From 12ab8b3437b3ff7dc3bdb0a423c4b26b99b486ec Mon Sep 17 00:00:00 2001
From: alejandrobailo <alejandrobailo94@gmail.com>
Date: Tue, 21 Jul 2026 18:26:14 +0200
Subject: [PATCH] fix(ui): filter sensitive Lighthouse context values

---
 ui/lib/lighthouse/context/contributions.test.ts |  3 +++
 ui/lib/lighthouse/context/contributions.ts      | 12 ++++++++++--
 ui/lib/lighthouse/context/pages.test.ts         | 15 +++++++++++++++
 ui/lib/lighthouse/context/pages.ts              | 12 +++++++++---
 4 files changed, 37 insertions(+), 5 deletions(-)

diff --git a/ui/lib/lighthouse/context/contributions.test.ts b/ui/lib/lighthouse/context/contributions.test.ts
index 26ec90ad31..4e5ad7b39b 100644
--- a/ui/lib/lighthouse/context/contributions.test.ts
+++ b/ui/lib/lighthouse/context/contributions.test.ts
@@ -154,6 +154,9 @@ describe("Lighthouse page contributions", () => {
           includeMuted: false,
           password: "do-not-send",
           query: "MATCH (n) RETURN n",
+          ownerEmail: "security@example.com",
+          sourceIp: "10.0.0.1",
+          authHeader: "Bearer sensitive-value",
         },
         nodeCount: 12,
         edgeCount: 15,
diff --git a/ui/lib/lighthouse/context/contributions.ts b/ui/lib/lighthouse/context/contributions.ts
index 0110b77495..064b2761d8 100644
--- a/ui/lib/lighthouse/context/contributions.ts
+++ b/ui/lib/lighthouse/context/contributions.ts
@@ -10,7 +10,10 @@ import {
   type LighthouseScanContextItem,
 } from "@/types/lighthouse-context";
 
-import { getLighthouseScopeKey } from "./pages";
+import {
+  containsSensitiveLighthouseContextValue,
+  getLighthouseScopeKey,
+} from "./pages";
 
 const FINDINGS_SCOPE_KEY = getLighthouseScopeKey("/findings");
 const RESOURCES_SCOPE_KEY = getLighthouseScopeKey("/resources");
@@ -315,7 +318,12 @@ function sanitizeAttackPathParameters(
     Object.entries(parameters)
       .filter(
         ([key, value]) =>
-          !/password|secret|token|credential|query/i.test(key) && value !== "",
+          !/password|secret|token|credential|query/i.test(key) &&
+          value !== "" &&
+          !(
+            typeof value === "string" &&
+            containsSensitiveLighthouseContextValue(value)
+          ),
       )
       .slice(0, 8)
       .map(([key, value]) => [
diff --git a/ui/lib/lighthouse/context/pages.test.ts b/ui/lib/lighthouse/context/pages.test.ts
index b444d06192..24f2a335df 100644
--- a/ui/lib/lighthouse/context/pages.test.ts
+++ b/ui/lib/lighthouse/context/pages.test.ts
@@ -125,4 +125,19 @@ describe("buildLighthousePageContext", () => {
     });
     expect(providers.filters).toEqual({ connected: ["true"] });
   });
+
+  it("should discard sensitive values from allowed search parameters", () => {
+    // Given
+    const searchParams = new URLSearchParams();
+    searchParams.append("filter[search]", "security@example.com");
+    searchParams.append("filter[search]", "10.0.0.1");
+    searchParams.append("filter[search]", "Bearer sensitive-value");
+    searchParams.append("filter[search]", "public bucket");
+
+    // When
+    const context = buildLighthousePageContext("/findings", searchParams);
+
+    // Then
+    expect(context.filters).toEqual({ search: ["public bucket"] });
+  });
 });
diff --git a/ui/lib/lighthouse/context/pages.ts b/ui/lib/lighthouse/context/pages.ts
index f96e440b91..420d78fe90 100644
--- a/ui/lib/lighthouse/context/pages.ts
+++ b/ui/lib/lighthouse/context/pages.ts
@@ -311,7 +311,10 @@ function buildFilters(
       .getAll(param)
       .flatMap((value) => value.split(","))
       .map((value) => value.trim())
-      .filter((value) => value.length > 0 && !containsSensitiveValue(value))
+      .filter(
+        (value) =>
+          value.length > 0 && !containsSensitiveLighthouseContextValue(value),
+      )
       .map((value) => value.slice(0, 256))
       .slice(0, remainingValues);
     if (values.length === 0) continue;
@@ -333,12 +336,15 @@ function toContextFilterKey(param: string): string {
   return param.slice(7, -1).replace(/__in$/, "");
 }
 
-function containsSensitiveValue(value: string): boolean {
+export function containsSensitiveLighthouseContextValue(
+  value: string,
+): boolean {
   return (
     /\b[^\s@]+@[^\s@]+\.[^\s@]+\b/.test(value) ||
     /\b(?:\d{1,3}\.){3}\d{1,3}\b/.test(value) ||
     /\bAKIA[A-Z0-9]{16}\b/.test(value) ||
-    /\b(?:bearer|password|secret|token)\s*[:=]/i.test(value)
+    /\bbearer\s+\S+/i.test(value) ||
+    /\b(?:password|secret|token|credential)\s*[:=]/i.test(value)
   );
 }