Fix: leet detector firing on prose with version numbers (encoded-payload FP)#238
Merged
Merged
Conversation
…oad FP) The leetspeak sub-rule of encoded-payload-redact flagged ordinary English prose containing a version string. e.g. on the github.blog npm v12 changelog, "Upgrade to npm 11.16.0 or later, run your normal install, and review the warnings." matched: "11.16.0" supplies four leet-shape digits (1,1,1,0), clearing minSubstitutions, and `deleet` leaves the real letters untouched so the already-English text clears the common-word floor. collectSubstitutionCiphers already skips candidates that are *already* English (a real cipher payload obscures its letters, so its raw form is not yet English). collectLeet was missing that guard. Add the same alreadyEnglish short-circuit so prose with incidental version-number digits is left visible while genuine leet payloads (letters broken by digits, raw form scores ~0 common words) still redact. Regression test uses the verbatim changelog copy; confirmed it fails without the guard and passes with it. Existing leet-payload test unaffected.
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Problem
The
leetspeaksub-rule ofencoded-payload-redactproduced false positives on ordinary English prose that contained a version number. Reported on the github.blog npm v12 changelog, where lines like:were redacted as
[encoded payload hidden].Root cause
11.16.0supplies four leet-shape digits (1,1,1,0), clearingminSubstitutions: 4.deleetonly rewrites digits/symbols — it leaves genuine letters untouched. So already-English text stays readable after decode, andyour/and/theclear theminCommonWords: 3floor.collectSubstitutionCiphers(ROT13/Atbash/reverse) already skips candidates that are already English — a real cipher payload obscures its letters, so its raw form isn't English yet.collectLeetwas missing that guard.Fix
Add the same
alreadyEnglishshort-circuit tocollectLeet. Prose carrying incidental version-number digits is left visible; genuine leet payloads (y0u c4n 533 7h15…, letters broken up by digits, raw form scores ~0 common words) still redact.Testing
redacts a leetspeak-encoded English sentencetest still passes — real payloads unaffected.encoded-payload-redactexample + property suites pass (52 tests);bun run checkclean.🤖 Generated with Claude Code