From 340cb073be49abaa66a354e21e706fa77b758283 Mon Sep 17 00:00:00 2001
From: sunlei <yemu2333@outlook.com>
Date: Sat, 13 Jun 2026 18:28:20 +0800
Subject: [PATCH] =?UTF-8?q?fix:=20=E6=89=A9=E5=B1=95=E8=BF=90=E8=A1=8C?=
 =?UTF-8?q?=E6=97=B6=E8=AF=81=E6=8D=AE=E6=96=87=E6=9C=AC=E8=84=B1=E6=95=8F?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 .../evidence/runtime-evidence.service.ts      |  9 +++--
 test/runtime/runtime-evidence.service.spec.ts | 33 +++++++++++++++++++
 2 files changed, 39 insertions(+), 3 deletions(-)

diff --git a/src/runtime/evidence/runtime-evidence.service.ts b/src/runtime/evidence/runtime-evidence.service.ts
index 29a5667..010ea4d 100644
--- a/src/runtime/evidence/runtime-evidence.service.ts
+++ b/src/runtime/evidence/runtime-evidence.service.ts
@@ -9,7 +9,7 @@ const REDACTED_BASE64_VALUE = '<redacted-base64>';
 const SENSITIVE_KEY_PATTERN =
   /password|secret|token|authorization|cookie|privatekey|sshkey|ticket|randstr|replytext|base64/i;
 const SENSITIVE_TEXT_KEY_PATTERN =
-  'password|secret|token|authorization|cookie|private[_-]?key|ssh[_-]?key|ticket|randstr|replyText|sid';
+  '(?:[A-Za-z0-9_-]*(?:password|secret|token|authorization|cookie|private[_-]?key|ssh[_-]?key|ticket|randstr|replyText|base64)[A-Za-z0-9_-]*|sid)';
 const SENSITIVE_TEXT_REPLACEMENTS: Array<[RegExp, string]> = [
   [
     /data:[a-z0-9.+-]+\/[a-z0-9.+-]+;base64,[a-z0-9+/=\r\n]+/gi,
@@ -26,8 +26,11 @@ const SENSITIVE_TEXT_REPLACEMENTS: Array<[RegExp, string]> = [
     '$1$2$1:$3<redacted>$3',
   ],
   [
-    new RegExp(`\\b(${SENSITIVE_TEXT_KEY_PATTERN})\\s*=\\s*[^\\s,;&]+`, 'gi'),
-    '$1=<redacted>',
+    new RegExp(
+      `\\b(${SENSITIVE_TEXT_KEY_PATTERN})(\\s*[:=]\\s*)[^\\s,;&]+`,
+      'gi',
+    ),
+    '$1$2<redacted>',
   ],
 ];
 
diff --git a/test/runtime/runtime-evidence.service.spec.ts b/test/runtime/runtime-evidence.service.spec.ts
index 16c5dd0..cadcd4f 100644
--- a/test/runtime/runtime-evidence.service.spec.ts
+++ b/test/runtime/runtime-evidence.service.spec.ts
@@ -216,4 +216,37 @@ describe('RuntimeEvidenceService', () => {
     expect(serialized).toContain('captcha evidence');
     expect(serialized).toContain('kept');
   });
+
+  it('redacts compound token and secret text keys while preserving session identifiers', () => {
+    const service = new RuntimeEvidenceService();
+
+    const record = service.createRecord({
+      title: 'compound token evidence',
+      taskType: 'api',
+      project: 'kt-template-online-api',
+      environment: 'local',
+      operation: 'admin-login',
+      target: 'sessionId=KT_SCAN_SAFE',
+      status: 'failed',
+      details: {
+        sessionId: 'KT_SCAN_SAFE',
+        text:
+          'accessToken=raw-access-token refreshToken=raw-refresh-token access_token=raw-snake-token client_secret=raw-client-secret sessionId=KT_SCAN_SAFE',
+        jsonText:
+          '{"accessToken":"raw-json-access","refreshToken":"raw-json-refresh","access_token":"raw-json-snake","client_secret":"raw-json-client-secret","sessionId":"KT_SCAN_SAFE"}',
+      },
+    });
+
+    const serialized = JSON.stringify(record);
+
+    expect(serialized).not.toContain('raw-access-token');
+    expect(serialized).not.toContain('raw-refresh-token');
+    expect(serialized).not.toContain('raw-snake-token');
+    expect(serialized).not.toContain('raw-client-secret');
+    expect(serialized).not.toContain('raw-json-access');
+    expect(serialized).not.toContain('raw-json-refresh');
+    expect(serialized).not.toContain('raw-json-snake');
+    expect(serialized).not.toContain('raw-json-client-secret');
+    expect(serialized).toContain('KT_SCAN_SAFE');
+  });
 });