Close remaining credential egress gaps

- redact geocoder endpoints in TypeScript and Python

- fail closed at traversal depth in both implementations

- detach inline GeoJSON in redacted projects

Author: giswqs

packages/core/src/credentials.ts

@@ -132,14 +132,6 @@ function redactConfigurationValue(
   redactedCount: { value: number },
   depth = 0,
 ): unknown {
-  if (typeof value === "string") {
-    const redacted = redactUrlCredentials(value);
-    if (redacted !== value) {
-      redactedPaths.push(path);
-      redactedCount.value += 1;
-    }
-    return redacted;
-  }
   if (depth >= MAX_REDACT_DEPTH) {
     // Fail closed. A deeply nested configuration shape is not needed to render
     // any built-in layer, and returning it unchanged would let a credential
@@ -148,12 +140,21 @@ function redactConfigurationValue(
     redactedCount.value += 1;
     return undefined;
   }
+  if (typeof value === "string") {
+    const redacted = redactUrlCredentials(value);
+    if (redacted !== value) {
+      redactedPaths.push(path);
+      redactedCount.value += 1;
+    }
+    return redacted;
+  }
   if (Array.isArray(value)) {
     return value.map((item, index) =>
       redactConfigurationValue(item, `${path}[${index}]`, redactedPaths, redactedCount, depth + 1),
     );
   }
-  if (!isPlainObject(value) || isGeoJsonPayload(value)) return value;
+  if (!isPlainObject(value)) return value;
+  if (isGeoJsonPayload(value)) return structuredClone(value);
 
   const result: Record<string, unknown> = {};
   for (const [key, nested] of Object.entries(value)) {
@@ -206,14 +207,23 @@ export function redactProjectCredentials(project: GeoLibreProject): CredentialRe
     redactedPaths.push("basemapStyleUrl");
     redactedCount.value += 1;
   }
-  const preferences = project.preferences
-    ? {
-        ...project.preferences,
-        environmentVariables: [],
-        geocoding: project.preferences.geocoding
-          ? { ...project.preferences.geocoding, apiKeys: {} }
-          : project.preferences.geocoding,
+  const geocoding = project.preferences?.geocoding
+    ? { ...project.preferences.geocoding, apiKeys: {} }
+    : project.preferences?.geocoding;
+  if (geocoding) {
+    for (const field of ["forwardEndpoint", "reverseEndpoint"] as const) {
+      const endpoint = geocoding[field];
+      if (typeof endpoint !== "string") continue;
+      const redacted = redactUrlCredentials(endpoint);
+      if (redacted !== endpoint) {
+        geocoding[field] = redacted;
+        redactedPaths.push(`preferences.geocoding.${field}`);
+        redactedCount.value += 1;
       }
+    }
+  }
+  const preferences = project.preferences
+    ? { ...project.preferences, environmentVariables: [], geocoding }
     : project.preferences;
   if (project.preferences?.environmentVariables?.length > 0) {
     redactedPaths.push("preferences.environmentVariables");

python/src/geolibre/project.py

@@ -63,6 +63,7 @@
     "st",
     "skoid",
 }
+_MAX_REDACT_DEPTH = 12
 
 
 def _redact_url(value: str) -> str:
@@ -97,18 +98,20 @@ def keep_params(params: str) -> str:
     )
 
 
-def _redact_config(value: Any) -> Any:
+def _redact_config(value: Any, depth: int = 0) -> Any:
     """Return project configuration with credential-named fields removed."""
+    if depth >= _MAX_REDACT_DEPTH:
+        return None
     if isinstance(value, str):
         return _redact_url(value)
     if isinstance(value, list):
-        return [_redact_config(item) for item in value]
+        return [_redact_config(item, depth + 1) for item in value]
     if not isinstance(value, dict):
         return copy.deepcopy(value)
     if value.get("type") in {"FeatureCollection", "Feature", "GeometryCollection"}:
         return copy.deepcopy(value)
     return {
-        key: _redact_config(nested)
+        key: _redact_config(nested, depth + 1)
         for key, nested in value.items()
         if key.lower() not in _CREDENTIAL_FIELD_NAMES
     }
@@ -125,6 +128,9 @@ def redact_credentials(project: dict[str, Any]) -> dict[str, Any]:
         geocoding = preferences.get("geocoding")
         if isinstance(geocoding, dict):
             geocoding["apiKeys"] = {}
+            for field in ("forwardEndpoint", "reverseEndpoint"):
+                if isinstance(geocoding.get(field), str):
+                    geocoding[field] = _redact_url(geocoding[field])
     layers = safe.get("layers")
     if isinstance(layers, list):
         for layer in layers:

python/tests/test_scripting.py

@@ -11,6 +11,7 @@
 
 import geolibre.geolibre as gmod
 from geolibre.geolibre import Feature, Layer, Map
+from geolibre.project import redact_credentials
 
 
 @pytest.fixture
@@ -309,6 +310,7 @@ def test_python_project_egress_redacts_credentials(m, tmp_path):
     m.project["preferences"]["geocoding"] = {
         "providerId": "mapbox",
         "apiKeys": {"mapbox": "python-geocoder-secret"},
+        "forwardEndpoint": "https://geocode.example.com?key=python-endpoint-secret",
     }
     m.project["layers"] = [
         {
@@ -341,6 +343,7 @@ def test_python_project_egress_redacts_credentials(m, tmp_path):
     for secret in (
         "python-env-secret",
         "python-geocoder-secret",
+        "python-endpoint-secret",
         "password",
         "python-url-secret",
         "python-subscription-secret",
@@ -357,6 +360,14 @@ def test_python_project_egress_redacts_credentials(m, tmp_path):
     assert m.to_project(keep_credentials=True)["plugins"]["settings"]
 
 
+def test_python_redaction_fails_closed_at_depth_limit():
+    nested = {"password": "too-deep-secret"}
+    for _ in range(12):
+        nested = {"child": nested}
+    safe = redact_credentials({"layers": [{"source": nested}]})
+    assert "too-deep-secret" not in str(safe)
+
+
 def test_to_html_writes_path(m, tmp_path):
     out = tmp_path / "nested" / "map.html"
     assert m.to_html(str(out)) is None

tests/project-credentials.test.ts

@@ -14,6 +14,8 @@ function credentialProject() {
     { key: "SERVICE_TOKEN", value: "environment-secret", enabled: true },
   ];
   project.preferences.geocoding.apiKeys = { mapbox: "geocoder-secret" };
+  project.preferences.geocoding.forwardEndpoint =
+    "https://geocode.example.com/search?key=endpoint-secret";
   project.basemapStyleUrl = "https://styles.example.com/map.json?access_token=basemap-secret";
   project.layers = [
     {
@@ -51,6 +53,7 @@ describe("project credential redaction", () => {
     for (const secret of [
       "environment-secret",
       "geocoder-secret",
+      "endpoint-secret",
       "basemap-secret",
       "password",
       "url-secret",
@@ -67,7 +70,7 @@ describe("project credential redaction", () => {
     assert.deepEqual(project.plugins?.settings, {});
     assert.ok(redactedPaths.includes("plugins.settings"));
     assert.equal(redactedPaths.includes("basemapStyleUrl"), true);
-    assert.equal(redactProjectCredentials(original).redactedCount, 8);
+    assert.equal(redactProjectCredentials(original).redactedCount, 9);
     assert.equal(original.plugins?.settings.external.arbitraryName, "plugin-secret");
   });
 
@@ -85,6 +88,27 @@ describe("project credential redaction", () => {
     assert.deepEqual(redactCredentials(once), once);
   });
 
+  it("returns detached inline GeoJSON", () => {
+    const original = credentialProject();
+    original.layers[0].source = {
+      type: "FeatureCollection",
+      features: [{ type: "Feature", geometry: null, properties: { name: "original" } }],
+    };
+    const safe = redactCredentials(original);
+    const safeSource = safe.layers[0].source as {
+      features: Array<{ properties: { name: string } }>;
+    };
+    safeSource.features[0].properties.name = "changed";
+    assert.equal(
+      (
+        original.layers[0].source as {
+          features: Array<{ properties: { name: string } }>;
+        }
+      ).features[0].properties.name,
+      "original",
+    );
+  });
+
   it("fails closed when configuration exceeds the traversal depth", () => {
     let nested: Record<string, unknown> = { arbitrary: "too-deep-secret" };
     for (let index = 0; index < 12; index += 1) nested = { child: nested };