Nic Boet 8359958068 fix(api): redact credentials sent as arrays, keep empty values visible ...

ZmErrorHandler::redact() matched token=, auth=, pass= and password=
only. A client that sends one of them as an array (token[]=x, which
Cake logs as token%5B0%5D=x) still puts the value in the log, so the
name may now carry [..] or %5B..%5D before the =.

An empty value is no longer replaced: token= stays token=, so the log
still shows a client that sent no credential.

Tests: prefixes (authority, tokenize, password2, pass_hint, token_type,
passwd) are not touched, arrays are redacted, empty stays empty.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
(cherry picked from commit 4789df0a04)

2026-10-30 18:53:27 -04:00

..

Error

fix(api): redact credentials sent as arrays, keep empty values visible

2026-10-30 18:53:27 -04:00