Fix installation-token redaction regex for new stateless token format - #4721
Open
aravindgee wants to merge 3 commits into
Open
Fix installation-token redaction regex for new stateless token format#4721aravindgee wants to merge 3 commits into
aravindgee wants to merge 3 commits into
Conversation
GitHub's new stateless installation token format (ghs_<id>_<base64url JWT>) contains '.' and '-', which the existing [A-Za-z0-9]+ character class in the error-log redaction regex does not match. Redaction would stop at the first '.' or '-', leaking the remainder of a real token into CI logs if one ever appeared in the error response body. Widen the character class to include the full base64url + JWT-separator alphabet.
{36,} reintroduces the exact hardcoded-length assumption we're fixing:
a token at 35 chars after the prefix goes completely unredacted.
[A-Za-z0-9._-]+ has no such cliff edge.
aravindgee
marked this pull request as ready for review
August 11, 2026 21:09
aravindgee
changed the title
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Widens the installation-token redaction regex (only hit when
.tokenextraction fails) to fully cover GitHub's new stateless token format — see the announcement.New tokens are
ghs_<id>_<base64url JWT>and contain./-, which the old[A-Za-z0-9]+class didn't match — redaction stopped at the first one, leaking the rest of a real token into logs. No minimum length: GitHub's post recommends{36,}, but that reintroduces a hardcoded-length assumption (a 35-char tail goes fully unredacted) — the exact thing the post warns against — so this drops it. Same fix applied to nitro, nitro-private, and infrastructure (identical line in all three buildspecs).Tracked in SREP-3581.