34 lines
1.7 KiB
TypeScript
34 lines
1.7 KiB
TypeScript
export const REDACTED = "[REDACTED]";
|
|
|
|
// scheme://user:password@host — only redacts when a password is present, so
|
|
// ordinary URLs (with or without a userinfo) are left untouched.
|
|
const URL_CREDENTIALS = /\b([a-z][a-z0-9+.-]*:\/\/)[^/\s@]+:[^/\s@]*@/gi;
|
|
|
|
// AWS access key ID (AKIA prefix + 16 uppercase alphanumeric chars).
|
|
const AWS_ACCESS_KEY_ID = /\bAKIA[0-9A-Z]{16}\b/g;
|
|
|
|
// OpenSSH and other PEM private key headers embedded anywhere in a string.
|
|
const PRIVATE_KEY_HEADER = /-----BEGIN [A-Z ]*PRIVATE KEY-----/g;
|
|
|
|
// Secret-bearing environment assignments are commonly included in provider
|
|
// and command error messages (for example, DB_PASSWORD=...).
|
|
const SECRET_ASSIGNMENT =
|
|
/\b([A-Z][A-Z0-9_]*(?:PASSWORD|PASSWD|TOKEN|SECRET|CREDENTIAL|PRIVATE_KEY|ACCESS_KEY|CONNECTION_STRING|DATABASE_URL)[A-Z0-9_]*)\s*[=:]\s*([^\s,;\]}]+)/gi;
|
|
const SECRET_FIELD =
|
|
/(["']?(?:password|passwd|token|secret|credential|privateKey|accessKey|connectionString|databaseUrl)["']?\s*:\s*["']?)([^"'\s,}\]]+)/gi;
|
|
const SECRET_DATA =
|
|
/((?:["'](?:kind|type)["']\s*:\s*["'](?:Secret|secret)["'][\s\S]{0,1000}?["'](?:data|stringData)["']\s*:\s*)\{[^{}]*\})/gi;
|
|
|
|
/** Redact common credential-bearing substrings while leaving everything else intact. */
|
|
export function redactString(value: string): string {
|
|
return value
|
|
.replace(AWS_ACCESS_KEY_ID, REDACTED)
|
|
.replace(PRIVATE_KEY_HEADER, REDACTED)
|
|
.replace(SECRET_ASSIGNMENT, (_match, key) => `${key}=${REDACTED}`)
|
|
.replace(SECRET_FIELD, (_match, prefix) => `${prefix}${REDACTED}`)
|
|
.replace(SECRET_DATA, (_match, prefix) =>
|
|
prefix.replace(/\{[^{}]*\}$/, `{${REDACTED}}`),
|
|
)
|
|
.replace(URL_CREDENTIALS, (_match, scheme) => `${scheme}${REDACTED}@`);
|
|
}
|