Skip to content

Fix redaction regex reuse: avoid mutating patterns and keep allowlist working across calls #19

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
SynthLuvr merged 3 commits into from
Feb 23, 2026
Merged

Fix redaction regex reuse: avoid mutating patterns and keep allowlist working across calls #19

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
bbd0610
reproduced bug
SynthLuvr Feb 23, 2026
8518ce2
do not use stateful regex
SynthLuvr Feb 23, 2026
25b41dc
Added test to address PR comment
SynthLuvr Feb 23, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
23 changes: 5 additions & 18 deletions src/redact.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -44,11 +44,6 @@ type RedactConfig = {

const replacement = "[REDACTED]";

const cloneRegex = (re: RegExp): RegExp => {
const flags = re.flags.includes("g") ? re.flags : `${re.flags}g`;
return new RegExp(re.source, flags);
};

const sliceAround = (
value: string,
offset: number,
Expand Down Expand Up @@ -100,9 +95,8 @@ const replaceAllMatchesWithContext = (
pattern: RegExp,
replacement: string,
allow?: ContextRule[],
) => {
const re = cloneRegex(pattern);
return value.replace(re, (...args: unknown[]) => {
) =>
value.replace(pattern, (...args: unknown[]) => {
const match = args[0];
if (typeof match !== "string") return replacement;

Expand All @@ -112,7 +106,6 @@ const replaceAllMatchesWithContext = (
if (shouldAllowByRules(meta.whole, match, meta.offset, allow)) return match;
return replacement;
});
};

/**
* BIP39 contextual replacer:
Expand All @@ -124,9 +117,8 @@ const replaceBip39MnemonicMatchesWithContext = (
pattern: RegExp,
replacement: string,
allow?: ContextRule[],
) => {
const re = cloneRegex(pattern);
return value.replace(re, (...args: unknown[]) => {
) =>
value.replace(pattern, (...args: unknown[]) => {
const match = args[0];
const phrase = args[1];

Expand All @@ -143,7 +135,6 @@ const replaceBip39MnemonicMatchesWithContext = (

return match.replace(phrase, replacement);
});
};

const createRedactor = (config: RedactConfig = {}) => {
const HEX_MIN_LEN = 16;
Expand All @@ -152,33 +143,29 @@ const createRedactor = (config: RedactConfig = {}) => {

const HEX = new RegExp(
String.raw`(?<![a-fA-F0-9])(?:0x)?[a-fA-F0-9]{${HEX_MIN_LEN},}(?![a-fA-F0-9])`,
"g",
);
const hexAllow: ContextRule[] = config.hex?.allow ?? [];

const BASE64 = new RegExp(
String.raw`(?<![A-Za-z0-9+/=])(?:[A-Za-z0-9+/]{4}){${BASE64_MIN_BLOCKS},}(?:[A-Za-z0-9+/]{2,3})?(?:={0,2})(?![A-Za-z0-9+/=])`,
"g",
);
const base64Allow = config.base64?.allow ?? [];

const BASE64URL = new RegExp(
String.raw`(?<![A-Za-z0-9\-_])[A-Za-z0-9\-_]{16,}(?:={0,2})?(?![A-Za-z0-9\-_])`,
"g",
);
const base64urlAllow = config.base64url?.allow ?? [];

const BASE58 = new RegExp(
String.raw`(?<![1-9A-HJ-NP-Za-km-z])[1-9A-HJ-NP-Za-km-z]{${BASE58_MIN_LEN},}(?![1-9A-HJ-NP-Za-km-z])`,
"g",
);
const base58Allow = config.base58?.allow ?? [];

const WORD = "[a-zA-Z]{2,8}";
const PHRASE_12_TO_24 = `(?:${WORD}\\s+){11,23}${WORD}`;
const MNEMONIC = new RegExp(
String.raw`(?<![A-Za-z])(${PHRASE_12_TO_24})(?![A-Za-z])`,
"gi",
"i",
);
const mnemonicAllow = config.mnemonic?.allow ?? [];

Comment thread
SynthLuvr marked this conversation as resolved.
Expand Down
22 changes: 22 additions & 0 deletions tests/redact.test.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -19,4 +19,26 @@ describe("redact", () => {
"Should redact private key ([REDACTED]) and API key ([REDACTED])",
);
});

it("allows whitelist each time", () => {
const redact = createRedact({ hex: { allow: [{ re: /\b(event)\b/i }] } });
for (let i = 0; i < 10; i++) {
const result = redact(
"Pushed event fcc6533b59301096a973b8be3e6518f0cd13f73a9821de558cca77ac9b014d6e.1771865100000",
);
expect(result).toBe(
"Pushed event fcc6533b59301096a973b8be3e6518f0cd13f73a9821de558cca77ac9b014d6e.1771865100000",
);
}
});

it("redacts multiple hex in same string", () => {
const redact = createRedact({});
const result = redact(
"Pushed event fcc6533b59301096a973b8be3e6518f0cd13f73a9821de558cca77ac9b014d6e.1561338e25f9b57a9babc7ad57a0e0ee0b13a7094a895319883c7daf4a869642 with key d13821711360de832b80be20507912cebe123ebe52240ae91e6a699b72beb26a",
);
expect(result).toBe(
"Pushed event [REDACTED].[REDACTED] with key [REDACTED]",
);
});
});