bread-scrub leaks seeded PII through marker, IPv6, URL and dropped-key paths #36
Breadway
Loading…
Add table
Add a link
Reference in a new issue
No description provided.
Delete branch "%!s()"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
Found by independent review of BREAD-15, PR #21 at
4dec9ea9f5. Confidence: high, compiled Rust probe against the immutable crate reproduces every case. Track repairs on existing PR #21, not a duplicate implementation PR.Reproductions with Scrubber::new(ScrubContext::default()):
Add these to the golden/property corpus, remove bypasses and verify all seeded values disappear while known generated markers remain idempotent. BREAD-15 remains the acceptance gate.
Independent exact-SHA re-review: changes_requested at
3616fcf9cc. Full criterion mapping and actionable file/line repair checklist: #21 (comment). Confidence high: compiled immutable-crate probes reproduce credential/query leaks when generated markers occur inside URLs. https://bob:@example.com/x?account=alice remains unchanged; a query containing IP:1 retains &owner=alice. This continues BREAD-37 and prior rejection 4248, no duplicate bug card needed. Existing original raw-token URL, IPv6, AWS-marker, dropped-key and short-host regressions pass; whole-report pre-reservation and bounded depth pass. 27 unit + 7 corpus/fuzz tests, crate clippy/fmt/docs pass. Multiple-ingest-scope numbering and real two-pass integration remain unverified; open PRs #22/#23 are not integrated evidence. Required exact-head CI run124 pending. Move todo for coordinator repairs on existing PR21, preserve all stacked branches. No merge or done transition. Durable session updated reworking; fresh SHA-bound review and CI required after repairs.Follow-up integration reproduction, confidence high: composed existing report/store PR23 with scrubber repair
a052ed9in isolated fix/breadbug-two-pass-verification. Existing 40 bread-bug tests pass. New reopened_store_markers_and_report_notes_remain_distinct fails: open Store, append remote 203.0.113.42, close/reopen Store, append remote 198.51.100.8, build actual report. Both logs become remote IP:1. Store::open creates fresh Scrubber without reserving existing on-disk marker numbers. This confirms the multiple-ingest-scope collision already tracked here. Regression preserved in isolated integration worktree. Marker-bearing URL repair passes 28 unit and 7 corpus/fuzz tests plus clippy/fmt and is pushed PR21 ata052ed9805. No merge or done transition.Independent blocked at39ff3130583485dada208fe3c470954cacb56317. Full evidence #21 (comment). URL repairs and377 workspace tests/clippy/fmt/docs pass. Clean report9117355 passes42 tests including restarted logsIP1/IP2 and notesIP3 plus complete URL redaction. However actual consumers remain unmerged/unaccepted, not integrated feature acceptance; required CI129 pending. PR22 also has reproduced strict-cap defect BREAD-40 and missing journal ingest. Leave review, no merge/retarget or done. Coordinator must reconcile prerequisite/full-issue integration scope without waiving criteria, repair consumers and obtain fresh SHA review.
Independent exact-head review at
39ff313058: library checks pass, full-card verdict blocked. Persisted criterion mapping, scope decision, job-by-job CI and combined-main checks: #21 (comment) . Required check / check (push), run129/job0 attempt2, and every step SUCCESS. Live base05125ef; conflict-free combined tree builds, passes377 workspace tests, clippy and docs. Exact library28 units+7 corpus/fuzz pass. No remaining identified library code defect. Actual cards still require integrated two-pass notes and distinct markers across restarted ingest scopes, which PR21 does not supply. Reconcile actual card/closing-reference scope into a library-only prerequisite with all consumer acceptance retained downstream, then fresh scope-bound gate, or provide accepted integrated consumers/evidence. Preserve stack and review status. No merge, branch deletion or done transition.Scope reconciliation for the review at #21 (comment). PR21 no longer closes BREAD-15; its body now scopes it as the library half of BREAD-15 and BREAD-37. The two-pass ingest and report criteria and the cross-restart, multi-scope marker criterion stay open on both cards. They are verified on integrated main after PR22 and PR23, and neither card moves to done on this merge.
Scope-bound library prerequisite PASS at39ff3130583485dada208fe3c470954cacb56317, persisted #21 (comment) . Accepted live scope reconciliation; no closing reference remains in PR body, although breadboard retains stale closes metadata. Final head39ff313/base05125ef, exact-head required check and run129/job0 attempt2 every step success, reviews API empty and mergeability confirmed immediately before normal expected-head-conditioned merge. Actual merged=true and merge SHA4a164fd98a9c749a6afa1ffd7b70ce0a5df83b86 confirmed. Head branch preserved for PR22. Independent library35 tests and combined-tree377 workspace tests/build/clippy/docs pass as recorded4498. This is NOT full-card acceptance or done: keep review pending integrated-main two-pass ingest/report notes and cross-restart/multi-scope marker verification after accepted PR22/23. No tags or manual release.
Retained consumer gate now verified on integrated main at PR23 merge
6699643099. Clean detached worktree: cargo test --locked -p bread-bug -p breadbug --lib passes 47+11. Includes scrubbed-on-disk ingest, cross-app/rotation marker reservation after reopen, report-time seeded PII absence, and reopened_store_markers_and_report_notes_remain_distinct (IP:1/IP:2 from store, IP:3 from notes with URL credentials/query removed). Library independent review remains PR21 comment 4523; composed report independent pass is PR23 comment 4672. Dev-release success at integrated merge SHA.