fix(bundle): redact private support bundle details (2026.6.16.2-23BD)

RealWhyKnot · RealWhyKnot · commit 8040fc121b2c · 2026-06-16T01:40:36.000-05:00
diff --git a/bridge/src/cmd_bundle/manifest.rs b/bridge/src/cmd_bundle/manifest.rs
@@ -192,8 +192,9 @@ pub(super) async fn build_manifest(
         redaction_policy: vec![
             "Wi-Fi passwords are not included.",
             "SSID values are redacted from bundle text.",
-            "Key/value fields named password, pass, ssid, token, secret, authorization, api_key, or apikey are redacted.",
-            "Lengths, failure codes, timings, local IPs, device names, driver names, firmware IDs, and filesystem paths may be included for diagnosis.",
+            "Key/value fields named password, pass, ssid, token, secret, authorization, api_key, apikey, hostname, computername, username, user_name, or userprofile are redacted.",
+            "Private LAN IP addresses, MAC addresses, Windows user profile paths, hostnames, and usernames are redacted from bundle text.",
+            "Lengths, ports, failure codes, timings, device names, driver names, and firmware IDs may be included for diagnosis.",
             "Raw per-key keyboard traces require trace logging and are not enabled by default.",
             "Raw USB packet dumps are only captured when the Pico is deliberately switched into debug input mode.",
             "Retained debug packet logs are redacted by the same bundle filter before they are written into the ZIP.",
diff --git a/bridge/src/cmd_bundle/mod.rs b/bridge/src/cmd_bundle/mod.rs
@@ -436,7 +436,7 @@ pub async fn build_bundle(out_path: PathBuf) -> Result<BundleSummary> {
         .unix_permissions(0o644);
 
     zip.start_file("manifest.json", opts)?;
-    zip.write_all(manifest_json.as_bytes())?;
+    zip.write_all(redact_bundle_text(&manifest_json).as_bytes())?;
 
     zip.start_file("bundle-capture.txt", opts)?;
     zip.write_all(redact_bundle_text(&capture_log.text()).as_bytes())?;
@@ -646,7 +646,8 @@ pub async fn build_bundle(out_path: PathBuf) -> Result<BundleSummary> {
                                     format!("crashes/{}", name.to_string_lossy()),
                                     opts,
                                 )?;
-                                zip.write_all(&bytes)?;
+                                let text = String::from_utf8_lossy(&bytes);
+                                zip.write_all(redact_bundle_text(&text).as_bytes())?;
                             }
                             Err(e) => {
                                 tracing::debug!(
@@ -685,7 +686,8 @@ pub async fn build_bundle(out_path: PathBuf) -> Result<BundleSummary> {
             match std::fs::read(&jp) {
                 Ok(bytes) => {
                     zip.start_file("state-journal.log", opts)?;
-                    zip.write_all(&bytes)?;
+                    let text = String::from_utf8_lossy(&bytes);
+                    zip.write_all(redact_bundle_text(&text).as_bytes())?;
                 }
                 Err(e) => {
                     tracing::debug!("bundle: could not read state journal: {e}");
@@ -2350,7 +2352,7 @@ pub async fn run(output: Option<PathBuf>) -> Result<()> {
         );
     }
     println!();
-    println!("Wi-Fi password and SSID are not included. Safe to share.");
+    println!("Wi-Fi credentials, local addresses, and profile paths are redacted. Safe to share.");
     println!();
     println!("Report this bundle at: {issue_url}");
 
diff --git a/bridge/src/cmd_bundle/redact.rs b/bridge/src/cmd_bundle/redact.rs
@@ -1,6 +1,8 @@
 //! Bundle text redaction. Keep diagnostic structure, counters, lengths,
-//! timings, and failure codes while stripping values that identify Wi-Fi
-//! networks or credentials.
+//! timings, and failure codes while stripping values that identify the
+//! operator, local network, Wi-Fi network, or credentials.
+
+use std::net::Ipv4Addr;
 
 const SENSITIVE_KEYS: &[&str] = &[
     "ssid",
@@ -12,8 +14,18 @@ const SENSITIVE_KEYS: &[&str] = &[
     "authorization",
     "api_key",
     "apikey",
+    "hostname",
+    "computername",
+    "username",
+    "user_name",
+    "userprofile",
 ];
 
+const REDACTED: &str = "<redacted>";
+const REDACTED_IP: &str = "<redacted-ip>";
+const REDACTED_MAC: &str = "<redacted-mac>";
+const USERPROFILE: &str = "%USERPROFILE%";
+
 pub(super) fn redact_bundle_text(input: &str) -> String {
     let mut out = String::with_capacity(input.len());
     for segment in input.split_inclusive('\n') {
@@ -40,6 +52,10 @@ pub(super) fn redact_bundle_text(input: &str) -> String {
 
 fn redact_line(line: &str) -> String {
     let line = redact_wifi_join_line(line);
+    let line = redact_windows_user_paths(&line);
+    let line = redact_private_ipv4(&line);
+    let line = redact_mac_addresses(&line);
+    let line = redact_hostname_label(&line);
     redact_key_values(&line)
 }
 
@@ -56,11 +72,188 @@ fn redact_wifi_join_line(line: &str) -> String {
     let value_end = value_start + rel_end;
     let mut out = String::with_capacity(line.len());
     out.push_str(&line[..value_start]);
-    out.push_str("<redacted>");
+    out.push_str(REDACTED);
     out.push_str(&line[value_end..]);
     out
 }
 
+fn redact_windows_user_paths(line: &str) -> String {
+    let mut out = String::with_capacity(line.len());
+    let mut index = 0usize;
+    while index < line.len() {
+        let Some((start, prefix)) = find_next_user_path_prefix(line, index) else {
+            out.push_str(&line[index..]);
+            break;
+        };
+        out.push_str(&line[index..start]);
+        let mut user_end = start + prefix.len();
+        let bytes = line.as_bytes();
+        while user_end < bytes.len() && bytes[user_end] != b'\\' && bytes[user_end] != b'/' {
+            user_end += 1;
+        }
+        out.push_str(USERPROFILE);
+        index = user_end;
+    }
+    out
+}
+
+fn find_next_user_path_prefix(line: &str, offset: usize) -> Option<(usize, &'static str)> {
+    const PREFIXES: &[&str] = &["C:\\Users\\", "C:/Users/", "C:\\\\Users\\\\"];
+    let lower = line[offset..].to_ascii_lowercase();
+    PREFIXES
+        .iter()
+        .filter_map(|prefix| {
+            lower
+                .find(&prefix.to_ascii_lowercase())
+                .map(|pos| (offset + pos, *prefix))
+        })
+        .min_by_key(|(pos, _)| *pos)
+}
+
+fn redact_private_ipv4(line: &str) -> String {
+    let bytes = line.as_bytes();
+    let mut out = String::with_capacity(line.len());
+    let mut index = 0usize;
+    let mut last = 0usize;
+    while index < bytes.len() {
+        if !bytes[index].is_ascii_digit() {
+            index += 1;
+            continue;
+        }
+        let start = index;
+        while index < bytes.len() && (bytes[index].is_ascii_digit() || bytes[index] == b'.') {
+            index += 1;
+        }
+        let end = index;
+        if is_private_ipv4_token(line, start, end) {
+            out.push_str(&line[last..start]);
+            out.push_str(REDACTED_IP);
+            last = end;
+        }
+    }
+    if last == 0 {
+        return line.to_string();
+    }
+    out.push_str(&line[last..]);
+    out
+}
+
+fn is_private_ipv4_token(line: &str, start: usize, end: usize) -> bool {
+    if start > 0 && is_token_char(line.as_bytes()[start - 1]) {
+        return false;
+    }
+    if end < line.len() && is_token_char(line.as_bytes()[end]) {
+        return false;
+    }
+    let candidate = &line[start..end];
+    if candidate.as_bytes().iter().filter(|b| **b == b'.').count() != 3 {
+        return false;
+    }
+    let Ok(ip) = candidate.parse::<Ipv4Addr>() else {
+        return false;
+    };
+    is_private_or_local_ipv4(ip)
+}
+
+fn is_private_or_local_ipv4(ip: Ipv4Addr) -> bool {
+    let octets = ip.octets();
+    octets[0] == 10
+        || (octets[0] == 172 && (16..=31).contains(&octets[1]))
+        || (octets[0] == 192 && octets[1] == 168)
+        || (octets[0] == 169 && octets[1] == 254)
+        || octets[0] == 127
+}
+
+fn is_token_char(byte: u8) -> bool {
+    byte.is_ascii_alphanumeric() || byte == b'.' || byte == b'_' || byte == b'-'
+}
+
+fn redact_mac_addresses(line: &str) -> String {
+    let bytes = line.as_bytes();
+    let mut out = String::with_capacity(line.len());
+    let mut index = 0usize;
+    let mut last = 0usize;
+    while index + 17 <= bytes.len() {
+        if is_mac_at(bytes, index) {
+            out.push_str(&line[last..index]);
+            out.push_str(REDACTED_MAC);
+            index += 17;
+            last = index;
+        } else {
+            index += 1;
+        }
+    }
+    if last == 0 {
+        return line.to_string();
+    }
+    out.push_str(&line[last..]);
+    out
+}
+
+fn is_mac_at(bytes: &[u8], start: usize) -> bool {
+    if start > 0 && is_token_char(bytes[start - 1]) {
+        return false;
+    }
+    let sep = bytes[start + 2];
+    if sep != b':' && sep != b'-' {
+        return false;
+    }
+    for group in 0..6 {
+        let pos = start + group * 3;
+        if !bytes[pos].is_ascii_hexdigit() || !bytes[pos + 1].is_ascii_hexdigit() {
+            return false;
+        }
+        if group < 5 && bytes[pos + 2] != sep {
+            return false;
+        }
+    }
+    let end = start + 17;
+    end >= bytes.len() || !is_token_char(bytes[end])
+}
+
+fn redact_hostname_label(line: &str) -> String {
+    const LABELS: &[&str] = &[
+        "hostname",
+        "host name",
+        "computername",
+        "computer name",
+        "username",
+        "user name",
+    ];
+    let trimmed = line.trim_start();
+    let prefix_len = line.len() - trimmed.len();
+    let lower = trimmed.to_ascii_lowercase();
+    for label in LABELS {
+        if !lower.starts_with(label) {
+            continue;
+        }
+        let mut value_start = prefix_len + label.len();
+        let bytes = line.as_bytes();
+        if value_start < bytes.len()
+            && !bytes[value_start].is_ascii_whitespace()
+            && bytes[value_start] != b':'
+            && bytes[value_start] != b'='
+        {
+            continue;
+        }
+        while value_start < bytes.len()
+            && (bytes[value_start].is_ascii_whitespace()
+                || bytes[value_start] == b':'
+                || bytes[value_start] == b'=')
+        {
+            value_start += 1;
+        }
+        if value_start >= bytes.len() {
+            return line.to_string();
+        }
+        let mut out = String::with_capacity(line.len());
+        out.push_str(&line[..value_start]);
+        out.push_str(REDACTED);
+        return out;
+    }
+    line.to_string()
+}
+
 fn redact_key_values(line: &str) -> String {
     let mut out = String::with_capacity(line.len());
     let mut index = 0usize;
@@ -72,7 +265,7 @@ fn redact_key_values(line: &str) -> String {
         out.push_str(&line[index..value_start]);
         let value_end = find_value_end(line, value_start);
         if value_end > value_start {
-            out.push_str("<redacted>");
+            out.push_str(REDACTED);
         }
         index = value_end;
         if key_start == index {
@@ -137,7 +330,7 @@ fn find_value_end(line: &str, value_start: usize) -> usize {
         let quote = bytes[value_start];
         let mut i = value_start + 1;
         while i < bytes.len() {
-            if bytes[i] == quote {
+            if bytes[i] == quote && quote_ends_value(bytes, i + 1) {
                 return i + 1;
             }
             i += 1;
@@ -154,6 +347,12 @@ fn find_value_end(line: &str, value_start: usize) -> usize {
     i
 }
 
+fn quote_ends_value(bytes: &[u8], next: usize) -> bool {
+    next >= bytes.len()
+        || bytes[next].is_ascii_whitespace()
+        || matches!(bytes[next], b',' | b';' | b'}' | b']')
+}
+
 #[cfg(test)]
 mod tests {
     use super::redact_bundle_text;
@@ -181,4 +380,50 @@ mod tests {
         assert!(!redacted.contains("abc123"));
         assert!(!redacted.contains("Cafe WiFi"));
     }
+
+    #[test]
+    fn redacts_quoted_ssid_with_apostrophe() {
+        let input = "ssid='Landen's_Router_2.4G' pass_len=12";
+        let redacted = redact_bundle_text(input);
+
+        assert_eq!(redacted, "ssid=<redacted> pass_len=12");
+        assert!(!redacted.contains("Landen"));
+        assert!(!redacted.contains("Router"));
+    }
+
+    #[test]
+    fn redacts_local_network_and_machine_identity() {
+        let input = concat!(
+            "ack from 192.168.50.227:4242 via 10.1.2.3\n",
+            "public dns 8.8.8.8 remains visible\n",
+            "path=C:\\Users\\Landen\\AppData\\Local\\ParsecCouchLink\\data\\logs\n",
+            "mac=AA-BB-CC-DD-EE-FF host=02E22DA9\n",
+            "hostname   DESKTOP-12345\n"
+        );
+        let redacted = redact_bundle_text(input);
+
+        assert!(redacted.contains("<redacted-ip>:4242"));
+        assert!(redacted.contains("via <redacted-ip>"));
+        assert!(redacted.contains("public dns 8.8.8.8 remains visible"));
+        assert!(
+            redacted.contains("path=%USERPROFILE%\\AppData\\Local\\ParsecCouchLink\\data\\logs")
+        );
+        assert!(redacted.contains("mac=<redacted-mac> host=02E22DA9"));
+        assert!(redacted.contains("hostname   <redacted>"));
+        assert!(!redacted.contains("192.168.50.227"));
+        assert!(!redacted.contains("10.1.2.3"));
+        assert!(!redacted.contains("C:\\Users\\Landen"));
+        assert!(!redacted.contains("AA-BB-CC-DD-EE-FF"));
+        assert!(!redacted.contains("DESKTOP-12345"));
+    }
+
+    #[test]
+    fn redacts_json_escaped_windows_profile_paths() {
+        let input =
+            r#"{ "config_path": "C:\\Users\\Landen\\AppData\\Roaming\\ParsecCouchLink\\config" }"#;
+        let redacted = redact_bundle_text(input);
+
+        assert!(redacted.contains(r#""config_path": "%USERPROFILE%\\AppData\\Roaming"#));
+        assert!(!redacted.contains(r#"C:\\Users\\Landen"#));
+    }
 }
