trace2: redact signatures from HTTP(S) URLs - #79
Open
ttaylorr-oai wants to merge 3 commits into
Open
Conversation
ttaylorr-oai
added
kind:review-only
ttaylorr-oai
force-pushed
the
dr/codex/trace2-redact-url-signatures
branch
3 times, most recently
from
September 2, 2026 18:01
042b556 to
7249010
Compare
ttaylorr-oai
force-pushed
the
dr/codex/trace2-redact-url-signatures
branch
from
September 2, 2026 18:14
7249010 to
3c52d45
Compare
ttaylorr-oai
force-pushed
the
codex
branch
3 times, most recently
from
September 9, 2026 00:14
809b7da to
777246e
Compare
Trace2 removes passwords from HTTP(S) URL arguments, but leaves query signatures in the trace. A signed URL can therefore disclose an access credential even when password redaction is enabled. Redact nonempty values whose decoded parameter names are "sig", "signature", or end in "-signature". Use the query-parameter decoder and Git's ASCII case folding, while preserving the spelling of the URL and unrelated query fields. Recognize HTTP(S) schemes case-insensitively, and keep user information, the query, and the fragment separate. Signed-off-by: Daniel Reynaud <dreynaud@openai.com> Signed-off-by: Taylor Blau <ttaylorr@openai.com>
Transport errors can include a signed URL in the message passed to error() or die(). Argument redaction does not cover these messages, so a failed request can still record its password or signature in Trace2. Have each target redact its formatted error payload. Keep the existing va_list callback contract, including each target's use of va_copy(), so the caller can still use the arguments when writing to stderr. Redact the JSON target's separate format field as well, accounting for doubled percent signs in literal query parameter names. Use whitespace, double quotes, and angle brackets to delimit URLs in error messages. Keep a trailing quote for a single-quoted token, but treat other punctuation as part of the URL: an apostrophe inside a signature is not a reliable delimiter. Continue scanning for adjacent or nested URLs after redacting each match. Signed-off-by: Daniel Reynaud <dreynaud@openai.com> Signed-off-by: Taylor Blau <ttaylorr@openai.com>
trace2_cmd_alias_fl() passes its argument array directly to the targets. A URL embedded in an ordinary alias definition, or passed through a shell alias, can therefore appear in an alias event without the redaction used for start, child_start, and exec events. Redact the arguments before alias-event dispatch and release the temporary array afterward. Signed-off-by: Taylor Blau <ttaylorr@openai.com>
ttaylorr-oai
force-pushed
the
dr/codex/trace2-redact-url-signatures
branch
from
September 9, 2026 23:26
3c52d45 to
764f047
Compare
dreynaud-oai
approved these changes
Sep 9, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Trace2 removes HTTP(S) URL passwords but leaves signed query parameters in several trace paths. Redact
sig,signature, and names ending in-signaturein URL arguments, error events, and alias events. Keep command arguments, stderr, andGIT_TRACE2_REDACT=0working as before.Keep the existing error callback and
va_listcontract. Each target redacts its formatted payload; JSON retains separatemsgandfmtfields. Query names use Git's parameter decoder and ASCII case folding. Error redaction covers complete signature values and adjacent or nested URLs.Validation:
t0212-trace2-event.shpasses with a developer build on macOS.The three commits are based on
masterat b8242b0. The PR targetscodexfor stable-topic review; the action pins are separate in #80.Supersedes #72 on
dr/codex/trace2-redact-url-signatures.