actions/claude-code-action
1
0
Fork 0
mirror of https://github.com/anthropics/claude-code-action.git synced 2026-08-03 01:38:30 +08:00
Code Issues Packages Projects Releases Wiki Activity

fix(sanitizer): redact GitHub user-to-server (ghu_) tokens (#1502)

Browse Source 
redactGitHubTokens covers ghp_, gho_, ghs_, ghr_, and github_pat_
tokens but misses ghu_ (GitHub App user-to-server tokens), one of the
documented GitHub token prefixes. A ghu_ token appearing in issue or
PR content passed through sanitization unredacted.

Add the ghu_ pattern, mirroring the existing 40-character token
patterns, with unit tests including the git-credential URL form.
This commit is contained in:
NickNojiri 2026-07-14 13:06:18 -07:00 committed by GitHub
parent f1bd27ca5b
commit 4f07c81564
No known key found for this signature in database
GPG Key ID: B5690EEEBB952194
2 changed files with 16 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
src/github/utils/sanitizer.ts
View File

@ -83,6 +83,12 @@ export function redactGitHubTokens(content: string): string {
"[REDACTED_GITHUB_TOKEN]",
);
// GitHub user-to-server tokens: ghu_XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX (40 chars)
content = content.replace(
/\bghu_[A-Za-z0-9]{36}\b/g,
"[REDACTED_GITHUB_TOKEN]",
);
// GitHub installation tokens: ghs_XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX (40 chars)
content = content.replace(
/\bghs_[A-Za-z0-9]{36}\b/g,

10
test/sanitizer.test.ts
View File

@ -276,6 +276,16 @@ describe("redactGitHubTokens", () => {
);
});
it("should redact user-to-server tokens (ghu_)", () => {
const token = "ghu_16C7e42F292c6912E7710c838347Ae178B4a";
expect(redactGitHubTokens(`User token: ${token}`)).toBe(
"User token: [REDACTED_GITHUB_TOKEN]",
);
expect(
redactGitHubTokens(`In a URL: x-access-token:${token}@github.com`),
).toBe("In a URL: x-access-token:[REDACTED_GITHUB_TOKEN]@github.com");
});
it("should redact installation tokens (ghs_)", () => {
const token = "ghs_xz7yzju2SZjGPa0dUNMAx0SH4xDOCS31LXQW";
expect(redactGitHubTokens(`Install token: ${token}`)).toBe(