Description
The Wave 6 pre-close confidentiality review found that malformed API response formatting recognises sensitive field names only when they use strict double-quoted JSON syntax. Single-quoted, unquoted, and split-quote JSON-like keys can therefore expose credential values through APICallError and shipped poll diagnostics.
Acceptance Criteria
- #1 Malformed-body sensitive-field classification covers single-quoted and unquoted keys through the shared SensitiveConfigKey vocabulary
- #2 Split-quote sensitive key fragments cannot expose their associated value in APICallError output
- #3 Focused redaction tests and the repository gate pass without over-redacting benign JSON-like fields
Definition of Done
- #1 just check
- #2 just gen (if any generated artifact changed) and the diff committed
Implementation Plan
-
Add the three observed malformed-key reproducers and observe each value survive.
-
Add a bounded JSON-like key scanner that delegates classification to SensitiveConfigKey and fails closed on split sensitive names.
-
Run focused race tests, CodeRabbit review, the repository gate, then commit and push.
-
Treat single-quoted strings as opaque inside composite sensitive values, consume malformed scalar suffixes fail closed, and skip JSON-like colon candidates inside genuine quoted strings.
-
Validate apparent quoted-token boundaries before skipping them, and make malformed-suffix scanning quote-aware so delimiters inside a suffix fragment cannot terminate redaction early.
-
Only skip a quoted token when its opener and trailing boundary form a structurally valid key or value position; a top-level string followed by a delimiter is malformed and must be rescanned.
Implementation Notes
Observed single-quoted, unquoted and split-quote key regressions fail before the fix. A bounded object-key pass strips quote artifacts, delegates to SensitiveConfigKey and preserves explicit benign JSON-like controls; the focused race-enabled truncation suite passes.
Independent review additionally reproduced a composite delimiter leak, a malformed suffix after a quoted sensitive scalar, and benign prose over-redaction. All failed before the fix and pass after single-quote-aware composite scanning, malformed-suffix consumption and opener-aware string skipping.
Independent review found that a stray opening quote could hide a later unquoted password field and that a comma inside a quoted malformed suffix leaked the tail. Both regressions failed before the fix and now pass under the focused race suite.
Independent review found a credential beginning with a comma, brace or bracket could make a stray leading quote look complete and hide an unquoted password field. The comma regression failed before the fix and passes after token skipping became context-aware.
Final independent-review reproducer: an apparently valid outer object, array, or comma-delimited string could end at password: while its closing quote simultaneously opened the malformed credential value. All three cases failed before the fix and pass after structurally skippable quoted tokens began yielding when they end at a shared sensitive-field delimiter.
Validation at implementation commit 3bb2bdd9: the focused race-enabled redaction suites and final just check passed; the final CodeRabbit two-file source slice completed with findings=0. The independent reviewer found the last overlapping-quote bypass, its object/array/comma reproducers failed before the fix and passed after it; the requested final independent retry was platform-blocked and is not counted as a clean pass.
Final Summary
Closed the malformed API-response credential-redaction bypass described by this task in implementation commit 3bb2bdd9. Focused race tests, the repository gate, and a completed zero-finding CodeRabbit source review passed.