fix(security): quoted local-part email mask — strip delimiter quotes, split on last @ (DC-109) [glm-grade=A]

2026-08-23 07:28:10 -07:00
parent c429b8fdd7
commit 9322831f1b
3 changed files with 50 additions and 3 deletions
@@ -242,7 +242,9 @@ describe('DC-095 round 2: adversarial judge findings', () => {
    const out = consoleOut();
    expect(out).not.toContain('john doe');
    expect(out).not.toContain('"john doe"@example.com');
-    expect(out).toContain('****@example.com');
+    // DC-109: delimiter quotes are syntax, not PII — strip, never re-emit.
+    expect(out).toContain('jo****@example.com'); // 2 REAL local chars, canonical shape
+    expect(out).not.toMatch(/["']j\*{4}/); // old bug: stray quote among the 2 chars
  });

  test('class instance enumerable email prop masked, prototype preserved', () => {