tiennm99/ccs
1
0
Fork 0
mirror of https://github.com/tiennm99/ccs.git synced 2026-09-10 02:17:11 +00:00
Code Issues Packages Projects Releases Wiki Activity

fix(ui): skip TOML comments when scanning sensitive array values

Browse Source 
PR-Agent on #1248 flagged that the TOML array walker did not skip
`#` line comments while balancing brackets. A sensitive array with a
comment containing `]` could terminate the scan early and leave the
real tail of the secret unmasked. Skip from `#` to the next newline at
the array's top level. Adds a regression test.
This commit is contained in:
Tam Nhu Tran
2026-05-14 17:57:06 -04:00
parent f404e52439
commit a633ee0af4
2 changed files with 27 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files
ui/src/components/shared/code-editor.tsx
+9 -3
View File
@@ -146,9 +146,10 @@ function findValueEnd(
return closeIdx >= 0 ? valueStart + 3 + closeIdx + 3 : docLen;
}
if (lookahead[0] === '[') {
// Track bracket depth, skipping content inside strings. Use the
// backslash-aware skipper so `\"` inside basic strings does not
// prematurely close the string scan.
// Track bracket depth, skipping content inside strings and comments.
// Use the backslash-aware skipper so `\"` inside basic strings does not
// prematurely close the string scan, and skip `# ... \n` so a `]` that
// appears inside a TOML comment cannot terminate the array early.
const text = doc.toString();
let depth = 0;
let i = valueStart;
@@ -158,6 +159,11 @@ function findValueEnd(
i = skipString(text, i, ch);
continue;
}
if (ch === '#') {
const nl = text.indexOf('\n', i);
i = nl >= 0 ? nl + 1 : docLen;
continue;
}
if (ch === '[') depth++;
else if (ch === ']') {
depth--;