From 56ddeb8ac352f4065e9d16626e2fa5bf90c26f1b Mon Sep 17 00:00:00 2001 From: luvs01 Date: Tue, 11 Aug 2026 10:45:40 +0900 Subject: [PATCH] fix(lab): redact digit-suffixed upstream hosts --- src/lab/artifacts/sanitize.ts | 9 +++++---- tests/lab-evidence-sanitization.test.ts | 4 ++++ 2 files changed, 9 insertions(+), 4 deletions(-) diff --git a/src/lab/artifacts/sanitize.ts b/src/lab/artifacts/sanitize.ts index afb638628..93a62d56d 100644 --- a/src/lab/artifacts/sanitize.ts +++ b/src/lab/artifacts/sanitize.ts @@ -166,11 +166,12 @@ const WEAK_HOST_CONTEXT_RE = /\b(?:upstream)["']?\s*[\s=:]\s*["']?([A-Za-z0-9_.-]{1,255})/gi; /** - * A dotted run of plain alphabetic words with no digits or hyphens in any - * label — `provider.metric.p95` reads as a namespace, not a host. Under a - * WEAK marker this is left alone; under a STRONG one the marker decides. + * A dotted run of plain alphabetic words, or the conventional + * `.metric.p` shape, reads as a namespace rather than a host. + * Other digit-suffixed labels are host-shaped and must not receive this weak + * marker exemption. Under a STRONG marker the marker always decides. */ -const DOTTED_NAMESPACE_RE = /^[a-z]+(?:\.[a-z]+)*\.[a-z]+[0-9]*$/i; +const DOTTED_NAMESPACE_RE = /^(?:[a-z]+(?:\.[a-z]+)+|[a-z]+(?:\.[a-z]+)*\.metric\.p[0-9]+)$/i; /** * Does this token look like a host rather than an English word? diff --git a/tests/lab-evidence-sanitization.test.ts b/tests/lab-evidence-sanitization.test.ts index d91e9242e..c15f3c4dd 100644 --- a/tests/lab-evidence-sanitization.test.ts +++ b/tests/lab-evidence-sanitization.test.ts @@ -213,6 +213,10 @@ describe("SEC-02 sanitizer boundary", () => { .toBe("dial tcp [host]:443: connect: refused"); expect(sanitizeDiagnostic("upstream api.us-east-1 unavailable")) .toBe("upstream [host] unavailable"); + for (const host of ["internal.service1", "db.prod1", "api.v2"]) { + expect(sanitizeDiagnostic(`upstream ${host} unavailable`)) + .toBe("upstream [host] unavailable"); + } // Without such a marker they survive — a recorded limit, asserted so it // cannot drift silently in either direction. expect(sanitizeDiagnostic("db.prod-1")).toBe("db.prod-1");