anomalyco/opencode
1
0
Fork 0
mirror of https://github.com/anomalyco/opencode.git synced 2026-07-23 02:36:57 -04:00
Code Issues 5.9k Packages Projects Releases 19 Wiki Activity

[PR #11178] fix: sanitize error messages to prevent credential leakage #13678

New Issue
Closed
opened 2026-02-16 18:18:30 -05:00 by yindo · 0 comments
yindo commented 2026-02-16 18:18:30 -05:00
Owner
Copy Link
Copy Source

Original Pull Request: https://github.com/anomalyco/opencode/pull/11178

State: closed
Merged: No

Summary

This PR fixes a security vulnerability where sensitive environment variables and tokens were being leaked into PR comments when shell errors occurred in the GitHub Action.

Security Impact

Severity: High

The GitHub Action was posting raw stderr output from shell commands to PR comments. This could expose:

  • GITHUB_TOKEN
  • ACTIONS_ID_TOKEN_REQUEST_TOKEN
  • ACTIONS_ID_TOKEN_REQUEST_URL
  • User-provided API keys (e.g., ZHIPU_API_KEY)
  • Various GITHUB_* context variables
  • Other secrets in environment variables

Fix

Added a sanitizeErrorMessage() function that sanitizes error messages before posting them to PR comments:

  1. Redacts base64-encoded tokens: Authorization headers, x-access-token values
  2. Redacts GitHub tokens: Matches ghp_, gho_, ghr_, ghs_ prefixes
  3. Redacts common API keys: GITHUB_TOKEN, AWS credentials, OpenAI keys, etc.
  4. Redacts URLs with embedded credentials: https://token@github.com patterns
  5. Truncates suspicious long lines: Lines >200 chars with base64-like patterns

Changes

  • Modified github/index.ts to call sanitizeErrorMessage() on shell error stderr
  • Added sanitizeErrorMessage() function with comprehensive regex-based redaction

Testing

The function handles:

  • Shell errors containing environment variables
  • Git command errors with embedded tokens
  • HTTP errors with Authorization headers
  • Long base64-encoded strings

Fixes #11166

**Original Pull Request:** https://github.com/anomalyco/opencode/pull/11178 **State:** closed **Merged:** No --- ## Summary This PR fixes a security vulnerability where sensitive environment variables and tokens were being leaked into PR comments when shell errors occurred in the GitHub Action. ## Security Impact **Severity: High** The GitHub Action was posting raw `stderr` output from shell commands to PR comments. This could expose: - `GITHUB_TOKEN` - `ACTIONS_ID_TOKEN_REQUEST_TOKEN` - `ACTIONS_ID_TOKEN_REQUEST_URL` - User-provided API keys (e.g., `ZHIPU_API_KEY`) - Various `GITHUB_*` context variables - Other secrets in environment variables ## Fix Added a `sanitizeErrorMessage()` function that sanitizes error messages before posting them to PR comments: 1. **Redacts base64-encoded tokens**: Authorization headers, x-access-token values 2. **Redacts GitHub tokens**: Matches `ghp_`, `gho_`, `ghr_`, `ghs_` prefixes 3. **Redacts common API keys**: GITHUB_TOKEN, AWS credentials, OpenAI keys, etc. 4. **Redacts URLs with embedded credentials**: `https://token@github.com` patterns 5. **Truncates suspicious long lines**: Lines >200 chars with base64-like patterns ## Changes - Modified `github/index.ts` to call `sanitizeErrorMessage()` on shell error stderr - Added `sanitizeErrorMessage()` function with comprehensive regex-based redaction ## Testing The function handles: - Shell errors containing environment variables - Git command errors with embedded tokens - HTTP errors with Authorization headers - Long base64-encoded strings Fixes #11166
yindo added the pull-request label 2026-02-16 18:18:30 -05:00
yindo closed this issue 2026-02-16 18:18:31 -05:00
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
acp
bad
bug
discussion
docs
documentation
enhancement
extension
good first issue
growth
help-wanted
mcp
model-problem
needs:compliance
nix
opentui
perf
pull-request
Mirrored from GitHub Pull Request
 tui
web
windows
zen
No Label pull-request
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
yindo
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: anomalyco/opencode#13678
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?