From caedbb219dfa85fac54b5e27c577d1d35d3e1a4b Mon Sep 17 00:00:00 2001
From: SnowCat Security Bot <security@localhost>
Date: Fri, 13 Nov 2026 03:33:45 +0800
Subject: [PATCH] =?UTF-8?q?fix(security):=20=E6=97=A5=E5=BF=97=E8=84=B1?=
 =?UTF-8?q?=E6=95=8F=E8=A7=84=E5=88=99=E5=A2=9E=E5=BC=BA,=20=E8=A6=86?=
 =?UTF-8?q?=E7=9B=96=E6=9B=B4=E5=A4=9A=20token=20=E6=B3=84=E9=9C=B2?=
 =?UTF-8?q?=E5=BD=A2=E6=80=81?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

- 原 sanitizeLog 仅匹配 token=[\w\d]+, 无法覆盖 token: xxx /
  access_token / refresh_token / credential / Authorization 及含
  ./- 的 JWT 形态。
- 扩展为三类规则: token=形式 / token: 形式 / 敏感凭据字段名前缀。
- 同时覆盖 LogHandler(历史日志)与 LogRealTimeHandler(SSE 实时日志),
  两处本就共用 sanitizeLog, 无需改动调用侧。
---
 packages/snowcat-webui-backend/src/api/Log.ts | 7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

diff --git a/packages/snowcat-webui-backend/src/api/Log.ts b/packages/snowcat-webui-backend/src/api/Log.ts
index 40db251..c802938 100644
--- a/packages/snowcat-webui-backend/src/api/Log.ts
+++ b/packages/snowcat-webui-backend/src/api/Log.ts
@@ -7,8 +7,11 @@ const isMacOS = process.platform === 'darwin';
 
 // 日志脱敏函数
 const sanitizeLog = (log: string): string => {
-  // 脱敏 token 参数，将 token=xxx 替换为 token=***
-  return log.replace(/token=[\w\d]+/gi, 'token=***');
+  // 脱敏: token=xxx / token: xxx / access_token / refresh_token / credential / Authorization 一律打码
+  return log
+    .replace(/token=[\w\d.\-]+/gi, 'token=***')
+    .replace(/token[:=]\s*"?[\w\d.\-]+/gi, 'token=***')
+    .replace(/(access_token|refresh_token|credential|Authorization)[:=]\s*"?[\w\d.\-+/=]+/gi, '$1=***');
 };
 // 日志记录
 export const LogHandler: RequestHandler = async (req, res) => {