This is an automated email from the ASF dual-hosted git repository. cgivre pushed a commit to branch feat/drill-mcp-server in repository https://gitbox.apache.org/repos/asf/drill-mcp.git
commit f308c84813e18977e7d0678a3e025a7eeda84284 Author: cgivre <[email protected]> AuthorDate: Tue Aug 11 16:32:30 2026 -0400 fix: add session key pattern and tests - Add session[._-]?key alternative to pattern for AWS STS-style credentials - Add tests for sessionKey, session_key, session-key, and X-Session-Key variants - All 23 redact tests pass, no regressions in full suite (116/116) --- drill_mcp/redact.py | 2 +- tests/test_redact.py | 20 ++++++++++++++++++++ 2 files changed, 21 insertions(+), 1 deletion(-) diff --git a/drill_mcp/redact.py b/drill_mcp/redact.py index 93cad99..f6ac0a4 100644 --- a/drill_mcp/redact.py +++ b/drill_mcp/redact.py @@ -35,7 +35,7 @@ REDACTED = "***REDACTED***" # are both caught. Deliberately broad: a false redaction is a cosmetic problem, # a missed one is a leaked credential. _SENSITIVE = re.compile( - r"password|passwd|secret|credential|token|access[._-]?key|private[._-]?key|api[._-]?key|authorization|passphrase|keytab|principal", + r"password|passwd|secret|credential|token|access[._-]?key|private[._-]?key|api[._-]?key|session[._-]?key|authorization|passphrase|keytab|principal", re.IGNORECASE, ) diff --git a/tests/test_redact.py b/tests/test_redact.py index 174bda0..7c0c64b 100644 --- a/tests/test_redact.py +++ b/tests/test_redact.py @@ -142,3 +142,23 @@ def test_passes_through_tuples(): result = redact(source) assert isinstance(result, tuple) assert result[0]["password"] == REDACTED + + +def test_redacts_session_key_camelcase(): + source = {"sessionKey": "session-value"} + assert redact(source)["sessionKey"] == REDACTED + + +def test_redacts_session_key_snake_case(): + source = {"session_key": "session-value"} + assert redact(source)["session_key"] == REDACTED + + +def test_redacts_session_key_kebab_case(): + source = {"session-key": "session-value"} + assert redact(source)["session-key"] == REDACTED + + +def test_redacts_session_key_header(): + source = {"X-Session-Key": "session-value"} + assert redact(source)["X-Session-Key"] == REDACTED
