fix: validate entire cookie assignment values

Only nested-parse Cookie: name=value headers. cookie=opaque-production-secret=fixture is rejected as a whole RHS.

Author: ericjuta

packages/evals/__tests__/sanitize.test.ts

@@ -193,6 +193,14 @@ describe("public eval text detection", () => {
     assert.includeMembers(kinds, ["header-credential"]);
   });
 
+  it("rejects a cookie assignment whose entire RHS is not synthetic", () => {
+    const kinds = findPublicTextViolations("cookie=opaque-production-secret=fixture").map(
+      ({ kind }) => kind,
+    );
+
+    assert.includeMembers(kinds, ["header-credential", "secret-assignment"]);
+  });
+
   it("allows negative prose and explicitly synthetic fixture values", () => {
     const text = [
       "tokenCount=3",

packages/evals/src/sanitize.ts

@@ -180,11 +180,7 @@ const isExplicitSyntheticCredential = (value: string): boolean => {
 
 const isExplicitSyntheticHeaderCredential = (match: RegExpExecArray, value: string): boolean => {
   const header = match[0].toLowerCase();
-  if (
-    header.startsWith("cookie") ||
-    header.startsWith("set-cookie") ||
-    header.startsWith("set_cookie")
-  ) {
+  if (/^(?:set[-_])?cookie\s*:/.test(header)) {
     const assignmentIndex = value.indexOf("=");
     if (assignmentIndex !== -1) {
       return isExplicitSyntheticCredential(value.slice(assignmentIndex + 1));