actions/claude-code-action
1
0
Fork 0
mirror of https://github.com/anthropics/claude-code-action.git synced 2026-08-22 03:18:54 +08:00
Code Issues Packages Projects Releases Wiki Activity

fix(security): unify secret redaction in public comment outputs (#1693)

Browse Source 
Ensure all public issue, PR, and inline comments apply redactSecrets() in addition to sanitizeContent() before submitting payloads to the GitHub API. This aligns public comment output with error log and step-summary redaction policies, preventing potential leakage of Anthropic API keys, AWS credentials, Slack tokens, JWTs, and GitHub tokens.
This commit is contained in:
Juwan
2026-08-18 17:23:11 -07:00
committed by GitHub
parent d40ddef4c0
commit 54eadc2f72
5 changed files with 96 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files
test/sanitizer.test.ts
+25
View File
@@ -518,3 +518,28 @@ describe("stripHtmlComments (legacy)", () => {
);
});
});
describe("outbound comment sanitization and redaction", () => {
it("should sanitize content and redact all credential types for public comments", () => {
const rawComment =
"Done! Configured AWS AKIAIOSFODNN7EXAMPLE, Anthropic sk-ant-api03-abcdefghijklmnopqrstuvwxyz1234567890, Slack xoxb-1234567890-abcdefghijkl-mnopqrstuvwx, and GitHub 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 <!-- secret note -->";
const sanitizedAndRedacted = redactSecrets(sanitizeContent(rawComment));
expect(sanitizedAndRedacted).not.toContain("AKIAIOSFODNN7EXAMPLE");
expect(sanitizedAndRedacted).not.toContain(
"sk-ant-api03-abcdefghijklmnopqrstuvwxyz1234567890",
);
expect(sanitizedAndRedacted).not.toContain(
"xoxb-1234567890-abcdefghijkl-mnopqrstuvwx",
);
expect(sanitizedAndRedacted).not.toContain(
"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",
);
expect(sanitizedAndRedacted).not.toContain("secret note");
expect(sanitizedAndRedacted).toContain("[REDACTED_AWS_KEY_ID]");
expect(sanitizedAndRedacted).toContain("[REDACTED_ANTHROPIC_KEY]");
expect(sanitizedAndRedacted).toContain("[REDACTED_SLACK_TOKEN]");
expect(sanitizedAndRedacted).toContain("[REDACTED_GITHUB_TOKEN]");
});
});