From c3e2b988c23a7b8d3b03a62b428017f347fb7006 Mon Sep 17 00:00:00 2001 From: Tobias Werth Date: Mon, 14 Nov 2022 14:04:33 -0500 Subject: [PATCH] redact 'token' strings from logging (#16764) It's common for users to set 'TOKEN' as an env var. While this is a little like whack-a-mole and we can't cover everything, this seems like a common string to redact. Closes #16622. PiperOrigin-RevId: 488392632 Change-Id: I7b48199cc140d6736cd145df63e03eeda747c7fb (cherry picked from commit 1940c5d68136ce2079efa8ff74d4e5fdf63ee3e6) Co-authored-by: Matt Mackay --- .../devtools/build/lib/runtime/SafeRequestLogging.java | 5 +++-- .../build/lib/runtime/SafeRequestLoggingTest.java | 10 ++++++++++ 2 files changed, 13 insertions(+), 2 deletions(-) diff --git a/src/main/java/com/google/devtools/build/lib/runtime/SafeRequestLogging.java b/src/main/java/com/google/devtools/build/lib/runtime/SafeRequestLogging.java index 0b75d5f0a1a8fb..3d8adb07c5f16a 100644 --- a/src/main/java/com/google/devtools/build/lib/runtime/SafeRequestLogging.java +++ b/src/main/java/com/google/devtools/build/lib/runtime/SafeRequestLogging.java @@ -21,14 +21,15 @@ /** Utils for logging safely user commandlines. */ public class SafeRequestLogging { private static final Pattern suppressFromLog = - Pattern.compile("--client_env=([^=]*(?:auth|pass|cookie)[^=]*)=", Pattern.CASE_INSENSITIVE); + Pattern.compile( + "--client_env=([^=]*(?:auth|pass|cookie|token)[^=]*)=", Pattern.CASE_INSENSITIVE); private SafeRequestLogging() {} /** * Generates a string form of a request to be written to the logs, filtering the user environment * to remove anything that looks private. The current filter criteria removes any variable whose - * name includes "auth", "pass", or "cookie". + * name includes "auth", "pass", "cookie" or "token". * * @return the filtered request to write to the log. */ diff --git a/src/test/java/com/google/devtools/build/lib/runtime/SafeRequestLoggingTest.java b/src/test/java/com/google/devtools/build/lib/runtime/SafeRequestLoggingTest.java index d9334ebd6f0608..5838ef0c46cb61 100644 --- a/src/test/java/com/google/devtools/build/lib/runtime/SafeRequestLoggingTest.java +++ b/src/test/java/com/google/devtools/build/lib/runtime/SafeRequestLoggingTest.java @@ -69,6 +69,16 @@ public void testGetRequestLogStringStripsApparentPasswordValues() { "[--client_env=dont_paSS_ME=__private_value_removed__, --client_env=other=isprinted]"); } + @Test + public void testGetRequestLogStringStripsApparentTokenValues() { + assertThat( + SafeRequestLogging.getRequestLogString( + ImmutableList.of( + "--client_env=service_ToKEn=notprinted", "--client_env=other=isprinted"))) + .isEqualTo( + "[--client_env=service_ToKEn=__private_value_removed__, --client_env=other=isprinted]"); + } + @Test public void testGetRequestLogIgnoresSensitiveTermsInValues() { assertThat(SafeRequestLogging.getRequestLogString(ImmutableList.of("--client_env=ok=COOKIE")))