fix(oci): bound and sanitize provider errors

Author: BillLeoutsakosvl346

apps/sim/lib/internal/oci/client.server.test.ts

@@ -24,6 +24,7 @@ function secureResponse(params: {
   ok: boolean
   status: number
   body?: string
+  responseBody?: ReadableStream<Uint8Array> | null
   opcRequestId?: string
 }) {
   return {
@@ -34,7 +35,7 @@ function secureResponse(params: {
       get: (name: string) =>
         name.toLowerCase() === 'opc-request-id' ? (params.opcRequestId ?? null) : null,
     },
-    body: null,
+    body: params.responseBody ?? null,
     text: vi.fn().mockResolvedValue(params.body ?? ''),
     json: vi.fn(),
     arrayBuffer: vi.fn(),
@@ -235,19 +236,17 @@ describe('OCI request client', () => {
     expect((failure as Error).message).not.toContain(echoedAuthorization)
   })
 
-  it('redacts encoded credentials and request URLs echoed by the provider', async () => {
+  it('redacts encoded credentials instead of falling through to a status-only error', async () => {
     const encodedFingerprint = encodeURIComponent(credentials.fingerprint)
-    const requestUrl = `${destination.origin}/n/`
-    const encodedRequestUrl = encodeURIComponent(requestUrl)
     const escapedPassphrase = 'secret "pass"'
-    const escapedPassphraseEcho = JSON.stringify(escapedPassphrase).slice(1, -1)
+    const encodedPassphrase = encodeURIComponent(escapedPassphrase)
     secureFetchMock.mockResolvedValueOnce(
       secureResponse({
         ok: false,
         status: 401,
         body: JSON.stringify({
           code: 'NotAuthenticated',
-          message: `provider echoed ${encodedFingerprint} ${encodedRequestUrl} ${escapedPassphraseEcho}`,
+          message: `provider echoed ${encodedFingerprint} ${encodedPassphrase}`,
         }),
       })
     )
@@ -259,12 +258,63 @@ describe('OCI request client', () => {
       timeout: 10_000,
       maxResponseBytes: 65_536,
     }).catch((error: unknown) => error)
+    expect((failure as Error).message).toContain('provider echoed')
+    expect((failure as Error).message).toContain('[REDACTED]')
     expect((failure as Error).message).not.toContain(encodedFingerprint)
-    expect((failure as Error).message).not.toContain(encodedRequestUrl)
-    expect((failure as Error).message).not.toContain(escapedPassphraseEcho)
+    expect((failure as Error).message).not.toContain(encodedPassphrase)
     expect((failure as Error).message).not.toContain(escapedPassphrase)
   })
 
+  it('redacts an encoded signed request URL instead of returning it', async () => {
+    const encodedRequestUrl = encodeURIComponent(`${destination.origin}/n/`)
+    secureFetchMock.mockResolvedValueOnce(
+      secureResponse({
+        ok: false,
+        status: 401,
+        body: JSON.stringify({
+          code: 'NotAuthenticated',
+          message: `provider echoed ${encodedRequestUrl}`,
+        }),
+      })
+    )
+    const failure = await sendOciRequest({
+      destination,
+      credentials,
+      method: 'GET',
+      encodedPath: '/n/',
+      timeout: 10_000,
+      maxResponseBytes: 65_536,
+    }).catch((error: unknown) => error)
+    expect((failure as Error).message).toContain('provider echoed')
+    expect((failure as Error).message).toContain('[REDACTED]')
+    expect((failure as Error).message).not.toContain(encodedRequestUrl)
+  })
+
+  it('redacts caller-supplied service header values echoed by the provider', async () => {
+    const serviceHeaderSecret = 'opaque-service-header-secret'
+    secureFetchMock.mockResolvedValueOnce(
+      secureResponse({
+        ok: false,
+        status: 401,
+        body: JSON.stringify({
+          code: 'NotAuthenticated',
+          message: `provider echoed ${serviceHeaderSecret}`,
+        }),
+      })
+    )
+    const failure = await sendOciRequest({
+      destination,
+      credentials,
+      method: 'GET',
+      encodedPath: '/n/',
+      timeout: 10_000,
+      maxResponseBytes: 65_536,
+      serviceHeaders: { 'opc-client-info': serviceHeaderSecret },
+    }).catch((error: unknown) => error)
+    expect((failure as Error).message).toContain('[REDACTED]')
+    expect((failure as Error).message).not.toContain(serviceHeaderSecret)
+  })
+
   it('redacts an echoed finalized request body from provider diagnostics', async () => {
     const requestBody = 'opaque-request-body-secret'
     secureFetchMock.mockResolvedValueOnce(
@@ -376,6 +426,7 @@ describe('OCI request client', () => {
       'signing-string-value',
       'private-key-value',
       'api-key-value',
+      'signature-value',
     ]
     secureFetchMock.mockResolvedValueOnce(
       secureResponse({
@@ -391,6 +442,7 @@ describe('OCI request client', () => {
             signing_string: echoedSecrets[4],
             'private key': echoedSecrets[5],
             'api key': echoedSecrets[6],
+            signature: echoedSecrets[7],
           }),
         }),
       })
@@ -407,6 +459,58 @@ describe('OCI request client', () => {
     for (const secret of echoedSecrets) expect((failure as Error).message).not.toContain(secret)
   })
 
+  it('fails closed for authorization signatures with flexible parameter spacing', async () => {
+    const echoedSignature = 'unknown-provider-signature'
+    secureFetchMock.mockResolvedValueOnce(
+      secureResponse({
+        ok: false,
+        status: 401,
+        body: JSON.stringify({
+          code: 'NotAuthenticated',
+          message: `provider echoed Signature version = "1", keyId = "unknown", signature = "${echoedSignature}"`,
+        }),
+      })
+    )
+    const failure = await sendOciRequest({
+      destination,
+      credentials,
+      method: 'GET',
+      encodedPath: '/n/',
+      timeout: 10_000,
+      maxResponseBytes: 65_536,
+    }).catch((error: unknown) => error)
+    expect((failure as Error).message).toBe('OCI request failed with status 401')
+    expect((failure as Error).message).not.toContain(echoedSignature)
+  })
+
+  it('bounds non-success response bodies independently of the caller response ceiling', async () => {
+    const cancel = vi.fn()
+    const response = secureResponse({
+      ok: false,
+      status: 502,
+      opcRequestId: 'request-oversized',
+      responseBody: new ReadableStream<Uint8Array>({
+        start(controller) {
+          controller.enqueue(new Uint8Array(65_537))
+        },
+        cancel,
+      }),
+    })
+    secureFetchMock.mockResolvedValueOnce(response)
+    const failure = await sendOciRequest({
+      destination,
+      credentials,
+      method: 'GET',
+      encodedPath: '/n/',
+      timeout: 10_000,
+      maxResponseBytes: 1024 * 1024,
+    }).catch((error: unknown) => error)
+    expect((failure as Error).message).toBe('OCI request failed with status 502')
+    expect((failure as OciRequestError).opcRequestId).toBe('request-oversized')
+    expect(cancel).toHaveBeenCalledOnce()
+    expect(response.text).not.toHaveBeenCalled()
+  })
+
   it('fails closed for a percent-encoded sensitive JSON key', async () => {
     secureFetchMock.mockResolvedValueOnce(
       secureResponse({

apps/sim/lib/internal/oci/client.server.ts

@@ -3,6 +3,10 @@ import {
   type SecureFetchResponse,
   secureFetchWithValidation,
 } from '@/lib/core/security/input-validation.server'
+import {
+  DEFAULT_MAX_ERROR_BODY_BYTES,
+  readResponseTextWithLimit,
+} from '@/lib/core/utils/stream-limits'
 import type { ValidatedOciDestination } from '@/lib/internal/oci/endpoints'
 import { OciRequestError, parseOciErrorBody } from '@/lib/internal/oci/errors'
 import {
@@ -12,7 +16,7 @@ import {
 } from '@/lib/internal/oci/signing.server'
 
 const MAX_OCI_TIMEOUT_MS = 5 * 60 * 1000
-const MAX_OCI_REDACTABLE_BODY_LENGTH = 65_536
+const MAX_OCI_REDACTABLE_REQUEST_MATERIAL_LENGTH = 65_536
 
 export interface OciRequestResult {
   readonly response: SecureFetchResponse
@@ -68,7 +72,8 @@ function sensitiveRequestValues(
   credentials: OciSigningCredentials,
   authorization: string | undefined,
   requestUrl: string,
-  requestBody: string | undefined
+  requestBody: string | undefined,
+  serviceHeaderValues: readonly string[]
 ): string[] {
   return [
     credentials.tenancyId,
@@ -80,9 +85,51 @@ function sensitiveRequestValues(
     authorization ?? '',
     requestUrl,
     requestBody ?? '',
+    ...serviceHeaderValues,
   ].filter(Boolean)
 }
 
+function getSignedServiceHeaderValues(
+  serviceHeaders: Readonly<Record<string, string>> | undefined,
+  signedHeaders: Readonly<Record<string, string>>
+): string[] {
+  return Object.keys(serviceHeaders ?? {}).flatMap((name) => {
+    const value = signedHeaders[name.toLowerCase()]
+    return value === undefined ? [] : [value]
+  })
+}
+
+function isRedactableRequestMaterial(values: readonly (string | undefined)[]): boolean {
+  let totalLength = 0
+  for (const value of values) {
+    if (value === undefined) continue
+    totalLength += value.length
+    if (totalLength > MAX_OCI_REDACTABLE_REQUEST_MATERIAL_LENGTH) return false
+  }
+  return true
+}
+
+async function readOciErrorBody(
+  response: SecureFetchResponse,
+  method: OciRequestMethod,
+  maxResponseBytes: number,
+  signal: AbortSignal | undefined
+): Promise<string | undefined> {
+  try {
+    return await readResponseTextWithLimit(response, {
+      maxBytes: Math.min(DEFAULT_MAX_ERROR_BODY_BYTES, maxResponseBytes),
+      label: 'OCI error response',
+      signal,
+      allowNoBodyFallback: true,
+      requestMethod: method,
+    })
+  } catch (error) {
+    if (signal?.aborted) throw error
+    await response.body?.cancel().catch(() => {})
+    return undefined
+  }
+}
+
 /** Sends one bounded, redirect-free OCI request to an already validated destination. */
 export async function sendOciRequest(params: {
   destination: ValidatedOciDestination
@@ -125,21 +172,34 @@ export async function sendOciRequest(params: {
   const opcRequestId = response.headers.get('opc-request-id') ?? undefined
   if (response.ok) return { response, opcRequestId }
 
-  const requestBodyIsRedactable =
-    signed.body === undefined || signed.body.length <= MAX_OCI_REDACTABLE_BODY_LENGTH
+  const serviceHeaderValues = getSignedServiceHeaderValues(params.serviceHeaders, signed.headers)
+  const requestMaterialIsRedactable = isRedactableRequestMaterial([
+    signed.body,
+    ...serviceHeaderValues,
+  ])
+  if (!requestMaterialIsRedactable) {
+    await response.body?.cancel().catch(() => {})
+    throw new OciRequestError({ status: response.status })
+  }
   const sensitiveValues = sensitiveRequestValues(
     params.credentials,
     signed.headers.authorization,
     signed.url,
-    requestBodyIsRedactable ? signed.body : undefined
+    signed.body,
+    serviceHeaderValues
+  )
+  const body = await readOciErrorBody(
+    response,
+    signed.method,
+    params.maxResponseBytes,
+    params.signal
   )
-  const body = await response.text()
-  const error = requestBodyIsRedactable ? parseOciErrorBody(body, sensitiveValues) : {}
+  const error = body === undefined ? {} : parseOciErrorBody(body, sensitiveValues)
   throw new OciRequestError({
     status: response.status,
     code: error.code,
     message: error.message,
-    opcRequestId: requestBodyIsRedactable ? opcRequestId : undefined,
+    opcRequestId,
     sensitiveValues,
   })
 }

apps/sim/lib/internal/oci/errors.ts

@@ -2,12 +2,13 @@ import {
   isSensitiveKey,
   REDACTED_MARKER,
   redactExactSensitiveValues,
+  redactKnownSensitiveValues,
 } from '@/lib/core/security/redaction'
 
 const MAX_OCI_ERROR_FIELD_LENGTH = 1024
 const MAX_OCI_ERROR_INPUT_LENGTH = 65_536
 const MAX_NESTED_JSON_DEPTH = 3
-const OCI_SENSITIVE_JSON_FIELDS = new Set(['signingstring'])
+const OCI_SENSITIVE_JSON_FIELDS = new Set(['signature', 'signingstring'])
 
 function normalizeJsonDiagnosticKey(key: string): string | undefined {
   let normalized = key
@@ -92,15 +93,22 @@ function sanitizeOciErrorField(
 ): string | undefined {
   if (typeof value !== 'string') return undefined
   if (value.length > MAX_OCI_ERROR_INPUT_LENGTH) return undefined
-  if (/%[0-9a-f]{2}/i.test(value)) return undefined
-  if (/\\(?:u[0-9a-f]{4}|x[0-9a-f]{2})/i.test(value)) return undefined
-  if (/\(request-target\)|x-content-sha256/i.test(value)) return undefined
-  const decoded = decodeNestedJsonDiagnostic(value)
-  if (decoded === undefined) return undefined
   const exactValues = sensitiveValues.flatMap((sensitiveValue) => {
     const jsonEncoded = JSON.stringify(sensitiveValue).slice(1, -1)
     return jsonEncoded === sensitiveValue ? [sensitiveValue] : [sensitiveValue, jsonEncoded]
   })
+  let knownRedacted: string
+  try {
+    knownRedacted = redactKnownSensitiveValues(value, exactValues)
+  } catch {
+    return undefined
+  }
+  if (/%[0-9a-f]{2}/i.test(knownRedacted)) return undefined
+  if (/\\(?:u[0-9a-f]{4}|x[0-9a-f]{2})/i.test(knownRedacted)) return undefined
+  if (/\(request-target\)|x-content-sha256/i.test(knownRedacted)) return undefined
+  if (/\bsignature\s*(?:version\s*)?=/i.test(knownRedacted)) return undefined
+  const decoded = decodeNestedJsonDiagnostic(knownRedacted)
+  if (decoded === undefined) return undefined
   let exactRedacted: string
   try {
     exactRedacted = redactExactSensitiveValues(decoded, exactValues)
@@ -110,7 +118,7 @@ function sanitizeOciErrorField(
   const sanitized = exactRedacted
     .replace(/-----BEGIN[\s\S]*/gi, '[redacted-key]')
     .replace(/https?:\/\/[^\s"']+/gi, '[redacted-url]')
-    .replace(/Signature\s+version=\\*"1\\*",[^\r\n]*/gi, '[redacted-authorization]')
+    .replace(/Signature\s+version\s*=\s*\\*"1\\*"\s*,[^\r\n]*/gi, '[redacted-authorization]')
     .replace(/[\u0000-\u001f\u007f]/g, ' ')
     .trim()
   return sanitized ? sanitized.slice(0, MAX_OCI_ERROR_FIELD_LENGTH) : undefined