HazyLabandcl-ment ce2fcffaf1 perf(redaction): add fast-path byte checks to eliminate regex allocations on clean strings (#945) ...

* perf(redaction): add fast-path byte checks to eliminate regex allocations on clean strings

Evaluating cascading regular expressions across every log line, tool output,
and session event incurred ~23 µs and 51 heap allocations even on strings with
zero secrets.

This introduces fast-path substring checks before invoking expensive regex
substitutions, yielding a 70x speedup and 0 B/op heap allocation on clean
strings.

* test(redaction): lengthen ghp_ fixtures and cover conditional gates

GitHub classic tokens need 36 characters after ghp_. Benchmarks and
shape tests now use a matching fixture. A table-driven test checks each
fast-path gate, including near-misses and case-insensitive Authorization.

* perf(redaction): structure triggered patterns and avoid allocation in header case checks

* test(redaction): cover secret-header and URL-password gates

Keep the redaction marker literal after url.URL rewrites userinfo, so
callers still see [REDACTED] instead of a percent-encoded form.

* fix(redaction): unescape only the generated URL password

A path or query that already contains the encoded redaction marker
must stay encoded. Only the userinfo password is rewritten in the
clear [REDACTED] form.

* fix(redaction): re-escape URL username after parse

Username() is decoded. Re-encoding with url.User keeps control bytes
out of the redacted URL so a %0AAuthorization userinfo cannot inject
a header after the header pass.

* fix(redaction): fail closed on password URLs without a host

* test(redaction): isolate query-gate coverage from assign and text secrets

* fix(redaction): fold Unicode U+017F and U+212A in containsCaseInsensitive

Go (?i) regular expressions apply Unicode simple case folding, where U+017F (ſ) folds to 's' and U+212A (K) folds to 'k'. Teach containsCaseInsensitive to fold these runes to ASCII lowercase with zero allocations so case-insensitive header gates cannot be bypassed by Unicode-folded equivalents.

---------

Co-authored-by: cl-ment <[email protected]>

2026-10-15 21:15:42 +08:00

..

audit_fixes_test.go

fix(redaction): split camelCase keys in normalizeKey (#994)

2026-09-12 08:45:58 +08:00

control_split_test.go

fix(redaction): redact credentials split by an invisible character (#1067)

2026-10-12 09:24:15 +08:00

control_split.go

fix(redaction): redact credentials split by an invisible character (#1067)

2026-10-12 09:24:15 +08:00

opaque_auth_test.go

fix model-discovery fallback + redact opaque Authorization tokens (#266)

2026-06-20 10:39:35 +05:30

redaction_test.go

perf(redaction): add fast-path byte checks to eliminate regex allocations on clean strings (#945)

2026-10-15 21:15:42 +08:00

redaction.go

perf(redaction): add fast-path byte checks to eliminate regex allocations on clean strings (#945)

2026-10-15 21:15:42 +08:00