fix(ui): don't redact valid repo/login names in miner commands - #457
Conversation
|
Note Gittensory Gate skippedPR closed before full evaluation. No late first comment was created.
Checked by Gittensory, a quiet PR intelligence layer for OSS maintainers. |
JSONbored
left a comment
There was a problem hiding this comment.
@galuis116 the sanitizer fix matches the bug in #456.
A few notes:
- Requiring
term=value/term: valuebefore redaction preserves valid repo/login names likewallet-adapterandtrust-score. - The regression test covers the broken command case well.
- This still changes visible command output in the UI, so the PR needs screenshot evidence in the PR description.
Required changes:
- Add JPG/PNG UI evidence showing the affected command surface with a valid repo/login containing one of the previously redacted terms.
- Keep the screenshot in the PR description, not committed to the repo.
Validation expected:
- Rerun the focused miner command test and the UI checks relevant to the command surface.
screenshot added. |
sanitizeMinerCommand's private-term redaction used an optional assignment group, so bare words (wallet, hotkey, trust-score) in already-validated login/repo names were redacted, producing broken commands still marked copyable/ready. Require the term=value form so only real secret leakage is redacted.
720bfed to
991031f
Compare
|
Superagent didn't find any vulnerabilities or security issues in this PR. |
JSONbored
left a comment
There was a problem hiding this comment.
@galuis116 this is ready from my side on the rebased head.\n\nA few notes:\n- The sanitizer now targets assignment-style sensitive values instead of redacting legitimate repo/login words.\n- The regression test covers the important Bittensor-adjacent case: login trust-score and repo metamask/wallet-adapter stay runnable and copyable.\n- I rebased the branch through GitHub update-branch, and the current head has green validate and non-Gittensory checks.\n\nNo code changes requested.
Closes #456.

sanitizeMinerCommand's private-term redaction had an optional value-assignment group, so it matched bare standalone words (wallet,hotkey,coldkey,mnemonic,trust-score, …). Sincelogin/repoFullNameare already validated bysafeGitHubLogin/safeRepoFullName, a legitimate name containing one of those words got corrupted while the command stayed markedcopyable: true, state: "ready"— so the user copies a broken command with[redacted]in place of their real repo/login. Common in a Bittensor/crypto ecosystem (e.g.metamask/wallet-adapter).Changes
term=value/term: valueform so only real secret leakage is redacted, not validated names.trust-scoreand repometamask/wallet-adapterasserting the names survive and the command stays runnable.Verification
wallet-adapter→[redacted]-adapter).