fix(oci): reject ambiguous diagnostics

Author: BillLeoutsakosvl346

apps/sim/lib/internal/oci/client.server.test.ts

@@ -232,7 +232,7 @@ describe('OCI request client', () => {
       maxResponseBytes: 65_536,
     }).catch((error: unknown) => error)
     expect(failure).toBeInstanceOf(OciRequestError)
-    expect((failure as Error).message).toContain('[REDACTED]')
+    expect((failure as Error).message).toBe('OCI request failed with status 401')
     expect((failure as Error).message).not.toContain('provider-echo')
     expect((failure as Error).message).not.toContain('(request-target)')
     expect((failure as Error).message).not.toContain('tenant/user/fingerprint')
@@ -298,6 +298,8 @@ describe('OCI request client', () => {
   it.each([
     encodeURIComponent('-----BEGIN PRIVATE KEY-----\ntruncated'),
     encodeURIComponent(`${destination.origin}/n/truncated`),
+    '----%2DBEGIN PRIVATE KEY-----',
+    'https:%2F%2Fobjectstorage.us-ashburn-1.oraclecloud.com/n/',
   ])('fails closed for encoded key or URL prefixes', async (message) => {
     secureFetchMock.mockResolvedValueOnce(
       secureResponse({
@@ -324,6 +326,8 @@ describe('OCI request client', () => {
       'secret-value',
       'password-value',
       '(request-target) host x-date',
+      'private-key-value',
+      'api-key-value',
     ]
     secureFetchMock.mockResolvedValueOnce(
       secureResponse({
@@ -337,6 +341,8 @@ describe('OCI request client', () => {
             secret: echoedSecrets[2],
             'pass%70hrase': echoedSecrets[3],
             signing_string: echoedSecrets[4],
+            'private key': echoedSecrets[5],
+            'api key': echoedSecrets[6],
           }),
         }),
       })
@@ -352,6 +358,50 @@ describe('OCI request client', () => {
     for (const secret of echoedSecrets) expect((failure as Error).message).not.toContain(secret)
   })
 
+  it('fails closed when structured JSON follows a plain-text prefix', async () => {
+    const message = `provider failed: ${JSON.stringify({ authorization: 'provider-echo' })}`
+    secureFetchMock.mockResolvedValueOnce(
+      secureResponse({
+        ok: false,
+        status: 401,
+        body: JSON.stringify({ code: 'NotAuthenticated', message }),
+      })
+    )
+    const failure = await sendOciRequest({
+      destination,
+      credentials,
+      method: 'GET',
+      encodedPath: '/n/',
+      timeout: 10_000,
+      maxResponseBytes: 65_536,
+    }).catch((error: unknown) => error)
+    expect((failure as Error).message).toBe('OCI request failed with status 401')
+  })
+
+  it.each([
+    `provider failed: ${JSON.stringify(JSON.stringify({ authorization: 'provider-echo' }))}`,
+    'provider failed: \\"authorization\\":\\"provider-echo\\"',
+    'signed headers: (request-target) host x-date',
+    'signed headers: host x-content-sha256',
+  ])('fails closed for escaped structured or signing diagnostics', async (message) => {
+    secureFetchMock.mockResolvedValueOnce(
+      secureResponse({
+        ok: false,
+        status: 401,
+        body: JSON.stringify({ code: 'NotAuthenticated', message }),
+      })
+    )
+    const failure = await sendOciRequest({
+      destination,
+      credentials,
+      method: 'GET',
+      encodedPath: '/n/',
+      timeout: 10_000,
+      maxResponseBytes: 65_536,
+    }).catch((error: unknown) => error)
+    expect((failure as Error).message).toBe('OCI request failed with status 401')
+  })
+
   it.each([
     '{"authorization":"Signature version=\\"1\\",signature=\\"echoed\\"',
     JSON.stringify({ level1: { level2: { level3: { authorization: 'echoed' } } } }),

apps/sim/lib/internal/oci/client.server.ts

@@ -69,6 +69,7 @@ function sensitiveRequestValues(
     credentials.tenancyId,
     credentials.userId,
     credentials.fingerprint,
+    credentials.fingerprint.toUpperCase(),
     credentials.privateKey,
     credentials.passphrase ?? '',
     authorization ?? '',

apps/sim/lib/internal/oci/errors.ts

@@ -8,7 +8,6 @@ const MAX_OCI_ERROR_FIELD_LENGTH = 1024
 const MAX_OCI_ERROR_INPUT_LENGTH = 65_536
 const MAX_NESTED_JSON_DEPTH = 3
 const OCI_SENSITIVE_JSON_FIELDS = new Set(['signingstring'])
-const ENCODED_DIAGNOSTIC_SENTINELS = ['-----BEGIN', 'https://']
 
 function normalizeJsonDiagnosticKey(key: string): string | undefined {
   let normalized = key
@@ -31,26 +30,24 @@ function looksLikeStructuredJson(value: string): boolean {
 
 function isSensitiveOciJsonKey(key: string): boolean {
   const compactKey = key.replace(/[^a-z]/gi, '').toLowerCase()
-  return OCI_SENSITIVE_JSON_FIELDS.has(compactKey) || isSensitiveKey(key)
+  return OCI_SENSITIVE_JSON_FIELDS.has(compactKey) || isSensitiveKey(compactKey)
 }
 
-function containsEncodedDiagnosticSentinel(value: string): boolean {
-  const lowerValue = value.toLowerCase()
-  return ENCODED_DIAGNOSTIC_SENTINELS.some((sentinel) => {
-    let encoded = sentinel
-    for (let depth = 0; depth < MAX_NESTED_JSON_DEPTH; depth += 1) {
-      encoded = encodeURIComponent(encoded)
-      if (encoded !== sentinel && lowerValue.includes(encoded.toLowerCase())) return true
-    }
-    return false
-  })
+function containsEmbeddedStructuredText(value: string): boolean {
+  return (
+    !looksLikeStructuredJson(value) &&
+    (/[[{]\s*\\*(?:["{[\]}]|-?\d|true\b|false\b|null\b)/.test(value) ||
+      /\\*"[^"\\\r\n]{1,128}\\*"\s*:\s*/.test(value))
+  )
 }
 
 function flattenJsonDiagnostic(value: unknown, depth = 0): string | undefined {
   if (depth > MAX_NESTED_JSON_DEPTH) return undefined
   if (value === null) return 'null'
   if (typeof value === 'string') {
-    if (!looksLikeStructuredJson(value)) return value
+    if (!looksLikeStructuredJson(value)) {
+      return containsEmbeddedStructuredText(value) ? undefined : value
+    }
     if (depth === MAX_NESTED_JSON_DEPTH) return undefined
     try {
       return flattenJsonDiagnostic(JSON.parse(value), depth + 1)
@@ -80,6 +77,7 @@ function flattenJsonDiagnostic(value: unknown, depth = 0): string | undefined {
 
 function decodeNestedJsonDiagnostic(value: string): string | undefined {
   if (value.length > MAX_OCI_ERROR_INPUT_LENGTH) return undefined
+  if (containsEmbeddedStructuredText(value)) return undefined
   if (!looksLikeStructuredJson(value)) return value
   try {
     return flattenJsonDiagnostic(JSON.parse(value))
@@ -94,7 +92,8 @@ function sanitizeOciErrorField(
 ): string | undefined {
   if (typeof value !== 'string') return undefined
   if (value.length > MAX_OCI_ERROR_INPUT_LENGTH) return undefined
-  if (containsEncodedDiagnosticSentinel(value)) return undefined
+  if (/%[0-9a-f]{2}/i.test(value)) return undefined
+  if (/\(request-target\)|x-content-sha256/i.test(value)) return undefined
   const decoded = decodeNestedJsonDiagnostic(value)
   if (decoded === undefined) return undefined
   const exactValues = sensitiveValues.flatMap((sensitiveValue) => {