diff --git a/src/main/rate-limits/minimax-request-context.test.ts b/src/main/rate-limits/minimax-request-context.test.ts index c0c7d709dab..9b01b4ff013 100644 --- a/src/main/rate-limits/minimax-request-context.test.ts +++ b/src/main/rate-limits/minimax-request-context.test.ts @@ -108,6 +108,12 @@ describe('redactMiniMaxSecret', () => { expect(redacted).not.toContain('x.y') }) + it('redacts quoted values with whitespace around the colon', () => { + const redacted = redactMiniMaxSecret('_token : "spaced.secret"') + expect(redacted).not.toContain('spaced.secret') + expect(redacted).toContain('_token:[REDACTED]') + }) + it('redacts minimax_group_id_v2', () => { expect(redactMiniMaxSecret('minimax_group_id_v2=99999 trailing')).not.toContain('99999') }) diff --git a/src/main/rate-limits/minimax-request-context.ts b/src/main/rate-limits/minimax-request-context.ts index 920de017506..6c8ff678a50 100644 --- a/src/main/rate-limits/minimax-request-context.ts +++ b/src/main/rate-limits/minimax-request-context.ts @@ -83,7 +83,8 @@ export function redactMiniMaxSecret(value: string): string { for (const name of SENSITIVE_COOKIE_NAMES) { redacted = redacted .replace(new RegExp(`${name}=([^;\\s]+)`, 'g'), `${name}=[REDACTED]`) - .replace(new RegExp(`${name}:["'][^"']+["']`, 'g'), `${name}:[REDACTED]`) + // Match parseCookiePairs' `\s*:\s*` tolerance so `name : "secret"` is redacted too. + .replace(new RegExp(`${name}\\s*:\\s*["'][^"']+["']`, 'g'), `${name}:[REDACTED]`) } return redacted }