From 7c1bd952683cf131beb2e22302471d834270d194 Mon Sep 17 00:00:00 2001 From: Bhautik Date: Sat, 19 Sep 2026 02:30:21 +0530 Subject: [PATCH] fix(security): redact delegated token in formatted output --- CHANGELOG.md | 5 +++++ src/instance.rs | 1 + src/models.rs | 14 +++++++++++++- 3 files changed, 19 insertions(+), 1 deletion(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index 8d8a7a7..c515523 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -4,6 +4,11 @@ All notable changes to the CreateOS Rust SDK are recorded here. ## Unreleased +### Fixed + +- Redact plaintext sandbox access tokens from debug output to prevent + accidental disclosure in logs. + ### Added - Sandbox access token creation, inspection, rotation, and disabling methods. diff --git a/src/instance.rs b/src/instance.rs index a3248b7..c482592 100644 --- a/src/instance.rs +++ b/src/instance.rs @@ -739,6 +739,7 @@ mod access_token_tests { let created = owner.create_access_token().await.unwrap(); assert_eq!(created.token, "skp_sb_first"); + assert!(!format!("{created:?}").contains(&created.token)); assert!(created.enabled && created.rotated_at.is_none()); assert_eq!( owner diff --git a/src/models.rs b/src/models.rs index 1da8357..36375ed 100644 --- a/src/models.rs +++ b/src/models.rs @@ -356,7 +356,7 @@ Sandbox { }); /// Plaintext delegated token returned only when created or rotated. -#[derive(Clone, Debug, Deserialize)] +#[derive(Clone, Deserialize)] pub struct SandboxAccessTokenCreateResponse { /// Delegated credential. Store it securely; it cannot be read again. pub token: String, @@ -368,6 +368,18 @@ pub struct SandboxAccessTokenCreateResponse { pub rotated_at: Option>, } +impl fmt::Debug for SandboxAccessTokenCreateResponse { + fn fmt(&self, formatter: &mut fmt::Formatter<'_>) -> fmt::Result { + formatter + .debug_struct("SandboxAccessTokenCreateResponse") + .field("token", &"[REDACTED]") + .field("enabled", &self.enabled) + .field("created_at", &self.created_at) + .field("rotated_at", &self.rotated_at) + .finish() + } +} + /// Delegated token state without plaintext credential material. #[derive(Clone, Debug, Deserialize)] pub struct SandboxAccessTokenMetadata {