From 66e834d9d7b19cb543e6e487c33244ee1de65545 Mon Sep 17 00:00:00 2001 From: Nick Stebbings <47646783+nick-stebbings@users.noreply.github.com> Date: Wed, 11 Mar 2026 07:06:53 +1300 Subject: [PATCH] fix(wasm): run leak scan before credential injection in tools wrapper (#791) * fix(wasm): run leak scan before credential injection in tools wrapper The tools WASM wrapper runs the LeakDetector on HTTP request headers AFTER inject_host_credentials() has already substituted real secrets (e.g., xoxb- Slack bot tokens). This causes the leak detector to flag the tool's own legitimate outbound API calls as secret exfiltration. Move the scan to run on raw_headers before any credential injection, matching the fix already applied to the channels wrapper in #421. Fixes the same class of bug as #421 (which only fixed channels/wasm/wrapper.rs). Co-Authored-By: Claude Opus 4.6 * perf: inline leak scan to avoid Vec allocation on every HTTP request Address review feedback: instead of cloning all header keys/values into a Vec to pass to scan_http_request(), iterate over raw_headers directly using scan_and_clean(). This also provides more specific error messages (URL vs header vs body). Co-Authored-By: Claude Opus 4.6 * style: fix cargo fmt formatting in leak scan loop Co-Authored-By: Claude Opus 4.6 --------- Co-authored-by: Claude Opus 4.6 --- src/tools/wasm/wrapper.rs | 84 ++++++++++++++++++++++++++++++++++----- 1 file changed, 74 insertions(+), 10 deletions(-) diff --git a/src/tools/wasm/wrapper.rs b/src/tools/wasm/wrapper.rs index 0bdf8bfa..591bf549 100644 --- a/src/tools/wasm/wrapper.rs +++ b/src/tools/wasm/wrapper.rs @@ -279,6 +279,27 @@ impl near::agent::host::Host for StoreData { let raw_headers: HashMap = serde_json::from_str(&headers_json).unwrap_or_default(); + // Leak scan runs on WASM-provided values BEFORE host credential injection. + // This prevents false positives where the host-injected Bearer token + // (e.g., xoxb- Slack token) triggers the leak detector — WASM never saw + // the real value, so scanning the pre-injection state is correct. + // Inline the scan to avoid allocating a Vec of cloned headers. + let leak_detector = LeakDetector::new(); + leak_detector + .scan_and_clean(&injected_url) + .map_err(|e| format!("Potential secret leak in URL blocked: {}", e))?; + for (name, value) in &raw_headers { + leak_detector.scan_and_clean(value).map_err(|e| { + format!("Potential secret leak in header '{}' blocked: {}", name, e) + })?; + } + if let Some(body_bytes) = body.as_deref() { + let body_str = String::from_utf8_lossy(body_bytes); + leak_detector + .scan_and_clean(&body_str) + .map_err(|e| format!("Potential secret leak in body blocked: {}", e))?; + } + let mut headers: HashMap = raw_headers .into_iter() .map(|(k, v)| { @@ -297,16 +318,6 @@ impl near::agent::host::Host for StoreData { self.inject_host_credentials(&host, &mut headers, &mut url); } - let leak_detector = LeakDetector::new(); - let header_vec: Vec<(String, String)> = headers - .iter() - .map(|(k, v)| (k.clone(), v.clone())) - .collect(); - - leak_detector - .scan_http_request(&url, &header_vec, body.as_deref()) - .map_err(|e| format!("Potential secret leak blocked: {}", e))?; - // Get the max response size from capabilities (default 10MB). let max_response_bytes = self .host_state @@ -1792,4 +1803,57 @@ mod tests { // Should remain as string since it can't be parsed assert_eq!(result["count"], serde_json::json!("not-a-number")); } + + /// Regression test: leak scan must run on raw headers (before credential + /// injection), not after. If it ran post-injection, the host-injected + /// Slack bot token (`xoxb-...`) would trigger a Block and reject the + /// tool's own legitimate outbound request. + #[test] + fn test_leak_scan_runs_before_credential_injection() { + use crate::safety::LeakDetector; + + // Simulate pre-injection headers: WASM only sees the placeholder, not the real token. + let raw_headers: Vec<(String, String)> = vec![ + ( + "Authorization".to_string(), + "Bearer {SLACK_BOT_TOKEN}".to_string(), + ), + ("Content-Type".to_string(), "application/json".to_string()), + ]; + + let detector = LeakDetector::new(); + + // Pre-injection scan should pass — placeholders are not secrets. + let pre_result = detector.scan_http_request( + "https://slack.com/api/chat.postMessage", + &raw_headers, + None, + ); + assert!( + pre_result.is_ok(), + "Leak scan on pre-injection headers should pass, but got: {:?}", + pre_result + ); + + // Post-injection headers would contain a real Slack token. + let post_injection_headers: Vec<(String, String)> = vec![ + ( + "Authorization".to_string(), + "Bearer xoxb-1234567890-abcdefghij".to_string(), + ), + ("Content-Type".to_string(), "application/json".to_string()), + ]; + + // Post-injection scan WOULD block — this is the false positive + // that the pre-injection ordering prevents. + let post_result = detector.scan_http_request( + "https://slack.com/api/chat.postMessage", + &post_injection_headers, + None, + ); + assert!( + post_result.is_err(), + "Leak scan on post-injection headers should block the Slack token" + ); + } }