fix(cnr): mask the session id in the secured POST body

[KaiSchwarz-cnic]

Found while setting up P8 of RSRMID-2994, and it doubles as that ticket's release trigger — a fix touching src/ is what makes semantic-release cut a version, which is what P8 needs in order to verify the release push now goes out over the deploy key.

The change stands on its own merits, though. It is not a contrived commit.

The defect

CNR\SocketConfig::getPOSTDataParams() masked s_pw but wrote s_sessionid in clear:

if (strlen($this->password) !== 0) {
    $params[$this->parameters["password"]] = $maskSecrets ? CommandRedactor::MASK : $this->password;
}
if (strlen($this->session) !== 0) {
    $params[$this->parameters["session"]] = $this->session;   // <-- not masked
}

$maskSecrets = true is the body built for debug logging. So a debug record could carry a working credential.

Why it matters more than it looks

A session id is not a lesser credential than the password but an alternative to it. setSession() says so itself, and enforces it:

// Always clears the stored password — a session and a password are alternative
// credentials on the wire and the newer one is authoritative.
public function setSession(string $session = ""): static
{
    $this->session = $session;
    $this->password = "";

So the gap opened precisely where it mattered. On the persistent-session path there is no password left to mask, and what the masked body contained was s_login + s_sessionid — everything needed to authenticate. Masking the password while logging the session defeated the masking on the one path where masking was the only thing left.

Scope

IBS/MONIKER are unaffected — they have no session parameter.

Tests

testGetPostDataSecuredMasksSession() asserts with a login present, which is the shape the fix is about, and pins the absence of the raw value rather than only the expected string.

No existing test changes:

• the other masked-path assertions (ClientTest::testGetPostDataSecured, testGetPostDataSecuredMasksAuth, CNR\LoggerTest) set credentials rather than a session, so none of them covered this
• the three tests that do assert an unmasked s_sessionid call getPOSTData() on the default unmasked path — that is the real request body and still has to carry the real value

I could not run the suite locally: the workspace devcontainer installs no language runtimes by design, so there is no PHP here. Static checks I did make: CommandRedactor was already imported, the new line is shorter than the s_pw line beside it, and both sides of the assertion go through http_build_query.

Note

If you would rather this had its own issue rather than riding on RSRMID-2994's branch prefix, say so and I will move it.

🤖 Generated with Claude Code

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 99.90%. Comparing base (51a0475) to head (cb0ef62).
⚠️ Report is 1 commits behind head on master.

Additional details and impacted files

@@            Coverage Diff            @@
##             master     #327   +/-   ##
=========================================
  Coverage     99.90%   99.90%           
- Complexity      469      470    +1     
=========================================
  Files            32       32           
  Lines          1065     1065           
=========================================
  Hits           1064     1064           
  Misses            1        1           

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[KaiSchwarz-cnic]

🎉 This PR is included in version 33.0.3 🎉

The release is available on GitHub release

Your semantic-release bot 📦🚀