🛡️ Sentinel: [HIGH] Fix credential leak due to unhandled DSN URL schemes

[seonghobae]

🚨 Severity: HIGH
💡 Vulnerability: urllib.parse.urlsplit이 언더스코어가 포함된 URL 스킴(예: snowflake_invalid://)을 빈 문자열로 처리하여, 잘못된 형식의 DSN 연결 실패 시 에러 메시지에 평문 암호가 그대로 노출되는 자격 증명 유출(Credential Leak) 취약점입니다.
🎯 Impact: 공격자 혹은 내부 로그 접근자가 데이터베이스 자격 증명을 획득할 수 있습니다.
🔧 Fix: 비밀번호 마스킹을 위한 DSN 파싱 시, 알 수 없는 스킴 부분을 임시로 http://로 치환하여 urlsplit이 사용자 정보를 정상적으로 파싱하도록 강제 우회했습니다.
✅ Verification: backend/tests/test_dsn_redaction.py 유닛 테스트를 추가하여 정규화 및 마스킹 성공을 검증했습니다. (cd backend && uv run pytest tests/test_dsn_redaction.py)

---

PR created automatically by Jules for task 3749945389775870191 started by @seonghobae

[google-labs-jules]

👋 Jules, reporting for duty! I'm here to lend a hand with this pull request.

When you start a review, I'll add a 👀 emoji to each comment to let you know I've read it. I'll focus on feedback directed at me and will do my best to stay out of conversations between you and other bots or reviewers to keep the noise down.

I'll push a commit with your requested changes shortly after. Please note there might be a delay between these steps, but rest assured I'm on the job!

For more direct control, you can switch me to Reactive Mode. When this mode is on, I will only act on comments where you specifically mention me with @jules. You can find this option in the Pull Request section of your global Jules UI settings. You can always switch back!

New to Jules? Learn more at jules.google/docs.

---

For security, I will only act on instructions from the user who triggered this task.

[Copilot]

Pull request overview

This PR addresses a credential leak risk in backend error redaction when DSNs use non-standard URL schemes (notably schemes containing underscores) that urllib.parse.urlsplit fails to parse correctly, potentially preventing password extraction/redaction.

Changes:

• Add a fallback parsing path in DSN password-candidate extraction by temporarily substituting an invalid/unknown scheme with http:// when urlsplit yields an empty scheme.
• Add unit tests to verify secret candidate extraction and error-message redaction for DSNs with unsupported schemes and for standard PostgreSQL DSNs.
• Document the vulnerability/learning/prevention guidance in .jules/sentinel.md.

Reviewed changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated no comments.

File	Description
backend/app/dsn_redaction.py	Adds scheme-substitution fallback so urlsplit can extract userinfo/query secrets for redaction even when the original scheme is malformed (e.g., contains underscores).
backend/tests/test_dsn_redaction.py	Adds focused tests validating secret candidate extraction and redaction behavior for malformed-scheme and standard DSNs.
.jules/sentinel.md	Records the vulnerability pattern and mitigation guidance for future prevention.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[github-actions]

Pull request overview

OpenCode exhausted the configured model pool without a usable current-head review conclusion. This is not approval evidence, so the PR is blocked until a source-backed review can establish approval sufficiency or identify concrete fixes.

Findings

1. HIGH .jules/sentinel.md:1 - OpenCode could not establish approval sufficiency

• Problem: every configured model path failed to produce a usable current-head control block.
• Root cause: model execution, timeout, export, normalization, or approval-gate validation did not complete after exponential retry across the configured model pool.
• Impact: approving from deterministic check state alone would miss PR-intent mismatches, missing files, edge-case bugs, robustness gaps, UX/DX regressions, security issues, and CodeGraph-backed base/head flow changes.
• Fix: rerun OpenCode after model availability recovers, or update the PR with the missing files, tests, docs, generated artifacts, and verification evidence needed for a source-backed review conclusion.
• Regression test: keep the approval gate posting REQUEST_CHANGES, not APPROVE or check-only failure, when no model produces a valid current-head review.

Summary

• Result: REQUEST_CHANGES
• Reason: coverage-evidence passed and peer GitHub Checks completed without failures, but no model produced a valid review control block.
• Deterministic evidence checked but not used for approval: current-head changed-file evidence (.jules/sentinel.md, backend/app/dsn_redaction.py, backend/tests/test_dsn_redaction.py); coverage-evidence result success; peer checks from statusCheckRollup excluding this OpenCode check.
• Model outcome: model_pool=exhausted; selected_model=none.
• Head SHA: 3962109996437937e24b2b79bfb2e9abc1398221
• Workflow run: 28549565437
• Workflow attempt: 1

No PR approval was posted because model-output failure is not evidence that the PR has no blockers.

Changed-File Evidence Map

flowchart LR
  PR["PR changed files"] --> Evidence["OpenCode bounded evidence"]
  Evidence --> S1["Changed file: sentinel.md"]
  S1 --> I1["repository behavior"]
  I1 --> R1["Review risk: Changed file: sentinel.md"]
  R1 --> V1["required checks"]
  Evidence --> S2["Backend (2 files)"]
  S2 --> I2["API and service runtime"]
  I2 --> R2["Review risk: Backend (2 files)"]
  R2 --> V2["backend tests"]

Loading

[github-actions]

HIGH OpenCode could not establish approval sufficiency

• Problem: the model pool exhausted without a valid current-head review control block, so this changed line cannot be approved from deterministic check state alone.
• Impact: PR-intent mismatches, missing files, robustness bugs, UX/DX regressions, and CodeGraph-backed flow changes could be missed.
• Fix: rerun OpenCode after model availability recovers, or add the missing source/test/docs/generated verification evidence needed for a source-backed approval.
• Verification: rerun the OpenCode Review workflow and confirm it emits APPROVE or source-backed REQUEST_CHANGES for this head SHA.

[github-actions]

OpenCode Review Overview

• Head SHA: 3962109996437937e24b2b79bfb2e9abc1398221
• Workflow run: 28549565437
• Workflow attempt: 1
• Gate result: REQUEST_CHANGES (approval step)

Pull request overview

OpenCode exhausted the configured model pool without a usable current-head review conclusion. This is not approval evidence, so the PR is blocked until a source-backed review can establish approval sufficiency or identify concrete fixes.

Findings

1. HIGH .jules/sentinel.md:1 - OpenCode could not establish approval sufficiency

• Problem: every configured model path failed to produce a usable current-head control block.
• Root cause: model execution, timeout, export, normalization, or approval-gate validation did not complete after exponential retry across the configured model pool.
• Impact: approving from deterministic check state alone would miss PR-intent mismatches, missing files, edge-case bugs, robustness gaps, UX/DX regressions, security issues, and CodeGraph-backed base/head flow changes.
• Fix: rerun OpenCode after model availability recovers, or update the PR with the missing files, tests, docs, generated artifacts, and verification evidence needed for a source-backed review conclusion.
• Regression test: keep the approval gate posting REQUEST_CHANGES, not APPROVE or check-only failure, when no model produces a valid current-head review.

Summary

• Result: REQUEST_CHANGES
• Reason: coverage-evidence passed and peer GitHub Checks completed without failures, but no model produced a valid review control block.
• Deterministic evidence checked but not used for approval: current-head changed-file evidence (.jules/sentinel.md, backend/app/dsn_redaction.py, backend/tests/test_dsn_redaction.py); coverage-evidence result success; peer checks from statusCheckRollup excluding this OpenCode check.
• Model outcome: model_pool=exhausted; selected_model=none.
• Head SHA: 3962109996437937e24b2b79bfb2e9abc1398221
• Workflow run: 28549565437
• Workflow attempt: 1

No PR approval was posted because model-output failure is not evidence that the PR has no blockers.

Changed-File Evidence Map

flowchart LR
  PR["PR changed files"] --> Evidence["OpenCode bounded evidence"]
  Evidence --> S1["Changed file: sentinel.md"]
  S1 --> I1["repository behavior"]
  I1 --> R1["Review risk: Changed file: sentinel.md"]
  R1 --> V1["required checks"]
  Evidence --> S2["Backend (2 files)"]
  S2 --> I2["API and service runtime"]
  I2 --> R2["Review risk: Backend (2 files)"]
  R2 --> V2["backend tests"]

Loading