Description
The Wave 6 pre-close confidentiality review found that a malformed single-quoted HTML attribute can consume the opener of a later URL attribute. The attribute scanner then skips the later value, JSON scanning cannot recover single-quoted HTML, and whitespace-bearing URL credentials can reach APICallError and shipped poll diagnostics.
Acceptance Criteria
- #1 Quoted HTML URL scanning reconsiders overlapping attribute boundaries after a non-sensitive candidate
- #2 Credential userinfo and query values remain redacted after malformed single-quoted HTML and in standalone single-quoted diagnostic URLs
- #3 Focused redaction tests and the repository gate pass
Definition of Done
- #1 just check
- #2 just gen (if any generated artifact changed) and the diff committed
Implementation Plan
-
Add the reviewer malformed-attribute and standalone single-quoted URL reproducers and observe leakage.
-
Resynchronise the HTML attribute scanner and cover standalone quoted diagnostic tokens without weakening JSON escape handling.
-
Run focused race tests, CodeRabbit review, the repository gate, then commit and push.
-
Inspect incomplete standalone single-quoted URL tokens before returning, and use escape-aware generic quote boundaries so an escaped apostrophe cannot split credential userinfo.
-
Treat an incomplete standalone single-quoted authority prefix as possible userinfo even when the whole body is below the truncation limit.
-
After a quoted URL rewrite, skip internal quote candidates but reconsider its closing quote as the only possible overlap boundary; apply the same rule to nested HTML attributes.
Implementation Notes
Observed all three single-quote regressions fail before the fix. HTML attribute scanning now reconsiders nested equals boundaries, and a post-normalization single-quoted URL pass protects standalone diagnostic tokens; the focused race-enabled truncation suite passes.
Independent review additionally reproduced incomplete and backslash-escaped standalone single-quoted credential URLs. Both failed before the fix and pass after the generic pass began inspecting incomplete tokens and using escape-aware quote termination.
CodeRabbit pass 2 found that an incomplete short single-quoted userinfo prefix still leaked because EOF classification was tied to body truncation. The focused regression failed before the fix; incomplete single-quoted tokens now apply the fail-closed quoted-userinfo suffix classifier regardless of body length.
Independent review found two panic paths from rescanning quotes inside already rewritten URL spans. Both panic reproducers now pass: a rewrite jumps to its closing quote rather than an escaped internal apostrophe, while a rewritten outer HTML attribute does not re-enter a nested attribute whose credentials were already scrubbed by the shared value redactor.
Validation at implementation commit 3bb2bdd9: the focused race-enabled redaction suites and final just check passed; the final CodeRabbit two-file source slice completed with findings=0. The independent reviewer found the last overlapping-quote bypass, its object/array/comma reproducers failed before the fix and passed after it; the requested final independent retry was platform-blocked and is not counted as a clean pass.
Final Summary
Closed the malformed API-response credential-redaction bypass described by this task in implementation commit 3bb2bdd9. Focused race tests, the repository gate, and a completed zero-finding CodeRabbit source review passed.