fix(telemetry): mask error text after credential words

BO
1d ago
+413-30

Issue for this PR

Closes #1588

Type of change

  • Bug fix
  • New feature
  • Refactor / code improvement
  • Documentation

What does this PR do?

The error-message template can retain credential values when they contain allowed words. For example, password=wrong user currently becomes <x> wrong user.

Stop processing the first line when a credential word is encountered, replacing that word and the remaining text with <x>. This preserves the diagnostic prefix and leaves error hashing and the event structure unchanged.

This intentionally also removes diagnostic text following credential words. It follows the existing tokenization rules and does not attempt general-purpose secret detection.

Implemented with Codex assistance.

How did you verify your code works?

Codex ran the checks in a cloud development environment. The added regression cases failed against the original implementation. With the fix, all 426 telemetry tests passed, including the 61 error-detail tests. Type checks across all 13 workspaces, formatting, lint, and git diff --check also passed.

A separate Codex review, assisted by Open Code Review’s delegation mode for file selection and rule preparation, covered both changed files and reported no defects requiring changes. Additional checks of extracted template functions covered credential masking, compatibility, and newline boundaries; these were not application-level tests.

Cost side effects

None. This changes local string processing and adds no model calls, warehouse queries, or cloud resources.

Screenshots / recordings

N/A. No UI changes.

Checklist

  • I have tested my changes locally
  • I have not included unrelated changes in this PR
  • I checked for cost side effects (model calls, queries or cloud resources that grow with user data) and described them, or wrote "none"

Summary by cubic

Fixes #1588, where error messages could leak credential values when the value itself consisted of allowed vocabulary words—password=wrong user previously became <x> wrong user. The template now stops at the first credential word and masks that word plus the rest of the line as <x>, so the value cannot appear.

Bug Fixes

  • Expands the exported credential word list with aliases like apikey, sessionid, and signature, matching whole words only to avoid false positives inside words like keychain.
  • Recognizes connection string keys in connection_string, connection-string, and spaced connection string assignment forms, on the first line only.
  • Strips ANSI escapes through a shared helper with separate template and legacy profiles; the legacy profile preserves historical maskString output and error hashes.
  • Bounds raw first-line processing at 8192 UTF-16 code units, failing closed to <x> for oversized lines.
  • Event structure and first-line-only processing are unchanged.

Summary by CodeRabbit

  • Bug Fixes
    • Error messages now hide credential-related terms and any following details on the first line, while retaining diagnostic information that appears before credentials.
    • Credential detection handles connection-string variants and ignores ANSI formatting. Messages with an oversized first line are safely omitted.
    • Telemetry event messages continue to preserve existing fingerprinting behavior while masking credential suffixes.
    • ANSI handling retains historical telemetry masking behavior and applies consistent input-size limits.