
"ts3server-url-password",
|
||||||
|
"Password embedded in a ts3server:// URL query string.",
|
||||||
|
r"(?i)(?:[?&])password=([^&\s]+)",
|
||||||
|
1,
|
||||||
|
),
|
||||||
|
// Generic Authorization: Bearer ...
|
||||||
|
RedactionRule::new_group(
|
||||||
|
"authorization-bearer",
|
||||||
|
"Authorization header bearer token.",
|
||||||
|
r"(?i)Authorization:\s*Bearer\s+(\S+)",
|
||||||
|
1,
|
||||||
|
),
|
||||||
|
// Linux user home: /home/<user>/... → minimize the username
|
||||||
|
// segment. Captures group 1 = username.
|
||||||
|
RedactionRule::new_group(
|
||||||
|
"linux-home-path",
|
||||||
|
"Linux home-directory path; minimizes the username segment.",
|
||||||
|
r"(/home/)([^/\s]+)",
|
||||||
|
2,
|
||||||
|
),
|
||||||
|
// Windows user: C:\Users\<user>\...
|
||||||
|
RedactionRule::new_group(
|
||||||
|
"windows-user-path",
|
||||||
|
"Windows user-profile path; minimizes the username segment.",
|
||||||
|
r"(?i)([A-Z]:\\Users\\)([^\\\s]+)",
|
||||||
|
2,
|
||||||
|
),
|
||||||
|
// macOS user: /Users/<user>/...
|
||||||
|
RedactionRule::new_group(
|
||||||
|
"macos-user-path",
|
||||||
|
"macOS user-profile path; minimizes the username segment.",
|
||||||
|
r"(/Users/)([^/\s]+)",
|
||||||
|
2,
|
||||||
|
),
|
||||||
|
]
|
||||||
|
});
|
||||||
@@ -0,0 +1,127 @@
|
|||||||
|
//! The redactor — applies the policy to free text and to structured
|
||||||
|
//! diagnostic data.
|
||||||
|
|
||||||
|
use std::collections::HashSet;
|
||||||
|
use std::sync::{Arc, RwLock};
|
||||||
|
|
||||||
|
use crate::policy::{RedactionPolicy, MAX_PROTOCOL_STRING_LEN};
|
||||||
|
use crate::REDACTION_MARKER;
|
||||||
|
|
||||||
|
/// Runtime registry of *literal* known secrets. The host application
|
||||||
|
/// (e.g. the secure-storage layer) registers a secret here when it
|
||||||
|
/// loads one into memory, so even if it slips into a log line verbatim
|
||||||
|
/// it gets scrubbed.
|
||||||
|
///
|
||||||
|
/// This is the strongest defense for SS-AUD-003 and REDACT-TC-002 —
|
||||||
|
/// regexes can miss; literal substring matches cannot.
|
||||||
|
#[derive(Debug, Clone, Default)]
|
||||||
|
pub struct KnownSecretRegistry {
|
||||||
|
inner: Arc<RwLock<HashSet<String>>>,
|
||||||
|
}
|
||||||
|
|
||||||
|
impl KnownSecretRegistry {
|
||||||
|
pub fn new() -> Self {
|
||||||
|
Self::default()
|
||||||
|
}
|
||||||
|
|
||||||
|
/// Register a literal secret string. Empty strings are ignored
|
||||||
|
/// (to avoid degenerate `s.replace("", _)` behaviour).
|
||||||
|
pub fn register(&self, secret: &str) {
|
||||||
|
if secret.is_empty() {
|
||||||
|
return;
|
||||||
|
}
|
||||||
|
self.inner.write().unwrap().insert(secret.to_string());
|
||||||
|
}
|
||||||
|
|
||||||
|
pub fn forget(&self, secret: &str) {
|
||||||
|
self.inner.write().unwrap().remove(secret);
|
||||||
|
}
|
||||||
|
|
||||||
|
pub fn snapshot(&self) -> Vec<String> {
|
||||||
|
self.inner.read().unwrap().iter().cloned().collect()
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
pub struct Redactor {
|
||||||
|
policy: RedactionPolicy,
|
||||||
|
known: KnownSecretRegistry,
|
||||||
|
}
|
||||||
|
|
||||||
|
impl Redactor {
|
||||||
|
pub fn new(policy: RedactionPolicy, known: KnownSecretRegistry) -> Self {
|
||||||
|
Self { policy, known }
|
||||||
|
}
|
||||||
|
|
||||||
|
pub fn with_default_policy() -> Self {
|
||||||
|
Self::new(RedactionPolicy::default_policy(), KnownSecretRegistry::new())
|
||||||
|
}
|
||||||
|
|
||||||
|
pub fn known_secrets(&self) -> &KnownSecretRegistry {
|
||||||
|
&self.known
|
||||||
|
}
|
||||||
|
|
||||||
|
pub fn policy(&self) -> &RedactionPolicy {
|
||||||
|
&self.policy
|
||||||
|
}
|
||||||
|
|
||||||
|
/// Redact `input` according to the policy + known secret registry.
|
||||||
|
///
|
||||||
|
/// Order:
|
||||||
|
/// 1. Known literal secrets (defence in depth — never miss a value).
|
||||||
|
/// 2. Regex rules (with optional capture-group narrowing).
|
||||||
|
/// 3. Length cap for hostile / oversized strings (REDACT-TC-009).
|
||||||
|
pub fn redact_text(&self, input: &str) -> String {
|
||||||
|
// 1. Literal known secrets.
|
||||||
|
let mut text = input.to_string();
|
||||||
|
for known in self.known.snapshot() {
|
||||||
|
if !known.is_empty() {
|
||||||
|
text = text.replace(&known, REDACTION_MARKER);
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
// 2. Regex rules.
|
||||||
|
for rule in &self.policy.rules {
|
||||||
|
text = match rule.redact_group {
|
||||||
|
None => rule
|
||||||
|
.pattern
|
||||||
|
.replace_all(&text, REDACTION_MARKER)
|
||||||
|
.into_owned(),
|
||||||
|
Some(group) => rule
|
||||||
|
.pattern
|
||||||
|
.replace_all(&text, |caps: ®ex::Captures<'_>| {
|
||||||
|
let full = caps.get(0).map(|m| m.as_str()).unwrap_or("");
|
||||||
|
match caps.get(group) {
|
||||||
|
Some(target) => full.replace(target.as_str(), REDACTION_MARKER),
|
||||||
|
None => full.to_string(),
|
||||||
|
}
|
||||||
|
})
|
||||||
|
.into_owned(),
|
||||||
|
};
|
||||||
|
}
|
||||||
|
|
||||||
|
// 3. Length cap.
|
||||||
|
if text.len() > MAX_PROTOCOL_STRING_LEN {
|
||||||
|
// Find the last char boundary inside the budget so we
|
||||||
|
// never split a UTF-8 codepoint.
|
||||||
|
let mut cut = MAX_PROTOCOL_STRING_LEN;
|
||||||
|
while cut > 0 && !text.is_char_boundary(cut) {
|
||||||
|
cut -= 1;
|
||||||
|
}
|
||||||
|
let mut truncated = text[..cut].to_string();
|
||||||
|
truncated.push_str("…[truncated]");
|
||||||
|
text = truncated;
|
||||||
|
}
|
||||||
|
|
||||||
|
text
|
||||||
|
}
|
||||||
|
|
||||||
|
/// True if the policy classifies `field_name` as a sensitive
|
||||||
|
/// structured field that must be redacted wholesale.
|
||||||
|
pub fn is_sensitive_field(&self, field_name: &str) -> bool {
|
||||||
|
let lower = field_name.to_lowercase();
|
||||||
|
self.policy
|
||||||
|
.redact_field_substrings
|
||||||
|
.iter()
|
||||||
|
.any(|needle| lower.contains(needle))
|
||||||
|
}
|
||||||
|
}
|
||||||
@@ -0,0 +1,235 @@
|
|||||||
|
//! Verification tests mapped to
|
||||||
|
//! `docs/security/diagnostic-redaction-audit-report.md` §4
|
||||||
|
//! (REDACT-TC-001..010).
|
||||||
|
//!
|
||||||
|
//! Each test name carries its REDACT-TC- identifier for traceability.
|
||||||
|
|
||||||
|
use diagnostics_redaction_spike::{
|
||||||
|
bundle::DiagnosticBundle, Redactor, REDACTION_MARKER,
|
||||||
|
};
|
||||||
|
use indoc::indoc;
|
||||||
|
|
||||||
|
// Unique markers so a leak is unambiguous in test output.
|
||||||
|
const SERVER_PASSWORD: &str = "REDACT_POC_PW_a9c41f";
|
||||||
|
const IDENTITY_SECRET: &str =
|
||||||
|
"MG0DAgeAAgEgAiAIXJBlj1hQbaH0Eq0DuLlCmH8bl_veTAO2_k9EQjEYSgIgNnImcmKo7ls5mExb6skfK2Twu54aeDr0OP1ITsC50CIA";
|
||||||
|
const AUTH_TOKEN: &str = "tok_REDACT_POC_TOKEN_8d11";
|
||||||
|
|
||||||
|
fn fresh_redactor() -> Redactor {
|
||||||
|
Redactor::with_default_policy()
|
||||||
|
}
|
||||||
|
|
||||||
|
// ---------- REDACT-TC-001 ----------
|
||||||
|
|
||||||
|
#[test]
|
||||||
|
fn redact_tc_001_server_password_in_connection_data() {
|
||||||
|
let r = fresh_redactor();
|
||||||
|
let input = format!("connect host=cn.teamspeak.app password={SERVER_PASSWORD} nickname=Chanora");
|
||||||
|
let out = r.redact_text(&input);
|
||||||
|
assert!(!out.contains(SERVER_PASSWORD), "password leaked: {out}");
|
||||||
|
assert!(out.contains(REDACTION_MARKER), "no marker in {out}");
|
||||||
|
// The non-secret context must be preserved.
|
||||||
|
assert!(out.contains("host=cn.teamspeak.app"));
|
||||||
|
assert!(out.contains("nickname=Chanora"));
|
||||||
|
}
|
||||||
|
|
||||||
|
// ---------- REDACT-TC-002 ----------
|
||||||
|
|
||||||
|
#[test]
|
||||||
|
fn redact_tc_002_identity_secret_in_storage_error() {
|
||||||
|
let r = fresh_redactor();
|
||||||
|
// Register the identity as a known literal — strongest defense.
|
||||||
|
r.known_secrets().register(IDENTITY_SECRET);
|
||||||
|
|
||||||
|
let input = format!(
|
||||||
|
"ERROR: failed to load identity (raw={IDENTITY_SECRET}); falling back to default"
|
||||||
|
);
|
||||||
|
let out = r.redact_text(&input);
|
||||||
|
assert!(!out.contains(IDENTITY_SECRET), "identity leaked: {out}");
|
||||||
|
assert!(out.contains(REDACTION_MARKER));
|
||||||
|
}
|
||||||
|
|
||||||
|
// ---------- REDACT-TC-003 ----------
|
||||||
|
|
||||||
|
#[test]
|
||||||
|
fn redact_tc_003_server_url_with_password_field() {
|
||||||
|
let r = fresh_redactor();
|
||||||
|
let url = format!("ts3server://cn.teamspeak.app?password={SERVER_PASSWORD}&nickname=Chanora");
|
||||||
|
let out = r.redact_text(&url);
|
||||||
|
assert!(!out.contains(SERVER_PASSWORD));
|
||||||
|
// Only the password value should be redacted; host + nickname keep flowing.
|
||||||
|
assert!(out.contains("ts3server://cn.teamspeak.app"));
|
||||||
|
assert!(out.contains("nickname=Chanora"));
|
||||||
|
assert!(out.contains("password=[REDACTED]"));
|
||||||
|
}
|
||||||
|
|
||||||
|
// ---------- REDACT-TC-004 ----------
|
||||||
|
|
||||||
|
#[test]
|
||||||
|
fn redact_tc_004_chat_text_excluded_by_default() {
|
||||||
|
let r = fresh_redactor();
|
||||||
|
let bundle = DiagnosticBundle {
|
||||||
|
chat_history: vec!["hello!".into(), "private message".into()],
|
||||||
|
..Default::default()
|
||||||
|
};
|
||||||
|
let red = r.redact_bundle(&bundle);
|
||||||
|
assert!(red.chat_history.is_empty(), "chat should be excluded by default");
|
||||||
|
}
|
||||||
|
|
||||||
|
// ---------- REDACT-TC-005 ----------
|
||||||
|
|
||||||
|
#[test]
|
||||||
|
fn redact_tc_005_channel_name_with_unicode_excluded_by_default() {
|
||||||
|
let r = fresh_redactor();
|
||||||
|
let bundle = DiagnosticBundle {
|
||||||
|
channel_tree: vec!["樱花庄".into(), "Default Channel".into()],
|
||||||
|
..Default::default()
|
||||||
|
};
|
||||||
|
let red = r.redact_bundle(&bundle);
|
||||||
|
// Default policy: channel tree excluded (audit-report §5 "TBD / Redact/minimize").
|
||||||
|
assert!(red.channel_tree.is_empty());
|
||||||
|
}
|
||||||
|
|
||||||
|
// ---------- REDACT-TC-006 ----------
|
||||||
|
|
||||||
|
#[test]
|
||||||
|
fn redact_tc_006_nickname_with_unicode_preserved_in_safe_field() {
|
||||||
|
// Nickname is conveyed via a non-sensitive extras key; the redactor
|
||||||
|
// does NOT mangle Unicode in safe fields (preserves UTF-8 by
|
||||||
|
// ADR-008, see audit-report row "Multilingual safe diagnostic text").
|
||||||
|
let r = fresh_redactor();
|
||||||
|
let mut extras = std::collections::BTreeMap::new();
|
||||||
|
extras.insert("local_nickname".into(), "クマー".into());
|
||||||
|
let bundle = DiagnosticBundle { extras, ..Default::default() };
|
||||||
|
let red = r.redact_bundle(&bundle);
|
||||||
|
assert_eq!(red.extras.get("local_nickname").map(|s| s.as_str()), Some("クマー"));
|
||||||
|
}
|
||||||
|
|
||||||
|
// ---------- REDACT-TC-007 ----------
|
||||||
|
|
||||||
|
#[test]
|
||||||
|
fn redact_tc_007_local_file_paths_user_segment_minimized() {
|
||||||
|
let r = fresh_redactor();
|
||||||
|
let lines = [
|
||||||
|
"/home/milkice/chanora/app.log",
|
||||||
|
"C:\\Users\\Alice\\AppData\\Roaming\\Chanora\\log.txt",
|
||||||
|
"/Users/bob/Library/Application Support/Chanora/x.db",
|
||||||
|
];
|
||||||
|
for l in lines {
|
||||||
|
let out = r.redact_text(l);
|
||||||
|
assert!(!out.contains("milkice"), "leaked milkice: {out}");
|
||||||
|
assert!(!out.contains("Alice"), "leaked Alice: {out}");
|
||||||
|
assert!(!out.contains("bob"), "leaked bob: {out}");
|
||||||
|
assert!(out.contains(REDACTION_MARKER), "no marker in {out}");
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
// ---------- REDACT-TC-008 ----------
|
||||||
|
|
||||||
|
#[test]
|
||||||
|
fn redact_tc_008_diagnostic_bundle_with_mixed_sensitive_fields() {
|
||||||
|
let r = fresh_redactor();
|
||||||
|
r.known_secrets().register(IDENTITY_SECRET);
|
||||||
|
|
||||||
|
let mut extras = std::collections::BTreeMap::new();
|
||||||
|
extras.insert("server_password".into(), SERVER_PASSWORD.into());
|
||||||
|
extras.insert("auth_token".into(), AUTH_TOKEN.into());
|
||||||
|
extras.insert("app_locale".into(), "en-US".into());
|
||||||
|
extras.insert("user_home".into(), "/home/milkice".into());
|
||||||
|
|
||||||
|
let bundle = DiagnosticBundle {
|
||||||
|
app_version: "0.0.0-poc".into(),
|
||||||
|
build_number: "1".into(),
|
||||||
|
platform_info: "Linux x86_64 path=/home/milkice/.local".into(),
|
||||||
|
connection_state: format!("disconnected; last_error=password={SERVER_PASSWORD}"),
|
||||||
|
server_address: Some(format!(
|
||||||
|
"ts3server://cn.teamspeak.app?password={SERVER_PASSWORD}"
|
||||||
|
)),
|
||||||
|
channel_tree: vec!["whatever".into()],
|
||||||
|
chat_history: vec!["should not appear".into()],
|
||||||
|
log_lines: vec![
|
||||||
|
format!("INFO loaded identity={IDENTITY_SECRET}"),
|
||||||
|
format!("WARN auth failed Authorization: Bearer {AUTH_TOKEN}"),
|
||||||
|
],
|
||||||
|
audio_device_names: vec!["Built-in Microphone".into()],
|
||||||
|
extras,
|
||||||
|
};
|
||||||
|
|
||||||
|
let red = r.redact_bundle(&bundle);
|
||||||
|
|
||||||
|
// Whole-bundle leak check: no plaintext anywhere.
|
||||||
|
let blob = serde_json::to_string(&red).unwrap();
|
||||||
|
assert!(!blob.contains(SERVER_PASSWORD), "server password leaked: {blob}");
|
||||||
|
assert!(!blob.contains(IDENTITY_SECRET), "identity leaked: {blob}");
|
||||||
|
assert!(!blob.contains(AUTH_TOKEN), "auth token leaked: {blob}");
|
||||||
|
assert!(!blob.contains("milkice"), "username leaked: {blob}");
|
||||||
|
assert!(!blob.contains("should not appear"), "chat leaked: {blob}");
|
||||||
|
|
||||||
|
// Positive checks: structural fields keep flowing.
|
||||||
|
assert_eq!(red.app_version, "0.0.0-poc");
|
||||||
|
assert_eq!(red.build_number, "1");
|
||||||
|
assert!(red.audio_device_names.contains(&"Built-in Microphone".to_string()));
|
||||||
|
assert_eq!(red.extras.get("app_locale").map(|s| s.as_str()), Some("en-US"));
|
||||||
|
assert_eq!(red.extras.get("server_password").map(|s| s.as_str()), Some(REDACTION_MARKER));
|
||||||
|
assert_eq!(red.extras.get("auth_token").map(|s| s.as_str()), Some(REDACTION_MARKER));
|
||||||
|
}
|
||||||
|
|
||||||
|
// ---------- REDACT-TC-009 ----------
|
||||||
|
|
||||||
|
#[test]
|
||||||
|
fn redact_tc_009_long_hostile_protocol_string_truncated() {
|
||||||
|
let r = fresh_redactor();
|
||||||
|
// A long benign string that does NOT match any redaction rule
|
||||||
|
// (no base64-style run, no path, no key=value secret) — so the
|
||||||
|
// length cap is the only thing that can act on it.
|
||||||
|
let huge: String = "hello world! ".repeat(400);
|
||||||
|
let out = r.redact_text(&huge);
|
||||||
|
assert!(out.len() < huge.len(), "expected truncation; got len={} input_len={}", out.len(), huge.len());
|
||||||
|
assert!(out.ends_with("…[truncated]"), "missing truncation marker; tail={:?}", &out[out.len().saturating_sub(40)..]);
|
||||||
|
}
|
||||||
|
|
||||||
|
// ---------- REDACT-TC-010 ----------
|
||||||
|
|
||||||
|
#[test]
|
||||||
|
fn redact_tc_010_multilingual_safe_text_preserved() {
|
||||||
|
let r = fresh_redactor();
|
||||||
|
let lines = indoc! {"
|
||||||
|
Welcome to Vigorous Pro!
|
||||||
|
欢迎来到 Vigorous Pro
|
||||||
|
日本語チャンネル
|
||||||
|
한국어 채널
|
||||||
|
Café résumé naïve
|
||||||
|
"};
|
||||||
|
let out = r.redact_text(lines);
|
||||||
|
for l in [
|
||||||
|
"Vigorous Pro",
|
||||||
|
"欢迎来到",
|
||||||
|
"日本語チャンネル",
|
||||||
|
"한국어 채널",
|
||||||
|
"Café résumé naïve",
|
||||||
|
] {
|
||||||
|
assert!(out.contains(l), "missing line {l:?} in {out}");
|
||||||
|
}
|
||||||
|
// No redaction markers should appear for benign multilingual text.
|
||||||
|
assert!(!out.contains(REDACTION_MARKER));
|
||||||
|
}
|
||||||
|
|
||||||
|
// ---------- Additional sanity ----------
|
||||||
|
|
||||||
|
#[test]
|
||||||
|
fn known_secret_is_scrubbed_even_when_no_regex_matches() {
|
||||||
|
let r = fresh_redactor();
|
||||||
|
let weird = "BANANA_PHONE_42";
|
||||||
|
r.known_secrets().register(weird);
|
||||||
|
let out = r.redact_text(&format!("note: secret value is {weird} here"));
|
||||||
|
assert!(!out.contains(weird));
|
||||||
|
assert!(out.contains(REDACTION_MARKER));
|
||||||
|
}
|
||||||
|
|
||||||
|
#[test]
|
||||||
|
fn empty_registered_secret_is_ignored() {
|
||||||
|
let r = fresh_redactor();
|
||||||
|
r.known_secrets().register("");
|
||||||
|
let out = r.redact_text("nothing to redact");
|
||||||
|
assert_eq!(out, "nothing to redact");
|
||||||
|
}
|
||||||
Reference in New Issue
Block a user