mirror of
https://github.com/bytedance/deer-flow.git
synced 2026-09-25 14:06:18 +00:00
1451e0a2e0
* fix(logging): collapse space-carrying Redirecting slots (#5225 round 16) A Redirecting slot was kept verbatim whenever a scheme matched at position 0, but the generic absolute-URL pass it is handed to stops both its `host` and `rest` groups at whitespace. A Location header value carrying an interior space (legal field syntax a misbehaving server can emit, and the shape round 13 deliberately kept matching) therefore survived in the clear after the first space: 'Redirecting /private/x?token=Q -> https://cdn.example/other page?sig=LeakedSig' redacted to '... -> https://cdn.example/<redacted> page?sig=LeakedSig'. The slot is now kept only when a whitespace-free absolute URL fills it, so the pass is guaranteed to consume it whole; space-carrying slots collapse like every other shape neither pass could cover. * fix(logging): ask the URL pass whether it consumes a Redirecting slot whole (#5225 round 16 review) The kept-set regex ([a-zA-Z...]*://\S+) was a stand-in for the invariant "the generic absolute-URL pass consumes the slot whole", and two whitespace-free absolute shapes satisfied it while the pass actually stopped early: a quote that reads as a closing mark (https://h/a')b?sig=…) and an empty host before the first /?# (https:///path?sig=…), which its host group never matches. Both left the signed tail in the log. Replace the stand-in with the check itself: run the pass's own pattern against the slot and keep it only when the match spans it end to end, so the rule cannot drift from the pattern's stop conditions again. --------- Co-authored-by: sxh313 <sxh313@users.noreply.github.com>