[Huge]

Summary

When OAuth2::AccessToken.new is initialized without token or refresh token values and @client.options[:raise_errors] is true, OAuth2::AccessToken#initialize raises OAuth2::Error with error_description: "Options are: #{opts.inspect}".

At this point, opts retains unconsumed response parameters from the token endpoint (such as OpenID Connect id_token JWTs, client credentials, or alternative token values). When the exception is logged or inspected by application error trackers, these sensitive values are serialized into the exception message.

Changes

• Added sanitize_opts and sensitive_opts_key? to sanitize opts before inspecting them in OAuth2::Error.
• Replaced values of sensitive keys (id_token, client_secret, password, assertion, token aliases) with [FILTERED] (using OAuth2::AUTH_SANITIZER.filtered_label).
• Added regression specs in spec/oauth2/access_token_spec.rb verifying that sensitive parameters in opts are redacted and not exposed in the error message.

---

Vulnerability identified by BudgetScan static analysis.

[pboling]

@Huge This is pretty good. I'm releasing a new auth-sanitizer that will have a tool you can use to simplify this.

Auth::Sanitizer.sanitize(value, filtered_keys:, label:)

ruby-oauth/auth-sanitizer#27

Also - I have the CI issues resolved separately. I'll have that into main shortly as well.

[Huge]

Thanks @pboling for the quick review, merge, and for adding the sanitizer helper in auth-sanitizer#27! Really appreciate it.