EXP-02: bodyExcerpt can leave a truncated credential in the excerpt #215

New issue

Closed

opened 2026-08-18 10:24:13 +00:00 by john · 1 comment

john commented

2026-08-18 10:24:13 +00:00

Owner

Requirement EXP-02, seeded at the v3.5.3 close. Found while carrying the v3.5.3 risk_surface survivors forward, and still live at v3.5.3.

bodyExcerpt's trailing-token safeguard runs only when clean <= room, so a sanitizer shrink can pull a window-edge-truncated credential's head under the cap while clean still exceeds it (review-provider.mjs:689).

Failure scenario, from the fire that raised it: a >4096-byte body whose first ~3000 bytes are one credential assignment, followed by a URL with userinfo straddling the window edge. The partial URL moves to byte 961 of clean, clean is ~1173 against a room of 1009, so the head cut returns ~36 bytes of the secret.

This is the one finding of the four blocker/high carried out of v3.5.3 that was NOT already fixed in the tree. The other three (the missing res error listener, the camelCase credential key, the quoted multi-word value) were verified fixed by probe at the close.

Fix direction: the safeguard runs on the path that truncates, not only on the path that fits.

Requirement EXP-02, seeded at the v3.5.3 close. Found while carrying the v3.5.3 `risk_surface` survivors forward, and still live at v3.5.3. `bodyExcerpt`'s trailing-token safeguard runs only when `clean <= room`, so a sanitizer shrink can pull a window-edge-truncated credential's head under the cap while `clean` still exceeds it (`review-provider.mjs:689`). **Failure scenario, from the fire that raised it:** a >4096-byte body whose first ~3000 bytes are one credential assignment, followed by a URL with userinfo straddling the window edge. The partial URL moves to byte 961 of `clean`, `clean` is ~1173 against a room of 1009, so the head cut returns ~36 bytes of the secret. This is the one finding of the four blocker/high carried out of v3.5.3 that was NOT already fixed in the tree. The other three (the missing `res` error listener, the camelCase credential key, the quoted multi-word value) were verified fixed by probe at the close. **Fix direction:** the safeguard runs on the path that truncates, not only on the path that fits.