mirror of
https://github.com/paperclipai/paperclip.git
synced 2026-10-27 19:35:13 +01:00
DottaandClaude Opus 5
b0f8b1e91e
Both findings from the exact-build security review (PAP-16983) against `b73524ec2ac5`. Sensitive information disclosure: every projected view carried raw `provider_event` records and unredacted tool results, so one ordinary turn handed an admitted browser provider protocol traffic, the echoed prompt, provider thread/turn/item identifiers, model and token metadata, and complete tool payloads. Redaction now happens where evidence is recorded, not where it is rendered — `redactPhase7EvidenceData` is the only way an entry enters a live session, so a raw payload never reaches the snapshot, the store, a frame, or a log. `toPhase7PublicThreadView` then publishes an allowlisted DTO on every response path, aliases provider-authored identifiers consistently, and scrubs withheld provider identity. A streamed failure answers with a code and fixed operator copy instead of the underlying message. Cross-session BOLA: the only capability was minted once per gateway process, so possession of a session id authorized reads and mutations of it. Each surface now mints a per-browser capability, stores only its SHA-256 with the session, and compares it in constant time on every session-scoped route. A valid id without its capability is answered 404, exactly like an id that never existed. `New chat`, a scenario POST, and reset rotate the capability after revoking the caller's prior bindings. Also normalises the stream frame cap to encoded UTF-8 bytes rather than UTF-16 code units, which the review flagged as low-severity hardening. Each new test was observed failing against the reinstated rejected behaviour (19 failed, 18 pre-existing passed) before passing against the fix. Refs PAP-16991. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>