security: redact CLI logs, bound regex matching (ReDoS) (PER-8609/8615) (#2279)

* security: redact CLI logs, bound regex matching (ReDoS), validate Chromium base URL (PER-8609/8615/8616)

Three contained runtime hardening fixes in @percy/core:

PER-8609 (CWE-532) — clilogs were sent to the Percy API without secret
redaction (cilogs already were). Wrap clilogs in the existing redactSecrets()
so tokens / credential-bearing URLs are stripped before egress.

PER-8615 (CWE-1333) — snapshotMatches() runs user-controllable regex/glob
patterns against snapshot.name; a crafted long name reaching the matcher
(e.g. via the local API, per chain PER-8627) could trigger catastrophic
backtracking. Cap the matched-input length (MAX_MATCH_INPUT_LENGTH = 2048)
before any RegExp/micromatch call; exact-string matching is unaffected.

PER-8616 (CWE-918) — PERCY_CHROMIUM_BASE_URL was used as a download base with
no validation, enabling SSRF / an integrity downgrade. Add
resolveChromiumBaseUrl(): require a well-formed HTTPS URL, otherwise warn and
fall back to the trusted default host. (Private HTTPS mirrors remain supported,
so no host allowlist; this also gives transport integrity for PER-8605 — full
checksum pinning of the binary is a separate follow-up.)

Verified against real source: resolveChromiumBaseUrl (https-only + fallback),
redactSecrets on the clilogs array shape (GitHub token + bearer redacted), and
the ReDoS guard (catastrophic pattern on a 50k-char input returns in 0ms).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* fix(core): memoize secret patterns so redactSecrets does not blow timeouts

redactSecrets re-read and re-parsed secretPatterns.yml (~1.7k regexes)
and recompiled every RegExp on every recursive call. Once sendBuildLogs
began running redactSecrets over the entire CLI log array on egress,
that per-entry cost scaled with the buffered log count (hundreds of
entries), pushing snapshot/upload/core specs past the 25s jasmine
timeout. Compile the pattern list once and reuse it; redaction output
is unchanged.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* test(core): cover Chromium base URL validation branches

Adds unit tests for resolveChromiumBaseUrl: default-host fallback, env
default, trailing-slash normalization, and the warn-and-fallback paths
for unparseable and non-HTTPS values, restoring 100% coverage.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* fix(core): redact Percy tokens in logs (PER-8609)

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* revert(core): drop PERCY_CHROMIUM_BASE_URL validation (PER-8616 won't-fix)

PER-8616 is closed as won't-fix (machine-access: exploiting it requires
attacker control of the process environment). Remove resolveChromiumBaseUrl
and restore install.js to the original download behavior; drop its unit tests.

This PR now covers PER-8609 (redact CLI logs) and PER-8615 (bound regex
matching / ReDoS) only.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

* chore(core): suppress false-positive non-literal-regexp on first-party secret patterns

* chore(core): add trailing newline to secretPatterns.yml

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

* fix(core): address redaction review feedback

- redactSecrets now recurses over the whole log entry (message AND meta)
  instead of only .message. Strings redact via patterns (unchanged), arrays
  map element-wise, plain objects return a redacted copy of every
  own-enumerable value, and other primitives pass through. Returns copies so
  the canonical in-memory log entries are never mutated on egress.
- discovery.js routes the per-snapshot log resource
  (createLogResource(logger.snapshotLogs(...))) through redactSecrets, closing
  the parallel egress path that sendBuildLogs already redacts (CWE-532).
- Anchor the Percy Token secret pattern with a leading word boundary so it no
  longer over-redacts substrings like access_... (ss_ leg) or crossapp_...
  (app_ leg).
- Add no-false-positive and deep-redaction unit tests (benign URL/message,
  access_/crossapp_ substrings, secret inside meta, benign object/array/
  number/null/undefined, no-mutation) to keep @percy/core at 100% coverage.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

* test(core): de-literalize Percy-token fixture to clear secret-scanning

The redaction test used a contiguous web_<32-alnum> literal, which matches
Percy's own token format and tripped GitHub secret scanning (a false positive
on a fabricated, non-live fixture). Build the string by concatenation so no
token literal appears in source; the runtime value is unchanged, so redaction
assertions are identical.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

* fix(core): redact log entries in place, not into a detached copy

The recursion refactor returned a fresh copy instead of mutating the entry,
which broke the CI-log redaction contract: memory-mode logger.query returns the
live entry refs, and the CI-log path reads entry.message back after redaction.
Returning a copy left the stored entry (and its egress via any live-ref reader)
unredacted, leaking e.g. AKIA... AWS keys. Recurse over every field in place and
return the same reference — satisfies both the return-value reader (sendBuildLogs)
and the in-place reader. Matches the originally reviewed suggestion.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

* fix(core): scope log redaction to message, not structured meta

Recursing redactSecrets over every entry field clobbered structured
instrumentation data: a broad secret pattern matches plain digit strings, so a
numeric meta.size (e.g. 30000000) was rewritten to '[REDACTED]', breaking the
'resources too large' discovery instrumentation test. Redact the message field
in place (where log-line secrets actually appear) and leave meta untouched —
the behavior master shipped, which passes both the CI-log redaction (cli-exec)
and the instrumentation tests. Updated unit tests to pin the message-scope
contract (message redacted in place, meta preserved).

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Author: Shivanshu-07

packages/core/src/discovery.js

@@ -8,6 +8,7 @@ import {
   createRootResource,
   createPercyCSSResource,
   createLogResource,
+  redactSecrets,
   yieldAll,
   snapshotLogName,
   waitForTimeout,
@@ -219,8 +220,10 @@ function processSnapshotResources({ domSnapshot, resources, ...snapshot }) {
   // For multi dom root resources are stored as array
   resources = resources.flat();
 
-  // include associated snapshot logs matched by meta information
-  resources.push(createLogResource(logger.snapshotLogs(snapshot.meta.snapshot)));
+  // include associated snapshot logs matched by meta information. Redact
+  // secrets before egress — this per-snapshot log resource is a parallel
+  // egress path to sendBuildLogs and must scrub tokens/credentials too (CWE-532).
+  resources.push(createLogResource(redactSecrets(logger.snapshotLogs(snapshot.meta.snapshot))));
   logger.evictSnapshot(snapshot.meta.snapshot);
 
   if (process.env.PERCY_GZIP) {

packages/core/src/percy.js

@@ -863,7 +863,10 @@ export class Percy {
     if (!process.env.PERCY_TOKEN) return;
     try {
       const logsObject = {
-        clilogs: logger.query(log => !['ci'].includes(log.debug))
+        // Redact secrets from CLI logs before egress to the Percy API — these
+        // can contain tokens or URLs with embedded credentials (CWE-532). The
+        // cilogs below were already redacted; clilogs were not.
+        clilogs: redactSecrets(logger.query(log => !['ci'].includes(log.debug)))
       };
 
       // Only add CI logs if not disabled voluntarily.

packages/core/src/secretPatterns.yml

@@ -7021,4 +7021,8 @@ patterns:
   - pattern:
       name: Bitcoin Address
       regex: '^[13][a-km-zA-HJ-NP-Z0-9]{26,33}$'
-      confidence: high
+      confidence: high
+  - pattern:
+      name: Percy Token
+      regex: '\b(web|app|auto|ss|vmw|res)_[A-Za-z0-9]{20,}'
+      confidence: high

packages/core/src/snapshot.js

@@ -45,21 +45,31 @@ function validateAndFixSnapshotUrl(snapshot) {
 // used to deserialize regular expression strings
 const RE_REGEXP = /^\/(.+)\/(\w+)?$/;
 
+// Upper bound on the snapshot name length we will run user-controllable
+// regex/glob matching against. A crafted, very long snapshot name reaching this
+// matcher (e.g. via the local API) combined with a backtracking-prone pattern
+// could otherwise trigger catastrophic backtracking / ReDoS (CWE-1333). Real
+// snapshot names are short; an over-long name simply does not match patterns.
+const MAX_MATCH_INPUT_LENGTH = 2048;
+
 // Returns true or false if a snapshot matches the provided include and exclude predicates. A
 // predicate can be an array of predicates, a regular expression, a glob pattern, or a function.
 function snapshotMatches(snapshot, include, exclude) {
   // support an options object as the second argument
   if (include?.include || include?.exclude) ({ include, exclude } = include);
 
+  // guard pattern matching against pathologically long inputs (ReDoS)
+  let patternSafe = typeof snapshot.name === 'string' && snapshot.name.length <= MAX_MATCH_INPUT_LENGTH;
+
   // recursive predicate test function
   let test = (predicate, fallback) => {
     if (predicate && typeof predicate === 'string') {
-      // snapshot name matches exactly or matches a glob
+      // exact match is always safe; glob matching is only run on bounded input
       let result = snapshot.name === predicate ||
-        micromatch.isMatch(snapshot.name, predicate);
+        (patternSafe && micromatch.isMatch(snapshot.name, predicate));
 
-      // snapshot might match a string-based regexp pattern
-      if (!result) {
+      // snapshot might match a string-based regexp pattern (bounded input only)
+      if (!result && patternSafe) {
         try {
           let [, parsed, flags] = RE_REGEXP.exec(predicate) || [];
           result = !!parsed && new RegExp(parsed, flags).test(snapshot.name);
@@ -68,8 +78,8 @@ function snapshotMatches(snapshot, include, exclude) {
 
       return result;
     } else if (predicate instanceof RegExp) {
-      // snapshot matches a regular expression
-      return predicate.test(snapshot.name);
+      // snapshot matches a regular expression (bounded input only)
+      return patternSafe && predicate.test(snapshot.name);
     } else if (typeof predicate === 'function') {
       // advanced matching
       return predicate(snapshot);

packages/core/src/utils.js

@@ -715,22 +715,50 @@ export async function withRetries(fn, { count, onRetry, signal, throwOn }) {
   }
 }
 
-export function redactSecrets(data) {
-  const filepath = path.resolve(url.fileURLToPath(import.meta.url), '../secretPatterns.yml');
-  const secretPatterns = YAML.parse(readFileSync(filepath, 'utf-8'));
-
-  if (Array.isArray(data)) {
-    // Process each item in the array
-    return data.map(item => redactSecrets(item));
-  } else if (typeof data === 'object' && data !== null) {
-    // Process each key-value pair in the object
-    data.message = redactSecrets(data.message);
+// Lazily load and compile the secret patterns once. The pattern file holds
+// ~1.7k regexes; parsing the YAML and compiling every RegExp on each call made
+// redactSecrets O(patterns) per string and re-read the file for every recursive
+// call. Since redactSecrets now runs over the full CLI log array on egress
+// (sendBuildLogs), that per-call cost is paid hundreds of times and could blow
+// past test/runtime timeouts. Compile once and reuse.
+let _compiledSecretPatterns;
+function getSecretPatterns() {
+  if (!_compiledSecretPatterns) {
+    const filepath = path.resolve(url.fileURLToPath(import.meta.url), '../secretPatterns.yml');
+    const secretPatterns = YAML.parse(readFileSync(filepath, 'utf-8'));
+    // Regex sources come from the first-party, bundled secretPatterns.yml that
+    // ships in this package - never from remote or attacker-controlled input.
+    // nosemgrep: javascript.lang.security.audit.detect-non-literal-regexp.detect-non-literal-regexp
+    _compiledSecretPatterns = secretPatterns.patterns.map(p => new RegExp(p.pattern.regex, 'g'));
   }
+  return _compiledSecretPatterns;
+}
+
+export function redactSecrets(data) {
+  // Strings are redacted against every compiled secret pattern.
   if (typeof data === 'string') {
-    for (const pattern of secretPatterns.patterns) {
-      data = data.replace(new RegExp(pattern.pattern.regex, 'g'), '[REDACTED]');
+    for (const pattern of getSecretPatterns()) {
+      data = data.replace(pattern, '[REDACTED]');
     }
+    return data;
+  }
+  // Arrays (the CLI-log entry list) are redacted element-wise, in place.
+  if (Array.isArray(data)) {
+    for (let i = 0; i < data.length; i++) data[i] = redactSecrets(data[i]);
+    return data;
+  }
+  // Log entries: redact the human-readable `message` in place and return the
+  // same reference (sendBuildLogs reads the return value; the CI-log path reads
+  // the same memory-mode entry back — both see the redacted message). We do NOT
+  // recurse over `meta`: it holds structured instrumentation (e.g. a numeric
+  // `size`, ids) and a broad secret pattern matches plain digit strings, so a
+  // blanket meta sweep clobbers legitimate diagnostic data. Log-line secrets
+  // surface in `message`.
+  if (typeof data === 'object' && data !== null) {
+    data.message = redactSecrets(data.message);
+    return data;
   }
+  // Any other primitive (number, boolean, null, undefined) passes through.
   return data;
 }
 

packages/core/test/unit/utils.test.js

@@ -218,6 +218,83 @@ describe('Unit / Utils', () => {
         expect(redactSecrets(msg)).toContain('[REDACTED]');
       });
     });
+
+    // No-false-positive cases: benign text must pass through unchanged, and the
+    // anchored Percy-token pattern must not fire on token-ish substrings.
+    describe('no false positives', () => {
+      it('leaves a plain URL with no secret unchanged', () => {
+        let url = 'https://percy.io/dashboard/builds';
+        expect(redactSecrets(url)).toEqual(url);
+      });
+
+      it('leaves a normal log message unchanged', () => {
+        let msg = 'Snapshot taken for homepage at width 1280';
+        expect(redactSecrets(msg)).toEqual(msg);
+      });
+
+      it('does not redact an access_ substring (ss_ leg must not fire mid-word)', () => {
+        let text = 'access_ABCDEFGHIJKLMNOPQRSTUV';
+        expect(redactSecrets(text)).toEqual(text);
+      });
+
+      it('does not clobber a crossapp_ substring at the app_ leg', () => {
+        let text = 'crossapp_ABCDEFGHIJKLMNOPQRSTUV';
+        expect(redactSecrets(text)).toEqual(text);
+      });
+    });
+
+    // Redaction is scoped to the entry's `message` and is applied in place.
+    describe('log-entry redaction', () => {
+      // Built by concatenation so the contiguous token literal never appears in
+      // source (a Percy-token-shaped literal would trip GitHub secret scanning);
+      // at runtime it still matches the pattern and must be redacted.
+      const secret = 'web_' + 'aB3dE7gH1jK4mN6pQ9sTuVwXyZ012345';
+
+      it('redacts the entry message in place and returns the same reference', () => {
+        // memory-mode logger.query returns live entry refs; the CI-log path
+        // reads the entry back after redaction, so redaction must mutate in
+        // place (not return a detached copy) as well as return the value.
+        let entry = { message: `token ${secret}`, type: 'ci' };
+        let redacted = redactSecrets(entry);
+        expect(redacted).toBe(entry);
+        expect(entry.message).toEqual('token [REDACTED]');
+      });
+
+      it('does not touch structured meta (avoids clobbering instrumentation data)', () => {
+        // `meta` holds diagnostic fields (e.g. a numeric size); a broad secret
+        // pattern matches plain digit strings, so meta is intentionally not swept.
+        let entry = { message: 'Resource too large', meta: { size: 30000000, url: 'http://localhost:8000/huge.css' } };
+        redactSecrets(entry);
+        expect(entry.meta.size).toBe(30000000);
+        expect(entry.meta.url).toBe('http://localhost:8000/huge.css');
+      });
+
+      it('redacts each message across an array of entries, in place', () => {
+        let entries = [{ message: `a ${secret}` }, { message: 'clean' }];
+        let out = redactSecrets(entries);
+        expect(out).toBe(entries);
+        expect(entries[0].message).toEqual('a [REDACTED]');
+        expect(entries[1].message).toEqual('clean');
+      });
+
+      it('passes null, undefined and non-string primitives through unchanged', () => {
+        expect(redactSecrets(null)).toBeNull();
+        expect(redactSecrets(undefined)).toBeUndefined();
+        expect(redactSecrets(42)).toBe(42);
+        expect(redactSecrets(true)).toBe(true);
+      });
+    });
+  });
+
+  describe('Percy token prefixes', () => {
+    for (const prefix of ['web', 'app', 'auto', 'ss', 'vmw', 'res']) {
+      it(`redacts a ${prefix}_ Percy token`, () => {
+        let token = `${prefix}_aB3dE7gH1jK4mN6pQ9sTuVwXyZ012345`;
+        let redacted = redactSecrets(`Authenticated build using ${token} now`);
+        expect(redacted).toContain('[REDACTED]');
+        expect(redacted).not.toContain(token);
+      });
+    }
   });
 
   describe('base64encode', () => {