fix(egress): strip Authorization before DLP scan; remove auth_header param from scan_outbound

2026-06-06 16:15:30 -04:00
parent 916b70c595
commit a04aed098d
3 changed files with 24 additions and 17 deletions
@@ -30,6 +30,7 @@ from bot_bottle.egress_addon_core import (
    match_route,
    parse_config,
    parse_routes,
+    scan_outbound,
 )


@@ -599,6 +600,22 @@ class TestDecisionDefaults(unittest.TestCase):
        self.assertIsNone(d.inject_authorization)


+# --- scan_outbound -------------------------------------------------------
+
+
+class TestScanOutbound(unittest.TestCase):
+    def test_body_token_patterns_still_block(self):
+        result = scan_outbound(
+            Route(host="chatgpt.com"),
+            "leak sk-" + "A" * 48,
+            {},
+        )
+        self.assertIsNotNone(result)
+        assert result is not None
+        self.assertEqual("body", result.location)
+        self.assertIn("OpenAI API key", result.reason)
+
+
 # --- is_git_push_request ------------------------------------------------