Redact WriteSecuredBulk / WriteSecured2Bulk payloads in GatewayLogRedactor (R21-O16 / SEC-13) #193

New Issue

2026-11-06T15:25:04-05:00

dohertj2 commented

2026-11-06 15:25:04 -05:00

GatewayLogRedactor.SensitiveCommandMethods lists WriteSecured/WriteSecured2 but not WriteSecuredBulk/WriteSecured2Bulk. Latent in cycle 1, but GatewayLogRedactorSeam now calls RedactCommandValue, so a secured-bulk payload would be logged unredacted if value logging is enabled.

Source: archreview/2026-10-21/remediation/00-tracking.md row R21-O16 (cycle-1 SEC-13)

Next step (from the tracker): Add both bulk kinds plus a redactor test; cross-check every command kind that carries a password. Confirmed 2026-11-06 in Server/Diagnostics/GatewayLogRedactor.cs:14-15.

Current-state evidence: the row is still Open/Deferred in the latest (2026-10-21) tracker, and a code check on local main @ 8c0a51d (2026-11-06) found it still present unless noted below.

`GatewayLogRedactor.SensitiveCommandMethods` lists `WriteSecured`/`WriteSecured2` but not `WriteSecuredBulk`/`WriteSecured2Bulk`. Latent in cycle 1, but `GatewayLogRedactorSeam` now calls `RedactCommandValue`, so a secured-bulk payload would be logged unredacted if value logging is enabled. Source: `archreview/2026-10-21/remediation/00-tracking.md` row R21-O16 (cycle-1 SEC-13) Next step (from the tracker): Add both bulk kinds plus a redactor test; cross-check every command kind that carries a password. Confirmed 2026-11-06 in `Server/Diagnostics/GatewayLogRedactor.cs:14-15`. Current-state evidence: the row is still `Open`/`Deferred` in the latest (2026-10-21) tracker, and a code check on local `main` @ `8c0a51d` (2026-11-06) found it still present unless noted below.

dohertj2 added the area:gateway area:auth priority:p1 type:review-finding migrated labels 2026-11-06 15:25:04 -05:00

dohertj2 referenced this issue from a commit

2026-11-06 15:45:54 -05:00

fix(diagnostics): redact WriteSecuredBulk/WriteSecured2Bulk payloads (#193)

dohertj2 commented

2026-11-06 15:59:03 -05:00

Fixed on main in 9354d69.

GatewayLogRedactor.SensitiveCommandMethods now includes WriteSecuredBulk and WriteSecured2Bulk, so their payloads are redacted even when value logging is enabled.
Cross-check of every password-carrying command kind: new test IsCredentialBearingCommand_CoversEveryCredentialBearingPayloadInTheContract walks every MxCommand payload descriptor. It fails if any *Secured* payload, or any payload with a password field at any depth, maps to a kind that isn't redacted. The test has a positive control (it must find AuthenticateUser, WriteSecuredBulk and AcknowledgeAlarmByName). Today the set is: AuthenticateUser, WriteSecured, WriteSecured2, WriteSecuredBulk, WriteSecured2Bulk, AcknowledgeAlarm and AcknowledgeAlarmByName. No other kind carries a credential.
More tests: RedactCommandValue_RedactsSecuredBulkWriteEvenWhenValueLoggingIsEnabled (both kinds, using the MxCommandKind.ToString() spelling that WorkerClient logs) and two new rows in IsCredentialBearingCommand_IdentifiesSensitiveMxAccessCommands.
The tests fail without the fix: with the Server change stashed, 5 failed / 30 passed in GatewayLogRedactorTests. With the fix, GatewayLogRedactor* gives 42/42.
docs/Diagnostics.md is updated.

Full gateway suite: macOS 1347 passed / 2 skipped (Windows-only); windev 1349/1349 at 777fef9.

Fixed on `main` in 9354d69. - `GatewayLogRedactor.SensitiveCommandMethods` now includes `WriteSecuredBulk` and `WriteSecured2Bulk`, so their payloads are redacted even when value logging is enabled. - Cross-check of every password-carrying command kind: new test `IsCredentialBearingCommand_CoversEveryCredentialBearingPayloadInTheContract` walks every `MxCommand` payload descriptor. It fails if any `*Secured*` payload, or any payload with a `password` field at any depth, maps to a kind that isn't redacted. The test has a positive control (it must find AuthenticateUser, WriteSecuredBulk and AcknowledgeAlarmByName). Today the set is: AuthenticateUser, WriteSecured, WriteSecured2, WriteSecuredBulk, WriteSecured2Bulk, AcknowledgeAlarm and AcknowledgeAlarmByName. No other kind carries a credential. - More tests: `RedactCommandValue_RedactsSecuredBulkWriteEvenWhenValueLoggingIsEnabled` (both kinds, using the `MxCommandKind.ToString()` spelling that `WorkerClient` logs) and two new rows in `IsCredentialBearingCommand_IdentifiesSensitiveMxAccessCommands`. - The tests fail without the fix: with the Server change stashed, 5 failed / 30 passed in `GatewayLogRedactorTests`. With the fix, `GatewayLogRedactor*` gives 42/42. - `docs/Diagnostics.md` is updated. Full gateway suite: macOS 1347 passed / 2 skipped (Windows-only); windev 1349/1349 at 777fef9.

dohertj2 closed this issue

2026-11-06 15:59:03 -05:00

dohertj2 referenced this issue

2026-11-06 15:59:04 -05:00

Merge fix/review-2026-10-21 to origin main and run the windev Worker gate #169

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: dohertj2/mxaccessgw#193