Hacktoberfest 2026: the issues maintainers tagged for October, open and beginner-friendly. Browse Hacktoberfest issues

Telemetry scrubber: case-insensitive mysql rule redacts an attached port (-P3306) and lets a real password survive in the same command

Open Beginner friendly
  • Is something wrong?
#815 0 comments 0 reactions 0 assignees View on GitHub

Maintainers usually reply within 1 day

Nobody has claimed this yet.

Assessment

Difficulty
2/5
Estimated time
1-3 hours
Newbie friendliness
82/100
Issue type
Bug
Clarity
Clearly specified
Activity status
Active
Tech stack
mysql, typescript
Domain
backend, security

Research direction

Start in server/src/telemetry/scrub.ts and inspect the mysql credential rule alongside its sibling sshpass rule. Add coverage for the mixed -P3306 and -phunter2 command, lowercase attached -p3306, and mysql -p database; confirm the port and database name remain while actual credentials are redacted.

Written by the indexing model from the issue text.

Description

Summary

In server/src/telemetry/scrub.ts, the tool-anchored mysql credential rule keeps the i flag:

[
  /(\bmysql(?:dump)?\b(?:[^|;&\\\r\n]|\\[\s\S])*?(?:[ \t]|\\\r?\n)-p)("[^"]*"|'[^']*'|[^\s'"-]\S*)/gi,
  (_m, lead) => `${lead}${REDACTED}`,
],

i makes (?:[ \t])-p match the uppercase attached port form -P3306 (mysql's syntax for --port attached to a single dash). Because the g continuation after the first match never sees another \bmysql\b anchor, a real password later in the same command line is not redacted.

Repro (upstream tree at e8bb2736)

scrubCommand("mysql -h db -P3306 -phunter2 app")
→ "mysql -h db -P[REDACTED] -phunter2 app"

The port is redacted as if it were a secret, and the actual password -phunter2 survives into OTLP export — contrary to the module header's stated priority ("a secret that survived costs a rotation") and to the sibling sshpass rule, which is deliberately case-sensitive with the comment "Case matters here: -P is sshpass's prompt".

Suggested fix

Drop i from the mysql rule (/gi → /g), matching the sshpass rule's convention:

  • mysql -h db -P3306 -phunter2 app → mysql -h db -P3306 -p[REDACTED] app
  • lowercase -p3306 (attached password form) is still redacted
  • mysqldump -phunter2 db unchanged

Tests worth pinning: the mixed -P/-p command above, the lowercase attached form, and mysql -p database (space form = interactive prompt, database name must not be redacted).

Context: we hit this in a downstream deployment while extending coverage for SSHPASS=… sshpass -e and docker <global-options> login -p …; the case-sensitivity divergence was found by a full-scope review pass. Happy to send a PR if wanted.

Dominant language
TypeScript
Stars
6.6k
Forks
914
Avg merge
22h 44m
Merged PRs (30d)
137

Getting set up

  • Ships a Dockerfile or Docker Compose file
  • Has a pull request template
  • No contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

More from CopilotKit/OpenBot

All issues in CopilotKit/OpenBot

Similar issues

More TypeScript issues

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.