LOG_FULL egress logging captures injected Authorization and unredacted bodies #257

New Issue

2026-06-24T00:55:48-04:00

didericis-claude commented

2026-06-24 00:55:48 -04:00

Severity: Medium

_log_request (bot_bottle/egress_addon.py:123) serializes dict(flow.request.headers). In request() the sidecar injects the upstream authorization header at line 219 before the LOG_FULL logging at line 221-222, so the sidecar-owned upstream token is written to stderr.

Additionally, request/response bodies in _log_request / _log_response are logged via get_text(...) without passing through redact_tokens — only host and path are redacted (contrast _req_ctx, which does redact). So known secret values in bodies are logged verbatim under LOG_FULL.

Chained with the validate/runtime parser mismatch issue, an agent can both enable LOG_FULL (via a proposed log: 2) and cause secret capture into the egress log.

Fix: in the full-log path, redact headers and body through redact_tokens, and never emit the injected Authorization header.

Filed from a security audit of the TLS-interception egress path and git-gate credential handling (follow-up to the prd-0054-install-script quality-eval review). The core controls — default-deny, per-bottle CA, sidecar credential isolation — were confirmed sound; these are residual hardening gaps.

**Severity:** Medium `_log_request` (`bot_bottle/egress_addon.py:123`) serializes `dict(flow.request.headers)`. In `request()` the sidecar injects the upstream `authorization` header at line 219 *before* the `LOG_FULL` logging at line 221-222, so the sidecar-owned upstream token is written to stderr. Additionally, request/response **bodies** in `_log_request` / `_log_response` are logged via `get_text(...)` without passing through `redact_tokens` — only `host` and `path` are redacted (contrast `_req_ctx`, which does redact). So known secret values in bodies are logged verbatim under LOG_FULL. Chained with the validate/runtime parser mismatch issue, an agent can both enable LOG_FULL (via a proposed `log: 2`) and cause secret capture into the egress log. **Fix:** in the full-log path, redact headers and body through `redact_tokens`, and never emit the injected `Authorization` header. --- _Filed from a security audit of the TLS-interception egress path and git-gate credential handling (follow-up to the `prd-0054-install-script` quality-eval review). The core controls — default-deny, per-bottle CA, sidecar credential isolation — were confirmed sound; these are residual hardening gaps._

didericis-claude added the Kind/Security

Priority

Medium

3

labels 2026-06-24 00:55:48 -04:00

didericis referenced this issue from a commit

2026-06-24 22:40:03 -04:00

fix(egress): strip injected Authorization and redact bodies in LOG_FULL path

didericis-claude referenced a pull request that will close this issue

2026-06-24 22:40:33 -04:00

PRD: LOG_FULL egress logging credential redaction #264

didericis referenced this issue from a commit