Redact potentially sensitive information from error objects #76
+639
−56
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,53 @@ | ||
| /* | ||
| * Licensed to Elasticsearch B.V. under one or more contributor | ||
| * license agreements. See the NOTICE file distributed with | ||
| * this work for additional information regarding copyright | ||
| * ownership. Elasticsearch B.V. licenses this file to you under | ||
| * the Apache License, Version 2.0 (the "License"); you may | ||
| * not use this file except in compliance with the License. | ||
| * You may obtain a copy of the License at | ||
| * | ||
| * http://www.apache.org/licenses/LICENSE-2.0 | ||
| * | ||
| * Unless required by applicable law or agreed to in writing, | ||
| * software distributed under the License is distributed on an | ||
| * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY | ||
| * KIND, either express or implied. See the License for the | ||
| * specific language governing permissions and limitations | ||
| * under the License. | ||
| */ | ||
|
|
||
| import traverse from 'traverse' | ||
|
|
||
| const secretKeys = [ | ||
| 'authorization', | ||
| 'password', | ||
| 'apikey', | ||
| 'x-elastic-app-auth' | ||
| ] | ||
|
|
||
| /** | ||
| * Clones an object and recursively loops through all keys, redacting their values if the key matches any of a list of strings. | ||
| * @param obj: Object to clone and redact | ||
| * @param additionalKeys: Extra keys that can be matched for redaction. Does not overwrite the default set. | ||
| */ | ||
| export function redactObject (obj: Record<string, any>, additionalKeys: string[] = []): Record<string, any> { | ||
| const toRedact = [...secretKeys, ...additionalKeys].map(key => key.toLowerCase()) | ||
| return traverse(obj) | ||
|
There was a problem hiding this comment.
It was proposed that we could use |
||
| // ts-standard thinks this is Array.prototype.map but it isn't | ||
| .map(function (node) { // eslint-disable-line array-callback-return | ||
| // represent URLs as strings with no username/password | ||
| // @ts-expect-error current typedef for `pre` is inaccurate | ||
| this.pre(function (childNode, key) { | ||
| if (childNode instanceof URL) { | ||
| node[key] = `${childNode.origin}${childNode.pathname}${childNode.search}` | ||
| } | ||
| }) | ||
|
|
||
| if (this.circular !== null && this.circular !== undefined) { | ||
| this.remove() | ||
| } else if (this.key !== undefined && toRedact.includes(this.key.toLowerCase())) { | ||
| this.update('[redacted]') | ||
| } | ||
| }) | ||
| } | ||
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,173 @@ | ||
| /* | ||
| * Licensed to Elasticsearch B.V. under one or more contributor | ||
| * license agreements. See the NOTICE file distributed with | ||
| * this work for additional information regarding copyright | ||
| * ownership. Elasticsearch B.V. licenses this file to you under | ||
| * the Apache License, Version 2.0 (the "License"); you may | ||
| * not use this file except in compliance with the License. | ||
| * You may obtain a copy of the License at | ||
| * | ||
| * http://www.apache.org/licenses/LICENSE-2.0 | ||
| * | ||
| * Unless required by applicable law or agreed to in writing, | ||
| * software distributed under the License is distributed on an | ||
| * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY | ||
| * KIND, either express or implied. See the License for the | ||
| * specific language governing permissions and limitations | ||
| * under the License. | ||
| */ | ||
|
|
||
| import { test } from 'tap' | ||
| import { inspect } from 'node:util' | ||
| import { errors, DiagnosticResult } from '../../' | ||
| import { HttpConnection, UndiciConnection } from '../../' | ||
|
|
||
| const theSecret = '**foo-bar-baz-bat**' | ||
|
|
||
| function makeDiagnostics(): DiagnosticResult[] { | ||
| const diagnosticBase: DiagnosticResult = { | ||
| headers: { | ||
| 'accept': 'text/plain', | ||
| 'authorization': theSecret, | ||
| }, | ||
| warnings: null, | ||
| meta: { | ||
| context: '', | ||
| name: 'foo', | ||
| request: { | ||
| params: { | ||
| method: 'get', | ||
| path: '/', | ||
| headers: { | ||
| authorization: theSecret, | ||
| } | ||
| }, | ||
| options: { | ||
| headers: { | ||
| authorization: theSecret, | ||
| } | ||
| }, | ||
| id: 'foo', | ||
| }, | ||
| connection: null, | ||
| attempts: 1, | ||
| aborted: false | ||
| } | ||
| } | ||
|
|
||
| const diagnostics: DiagnosticResult[] = [] | ||
| diagnostics.push(diagnosticBase) | ||
|
|
||
| const classes = [HttpConnection, UndiciConnection] | ||
| const auths = [ | ||
| { username: 'elastic', password: theSecret }, | ||
| { apiKey: theSecret }, | ||
| { apiKey: { id: theSecret, api_key: theSecret }}, | ||
| { bearer: theSecret }, | ||
| ] | ||
|
|
||
| classes.forEach(Conn => { | ||
| auths.forEach(auth => { | ||
| const diag = structuredClone(diagnosticBase) | ||
| diag.meta.connection = new Conn({ | ||
| url: new URL(`http://user:${theSecret}@www.foo.com`), | ||
| auth, | ||
| }) | ||
| diagnostics.push(diag) | ||
| }) | ||
| }) | ||
|
|
||
| return diagnostics | ||
|
|
||
| // TODO: figure out which of these could also contain secrets | ||
| // auth?: BasicAuth | ApiKeyAuth | BearerAuth; | ||
| // diagnostic?: Diagnostic; | ||
| // timeout?: number; | ||
| // agent?: HttpAgentOptions | UndiciAgentOptions | agentFn | boolean; | ||
| // proxy?: string | URL; | ||
| // caFingerprint?: string; | ||
| } | ||
|
|
||
| test('redact sensitive data when logging a TimeoutError', t => { | ||
| const diags = makeDiagnostics() | ||
|
|
||
| diags.forEach(diag => { | ||
| const err = new errors.TimeoutError('err', diag) | ||
| t.notMatch(inspect(err), theSecret, 'TimeoutError should redact sensitive data') | ||
| t.notMatch(inspect(err.meta), theSecret, 'TimeoutError should redact sensitive data') | ||
| t.notMatch(JSON.stringify(err.meta ?? ''), theSecret) | ||
| t.notMatch(err.meta?.toString(), theSecret) | ||
| }) | ||
|
|
||
| t.end() | ||
| }) | ||
|
|
||
| test('redact sensitive data when logging a ConnectionError', t => { | ||
| const diags = makeDiagnostics() | ||
|
|
||
| diags.forEach(diag => { | ||
| const err = new errors.ConnectionError('err', diag) | ||
| t.notMatch(inspect(err), theSecret, 'ConnectionError should redact sensitive data') | ||
| t.notMatch(inspect(err.meta), theSecret, 'ConnectionError should redact sensitive data') | ||
| t.notMatch(JSON.stringify(err.meta ?? ''), theSecret) | ||
| t.notMatch(err.meta?.toString(), theSecret) | ||
| }) | ||
|
|
||
| t.end() | ||
| }) | ||
|
|
||
| test('redact sensitive data when logging a NoLivingConnectionsError', t => { | ||
| const diags = makeDiagnostics() | ||
|
|
||
| diags.forEach(diag => { | ||
| const err = new errors.NoLivingConnectionsError('err', diag) | ||
| t.notMatch(inspect(err), theSecret, 'NoLivingConnectionsError should redact sensitive data') | ||
| t.notMatch(inspect(err.meta), theSecret, 'NoLivingConnectionsError should redact sensitive data') | ||
| t.notMatch(JSON.stringify(err.meta ?? ''), theSecret) | ||
| t.notMatch(err.meta?.toString(), theSecret) | ||
| }) | ||
|
|
||
| t.end() | ||
| }) | ||
|
|
||
| test('redact sensitive data when logging a ResponseError', t => { | ||
| const diags = makeDiagnostics() | ||
|
|
||
| diags.forEach(diag => { | ||
| const err = new errors.ResponseError(diag) | ||
| t.notMatch(inspect(err), theSecret, 'ResponseError should redact sensitive data') | ||
| t.notMatch(inspect(err.meta), theSecret, 'ResponseError should redact sensitive data') | ||
| t.notMatch(JSON.stringify(err.meta ?? ''), theSecret) | ||
| t.notMatch(err.meta?.toString(), theSecret) | ||
| }) | ||
|
|
||
| t.end() | ||
| }) | ||
|
|
||
| test('redact sensitive data when logging a RequestAbortedError', t => { | ||
| const diags = makeDiagnostics() | ||
|
|
||
| diags.forEach(diag => { | ||
| const err = new errors.RequestAbortedError('err', diag) | ||
| t.notMatch(inspect(err), theSecret, 'RequestAbortedError should redact sensitive data') | ||
| t.notMatch(inspect(err.meta), theSecret, 'RequestAbortedError should redact sensitive data') | ||
| t.notMatch(JSON.stringify(err.meta ?? ''), theSecret) | ||
| t.notMatch(err.meta?.toString(), theSecret) | ||
| }) | ||
|
|
||
| t.end() | ||
| }) | ||
|
|
||
| test('redact sensitive data when logging a ProductNotSupportedError', t => { | ||
| const diags = makeDiagnostics() | ||
|
|
||
| diags.forEach(diag => { | ||
| const err = new errors.ProductNotSupportedError('err', diag) | ||
| t.notMatch(inspect(err), theSecret, 'ProductNotSupportedError should redact sensitive data') | ||
| t.notMatch(inspect(err.meta), theSecret, 'ProductNotSupportedError should redact sensitive data') | ||
| t.notMatch(JSON.stringify(err.meta ?? ''), theSecret) | ||
| t.notMatch(err.meta?.toString(), theSecret) | ||
| }) | ||
|
|
||
| t.end() | ||
| }) |
Oops, something went wrong.
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Can a user customize this list?