fix(media): redact final diagnostics and compare IPv6 origins

Merged
JL
25d ago
+724-139

Media retry logs already suppressed opaque backend messages, but final tracing events could print the same signed URL through error Debug. This completes R01 from the October 5 report and the two late findings on #1647.

Download errors now format both Display and Debug using only their variant and typed diagnostic facts, including HTTP status, I/O kind, integrity classification, refresh state and cleanup kind. Buffered/streaming upload and sticker-pack fetch emit the same safe diagnostic instead of formatting anyhow causes. IQ media-connection responses redact auth and ip_token, including when nested. Original causes remain available through source/downcast; sticker-pack transport errors now retain their original cause instead of interpolating it into a new string. This also protects downstream app-state warnings that use Display. Explicit source access still exposes the original cause. Streaming MAC failures now retain the existing typed InvalidMac variant, and IQ diagnostics preserve a safe failure kind and rejection code. The additive non-exhaustive wacore::download::DownloadPreparationError preserves safe local reasons without storing caller text.

Equivalent IPv6 literals now compare as addresses. Scheme, port and userinfo restrictions remain enforced, and the signed query, path encoding and fragment are preserved. No public signature, dependency or workflow changes. R03's validated DownloadParams is isolated in stacked draft #1656.

Validation completed on head f1734509:

  • The latest commit only removes a literal unwrap from the nested IQ test. Production code is unchanged from 832119cf. Local cargo clippy --all-targets -- -D warnings passed, as did Clippy for both touched crates with tracing enabled. All six updated IQ tests also passed. All current-head CI jobs are terminal: build/tests, all-features build/Clippy/tests, every feature-matrix job, native/MSRV consumers, WASM including isolated profiles and VoIP, E2E, Miri, rustdoc, generated artifacts, formatting, Cargo Deny, native binary size and CodSpeed passed. The informational semver failure and neutral/skipped review checks are explicitly documented below; this is not an all-checks-green claim. Earlier local test results below remain attributed to 832119cf.
  • Added deterministic tracing capture for all seven public media entries, with signed-URL/token/context markers and typed source assertions.
  • Added nested IQ/error Debug regressions and IPv6 equivalence plus origin-rejection controls.
  • Formatting and whitespace checks passed. Head 832119cf passed all 120 focused core/SDK media tests, four independent native consumer tests and two native compile-fail controls. Replaying the new tests against base bd1f3069 reproduces the IPv6 rejection, IQ token disclosure and final tracing/nested error disclosure. The full affected-crate suite also passed: 4,262 tests, with four existing ignored nightly/measurement probes. The independent wasm32 consumer compiles, including Rc/RefCell references and writers; two pre-existing unused-qualification warnings remain. Current-head CI is complete with the informational semver exception described below.
  • Paired wasm32 release download_probe build against bd1f3069: 102,560 → 106,784 bytes total (+4,224); excluding custom sections, 76,068 → 79,755 (+3,687). Code payload +3,228 and data payload +452 bytes. Both artifacts contain no checkout paths. Same toolchain, locked manifest, features and build command.
  • Native Binary Size (PR) passed again on f1734509, with the same measured delta against bd1f3069: stripped binary +6.91 KiB, .text +2.19 KiB, allocated sections +664 bytes; dependency count unchanged. Latest main 39d3b776 includes #1652 and #1653, touching chat-action/lifecycle code and shared exports outside this PR. A read-only merge-tree against it succeeds without conflicts; no integration commit was made and CI evidence remains for f1734509.
  • On f1734509, Codex completed with no major issues and Greptile passed at confidence 5/5. CodeRabbit's requested full review finished with no new inline findings; its latest formal approval is on 832119cf. All review threads are resolved.
  • Current-head CodSpeed passed: 842 results unchanged, 12 skipped, no regression alert. The prior appstate_macs_read_each[1] alert was investigated: most of its increase was in malloc_consolidate, 0.739 → 63.0 µs. On f1734509, the benchmark is 330.903 µs versus 330.427 µs base and malloc_consolidate is 0.919 µs. The prior alert did not reproduce; this does not establish controlled walltime equivalence. Evidence and run links are in comment 5998969734. No benchmark, gate or storage change or waiver was used.
  • Current-head informational semver still fails with the same 24/3/7 major-check categories against published 0.7.0, covering existing incompatible API evolution. R01 introduces no breaking signatures.
  • Cubic could not review because the account's monthly line limit was reached; its neutral status is not an approval.

Protocol evidence: whatspec 1f5167c4cebf263edaf001e06a2497f213c55793, schema 4.3.0, WhatsApp Web 2.3000.1047483476. Verified all 579 bundles and 75,824,128 bytes against the lock, plus archive SHA-256 22243b9c2ff18a66cea8fd66551821fe0f9f09786d107e2be8284637db86c349. AST-extracted WAWebMmsClientFormatDownloadUrl is at bytes [842489,844504) of bundle f588ee2f033b87e018a3be34a37ec1347d8b6b8700de539e6be31481b29c4690. The diagnostics fix is Rust-specific; the IPv6 change corrects our origin comparison without adopting unrelated query aliases or claiming complete Web parity.

Original base: bd1f3069ac0fccec0060c1b1ee7aa54f4fa217a0. Latest main checked: 39d3b776531230abf2f22e2c7b8544df6debc291. No merge requested.