fix(ui): filter sensitive Lighthouse context values

ui/lib/lighthouse/context/contributions.test.ts

@@ -154,6 +154,9 @@ describe("Lighthouse page contributions", () => {
           includeMuted: false,
           password: "do-not-send",
           query: "MATCH (n) RETURN n",
+          ownerEmail: "security@example.com",
+          sourceIp: "10.0.0.1",
+          authHeader: "Bearer sensitive-value",
         },
         nodeCount: 12,
         edgeCount: 15,

ui/lib/lighthouse/context/contributions.ts

@@ -10,7 +10,10 @@ import {
   type LighthouseScanContextItem,
 } from "@/types/lighthouse-context";
 
-import { getLighthouseScopeKey } from "./pages";
+import {
+  containsSensitiveLighthouseContextValue,
+  getLighthouseScopeKey,
+} from "./pages";
 
 const FINDINGS_SCOPE_KEY = getLighthouseScopeKey("/findings");
 const RESOURCES_SCOPE_KEY = getLighthouseScopeKey("/resources");
@@ -315,7 +318,12 @@ function sanitizeAttackPathParameters(
     Object.entries(parameters)
       .filter(
         ([key, value]) =>
-          !/password|secret|token|credential|query/i.test(key) && value !== "",
+          !/password|secret|token|credential|query/i.test(key) &&
+          value !== "" &&
+          !(
+            typeof value === "string" &&
+            containsSensitiveLighthouseContextValue(value)
+          ),
       )
       .slice(0, 8)
       .map(([key, value]) => [

ui/lib/lighthouse/context/pages.test.ts

@@ -125,4 +125,19 @@ describe("buildLighthousePageContext", () => {
     });
     expect(providers.filters).toEqual({ connected: ["true"] });
   });
+
+  it("should discard sensitive values from allowed search parameters", () => {
+    // Given
+    const searchParams = new URLSearchParams();
+    searchParams.append("filter[search]", "security@example.com");
+    searchParams.append("filter[search]", "10.0.0.1");
+    searchParams.append("filter[search]", "Bearer sensitive-value");
+    searchParams.append("filter[search]", "public bucket");
+
+    // When
+    const context = buildLighthousePageContext("/findings", searchParams);
+
+    // Then
+    expect(context.filters).toEqual({ search: ["public bucket"] });
+  });
 });

ui/lib/lighthouse/context/pages.ts

@@ -311,7 +311,10 @@ function buildFilters(
       .getAll(param)
       .flatMap((value) => value.split(","))
       .map((value) => value.trim())
-      .filter((value) => value.length > 0 && !containsSensitiveValue(value))
+      .filter(
+        (value) =>
+          value.length > 0 && !containsSensitiveLighthouseContextValue(value),
+      )
       .map((value) => value.slice(0, 256))
       .slice(0, remainingValues);
     if (values.length === 0) continue;
@@ -333,12 +336,15 @@ function toContextFilterKey(param: string): string {
   return param.slice(7, -1).replace(/__in$/, "");
 }
 
-function containsSensitiveValue(value: string): boolean {
+export function containsSensitiveLighthouseContextValue(
+  value: string,
+): boolean {
   return (
     /\b[^\s@]+@[^\s@]+\.[^\s@]+\b/.test(value) ||
     /\b(?:\d{1,3}\.){3}\d{1,3}\b/.test(value) ||
     /\bAKIA[A-Z0-9]{16}\b/.test(value) ||
-    /\b(?:bearer|password|secret|token)\s*[:=]/i.test(value)
+    /\bbearer\s+\S+/i.test(value) ||
+    /\b(?:password|secret|token|credential)\s*[:=]/i.test(value)
   );
 }