fix(logging): avoid raw parser input in diagnostics

Previously, malformed GraphQL chunk-size errors included untrusted request data,
and no regression test ensured that unclassified Network Activity failures did
not push raw parser messages to the gateway.

Now, GraphQL chunk-size errors omit the untrusted token, and the log-push
regression test verifies that raw parser messages remain suppressed.

Signed-off-by: Kris Hicks <khicks@nvidia.com>

Author: krishicks

crates/openshell-supervisor-network/src/l7/graphql.rs

@@ -498,7 +498,7 @@ async fn read_chunked_body_for_inspection<C: AsyncRead + Unpin>(
             .unwrap_or_default();
         let chunk_size = usize::from_str_radix(size_token, 16)
             .into_diagnostic()
-            .map_err(|_| miette!("Invalid GraphQL chunk size token: {size_token:?}"))?;
+            .map_err(|_| miette!("Invalid GraphQL chunk size token"))?;
         pos = size_line_end + 2;
 
         if decoded.len().saturating_add(chunk_size) > max_body_bytes {
@@ -734,6 +734,31 @@ mod tests {
         assert!(req.raw_header.ends_with(body));
     }
 
+    #[tokio::test]
+    async fn invalid_chunk_size_does_not_echo_request_data() {
+        let sentinel = "graphql-chunk-secret";
+        let mut req = L7Request {
+            action: "POST".to_string(),
+            target: "/graphql".to_string(),
+            query_params: HashMap::new(),
+            raw_header: format!(
+                "POST /graphql HTTP/1.1\r\nHost: example.com\r\nTransfer-Encoding: chunked\r\n\r\n{sentinel}\r\n"
+            )
+            .into_bytes(),
+            body_length: BodyLength::Chunked,
+        };
+        let error =
+            inspect_graphql_request(&mut tokio::io::empty(), &mut req, DEFAULT_MAX_BODY_BYTES)
+                .await
+                .expect_err("invalid chunk size must be rejected");
+        assert!(
+            error
+                .to_string()
+                .contains("Invalid GraphQL chunk size token")
+        );
+        assert!(!error.to_string().contains(sentinel));
+    }
+
     #[tokio::test]
     async fn absolute_form_chunked_graphql_post_classifies_after_inspection() {
         let body = br#"{"query":"query Viewer { viewer { login } }"}"#;

crates/openshell-supervisor-process/src/log_push.rs

@@ -378,6 +378,23 @@ mod tests {
         assert!(line.event_time.is_some());
     }
 
+    #[test]
+    fn unclassified_network_failures_do_not_push_raw_messages() {
+        let sentinel = "raw-parser-secret";
+        let event = NetworkActivityBuilder::new(&ocsf_ctx())
+            .activity(ActivityId::Fail)
+            .severity(SeverityId::Medium)
+            .status(StatusId::Failure)
+            .dst_endpoint(Endpoint::from_domain("example.com", 443))
+            .message(format!("parser failed: {sentinel}"))
+            .build();
+
+        let lines = capture(16, || ocsf_emit!(event));
+
+        assert_eq!(lines.len(), 1);
+        assert!(!lines[0].message.contains(sentinel), "{:?}", lines[0]);
+    }
+
     #[test]
     fn non_ocsf_events_use_visitor_extraction() {
         let lines = capture(16, || {