Security Hardening: Remove word boundary matching for scrubbing secrets from web hook diagnostic output.

Author: jhuckaby

lib/action.js

@@ -1431,10 +1431,10 @@ class Actions {
 		// try to scrub secrets from output details (best effort)
 		var scrubSecrets = null;
 		if (data.secrets && Tools.firstKey(data.secrets)) {
-			var sec_re = new RegExp( "\\b(" + 
+			var sec_re = new RegExp( "(" + 
 				Object.values(data.secrets).map( sec => Tools.escapeRegExp(sec) ).join('|') + '|' + 
 				Object.values(data.secrets).map( sec => Tools.escapeRegExp( encodeURIComponent(sec) ) ).join('|') + 
-				")\\b", 'g' );
+				")", 'g' );
 			scrubSecrets = function(value) { return String(value).replace( sec_re, '(REDACTED)' ); }
 		}
 		else {