fix(plugins): redact credential patterns in free-text values, not just exact keys - #6499
Open
prasanna8585 wants to merge 1 commit into
Open
Conversation
…t exact keys
_recursive_smart_truncate -> _sanitize_json_blob / _sanitize_free_text
is the sanitization path used for tool args/results, session-state
deltas, usage/cache metadata, A2A payloads, and tool schemas (every
event type BigQueryAgentAnalyticsPlugin logs except proper LLM Part
content, which already goes through _sanitize_strings ->
_sanitize_sensitive_text).
That path only pattern-inspects strings that are JSON-container-shaped
(start with '{' or '['); plain prose values were returned completely
unchanged, with only exact dict-key matches against _SENSITIVE_KEYS
redacted. A credential embedded in ordinary text under an unrecognized
key -- e.g. a tool's own status/error message containing
'Authorization: Bearer sk-...' or 'api_key: sk-...' -- reached BigQuery
in plaintext.
This wires the existing _redact_sensitive_patterns() pass (already used
for signed-URI segments, Part-content text, and error/traceback text)
into the two prose fallback branches of _sanitize_json_blob and
_sanitize_free_text, so credential-shaped text is caught regardless of
which key it's nested under or whether it's JSON-shaped at all.
Verified against the existing test suite (437 passed, 0 regressions)
and added a regression test covering the reported gap.
adk-bot
added
the
tracing
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
_recursive_smart_truncate->_sanitize_json_blob/_sanitize_free_textis the sanitization path used for tool args/results, session-state deltas, usage/cache metadata, A2A payloads, and tool schemas. That path only pattern-inspects JSON-container-shaped strings; plain prose values passed through unredacted with only exact dict-key matches against_SENSITIVE_KEYSbeing caught. This wires the existing_redact_sensitive_patterns()pass (already used for signed-URI segments, Part-content text, and error/traceback text) into the two prose fallback branches so credential-shaped text is caught regardless of which key it's nested under.Verified against the existing test suite (437 passed, 0 regressions) with a new regression test added for the fixed gap.