CalvinBackup/gstack
1
0
Fork 0
mirror of https://github.com/garrytan/gstack.git synced 2026-09-27 07:01:54 +02:00
Code Issues Packages Projects Releases Wiki Activity

fix(redact-prepush): fill the slice overlap to its budget, not only when empty

Browse Source 
The overlap carried a long line's suffix only when the tail was otherwise
empty. One short line between the long label line and the secret landed in
the tail first, the tail was no longer empty, and the label was dropped
again, so aws.secret_key never fired. The overlap is now filled from the
seam backwards to its exact budget, taking a partial line wherever a whole
one no longer fits; a character is added only if it still fits, so the
slice budget invariant keeps holding.

Gate rows 21 (one short line) and 22 (several) pin it; both fail on the
scanner this branch forks from.

The absent-tip comment claimed the range scans everything reachable. It
scans the net diff of emptyTree..localSha, i.e. the final tree, not each
commit, and now says so, including that a credential added and later
removed inside one push is not in any diff this hook computes.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
This commit is contained in:
Lubos Buracinsky
2026-09-22 18:38:55 +02:00
co-authored by Claude Opus 5
parent 2144829381
commit c3c013da72
2 changed files with 84 additions and 34 deletions
Download Patch File Download Diff File Expand all files Collapse all files
test/redact-prepush-fail-open.sh
+34
View File
@@ -397,6 +397,40 @@ git add -A >/dev/null; git commit -qm bigline >/dev/null
S19=$(run_probe "$R/s19")
row "19 label at the end of an over-overlap line" "$S19" "BLOCK(aws.secret_key)"
# 21: same seam, but a SHORT line sits between the long line and the secret.
# Carrying a long line's suffix only when the tail is otherwise empty is not
# enough: the short line lands in the tail first, the tail is no longer empty,
# and the long line's end — where the label is — is dropped again.
mkrepo s21
SEC="$SEC" python3 -c "
import os
sec=os.environ['SEC']
filler='x'*770020
with open('big.txt','w') as f:
f.write(filler+' aws_secret_access_key =\n')
f.write('\n')
f.write(sec+' '+'y'*20000+'\n')"
git add -A >/dev/null; git commit -qm bigline-gap >/dev/null
S21=$(run_probe "$R/s21")
row "21 short line between the long label line and the secret" "$S21" "BLOCK(aws.secret_key)"
# 22: the general form of 19/21. Several short lines between the long label
# line and the secret, still well inside the pattern's proximity window. The
# property being pinned is that the LAST overlap-worth of text before a seam is
# always carried, whatever mix of long and short lines it is made of.
mkrepo s22
SEC="$SEC" python3 -c "
import os
sec=os.environ['SEC']
filler='x'*770000
with open('big.txt','w') as f:
f.write(filler+' aws_secret_access_key =\n')
for _ in range(20): f.write('\n')
f.write(sec+' '+'y'*20000+'\n')"
git add -A >/dev/null; git commit -qm bigline-gaps >/dev/null
S22=$(run_probe "$R/s22")
row "22 several short lines between long label line and secret" "$S22" "BLOCK(aws.secret_key)"
# E6: long-line slicer survives multi-byte text
mkrepo e6; KEY="$KEY" python3 -c "
import os