Description
The Wave 6 CodeRabbit review found that the tolerant malformed-body key scanner treats backslash-u sequences as literal key text. An unquoted or otherwise non-strict JSON-like credential key can therefore encode a sensitive character, evade SensitiveConfigKey classification, and expose its value through APICallError and shipped poll diagnostics.
Acceptance Criteria
- #1 Unicode escapes in malformed JSON-like key candidates are decoded before shared sensitive-key classification
- #2 Malformed escape-bearing key candidates fail closed rather than exposing an associated value
- #3 Focused redaction tests, independent confidentiality review and the repository gate pass
Definition of Done
- #1 just check
- #2 just gen (if any generated artifact changed) and the diff committed
Implementation Plan
-
Add valid and malformed escaped-key reproducers and observe credential leakage. 2. Decode valid Unicode escapes in bounded JSON-like key candidates and classify malformed escape-bearing candidates fail closed. 3. Run the focused race suite, independent review, CodeRabbit and the repository gate.
-
Recognize a Unicode-escaped colon as a malformed field delimiter outside quoted strings.
Implementation Notes
Both an unquoted Unicode-escaped password key and an invalid escape-bearing key leaked in the failing-before regression. The bounded JSON-like key decoder now resolves valid Unicode escapes and treats malformed escapes as sensitive ambiguity; the focused race suite passes.
Independent review found that a Unicode-escaped colon after a sensitive key bypassed discovery even though key escapes were decoded. The regression failed before the fix and now passes with encoded-colon recognition outside quoted strings.
Validation at implementation commit 3bb2bdd9: the focused race-enabled redaction suites and final just check passed; the final CodeRabbit two-file source slice completed with findings=0. The independent reviewer found the last overlapping-quote bypass, its object/array/comma reproducers failed before the fix and passed after it; the requested final independent retry was platform-blocked and is not counted as a clean pass.
Final Summary
Closed the malformed API-response credential-redaction bypass described by this task in implementation commit 3bb2bdd9. Focused race tests, the repository gate, and a completed zero-finding CodeRabbit source review passed.