| 1 | package apperr |
| 2 | |
| 3 | import ( |
| 4 | "regexp" |
| 5 | "strings" |
| 6 | ) |
| 7 | |
| 8 | // Sanitisation is a floor, not a guarantee (spec §3.1): the patterns below |
| 9 | // catch what secrets look like in practice — addresses, bearer tokens, |
| 10 | // key=value credentials, long opaque runs — before anything is buffered. |
| 11 | var ( |
| 12 | reEmail = regexp.MustCompile(`[A-Za-z0-9._%+-]+@[A-Za-z0-9.-]+\.[A-Za-z]{2,}`) |
| 13 | reAuth = regexp.MustCompile(`(?i)\b(bearer|basic)\s+[A-Za-z0-9._~+/=-]+`) |
| 14 | // key=value and "key": "value" shapes, value up to the next delimiter. |
| 15 | reKV = regexp.MustCompile(`(?i)\b(token|key|secret|password|passwd|pwd|api_key|apikey|access_token|auth)("?\s*[=:]\s*"?)[^\s&"',;]+`) |
| 16 | // reLongCandidate finds runs of 32+ characters that COULD be a |
| 17 | // redacted secret: a digest, a token, a base64 blob. It deliberately |
| 18 | // over-matches — an absolute path (/app/node_modules/.../index) and a |
| 19 | // long camelCase identifier both fit this shape — because |
| 20 | // looksLikeSecretToken, not the regex, decides what actually gets |
| 21 | // redacted. |
| 22 | reLongCandidate = regexp.MustCompile(`\b[A-Za-z0-9+/_-]{32,}={0,2}`) |
| 23 | // reHexOnly is a candidate that is nothing but hex digits: a digest. |
| 24 | reHexOnly = regexp.MustCompile(`^[0-9a-fA-F]{32,}$`) |
| 25 | ) |
| 26 | |
| 27 | // looksLikeSecretToken reports whether a run already matched by |
| 28 | // reLongCandidate actually looks like a hex digest or a base64 blob, |
| 29 | // rather than an ordinary path or a long identifier. A hex digest is all |
| 30 | // [0-9a-fA-F]. A base64 blob either mixes a digit, an upper-case letter |
| 31 | // and a lower-case letter, or carries a base64-only character (+ or the = |
| 32 | // padding) — a bare / is treated as a base64 signal only when the token |
| 33 | // has no "." and is not itself a path segment, since both a |
| 34 | // node_modules path segment and an absolute path contain "/" without |
| 35 | // being base64. precededBySlash is true when the character immediately |
| 36 | // before the match in the original string is "/": \b never matches |
| 37 | // between two non-word characters, so an absolute path's candidate token |
| 38 | // starts right after its leading "/", not with it — precededBySlash is |
| 39 | // how the caller hands back the "starts with /" signal the regex itself |
| 40 | // can't capture. |
| 41 | func looksLikeSecretToken(tok string, precededBySlash bool) bool { |
| 42 | if reHexOnly.MatchString(tok) { |
| 43 | return true |
| 44 | } |
| 45 | hasDigit := strings.ContainsAny(tok, "0123456789") |
| 46 | hasUpper := strings.ContainsAny(tok, "ABCDEFGHIJKLMNOPQRSTUVWXYZ") |
| 47 | hasLower := strings.ContainsAny(tok, "abcdefghijklmnopqrstuvwxyz") |
| 48 | if hasDigit && hasUpper && hasLower { |
| 49 | return true |
| 50 | } |
| 51 | if strings.ContainsAny(tok, "+=") { |
| 52 | return true |
| 53 | } |
| 54 | if strings.Contains(tok, "/") && !strings.Contains(tok, ".") && !precededBySlash { |
| 55 | return true |
| 56 | } |
| 57 | return false |
| 58 | } |
| 59 | |
| 60 | // Sanitize redacts secrets in free text: messages, stacks, field values. |
| 61 | func Sanitize(s string) string { |
| 62 | s = reEmail.ReplaceAllString(s, "<email>") |
| 63 | s = reAuth.ReplaceAllStringFunc(s, func(m string) string { |
| 64 | word := m[:strings.IndexAny(m, " \t")] |
| 65 | return word + " <redacted>" |
| 66 | }) |
| 67 | s = reKV.ReplaceAllString(s, "${1}${2}<redacted>") |
| 68 | s = redactLongTokens(s) |
| 69 | return s |
| 70 | } |
| 71 | |
| 72 | // redactLongTokens replaces each reLongCandidate match that |
| 73 | // looksLikeSecretToken accepts with "<hex>", leaving the rest — an |
| 74 | // ordinary path or identifier — untouched. It walks matches by index |
| 75 | // (rather than ReplaceAllStringFunc) because looksLikeSecretToken needs |
| 76 | // to see the byte before the match to tell a path segment from a base64 |
| 77 | // blob. |
| 78 | func redactLongTokens(s string) string { |
| 79 | idxs := reLongCandidate.FindAllStringIndex(s, -1) |
| 80 | if idxs == nil { |
| 81 | return s |
| 82 | } |
| 83 | var b strings.Builder |
| 84 | last := 0 |
| 85 | for _, m := range idxs { |
| 86 | start, end := m[0], m[1] |
| 87 | precededBySlash := start > 0 && s[start-1] == '/' |
| 88 | if looksLikeSecretToken(s[start:end], precededBySlash) { |
| 89 | b.WriteString(s[last:start]) |
| 90 | b.WriteString("<hex>") |
| 91 | last = end |
| 92 | } |
| 93 | } |
| 94 | b.WriteString(s[last:]) |
| 95 | return b.String() |
| 96 | } |
| 97 | |
| 98 | var ( |
| 99 | reUUID = regexp.MustCompile(`^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}$`) |
| 100 | reHex16 = regexp.MustCompile(`^[0-9a-fA-F]{16,}$`) |
| 101 | reB64ish = regexp.MustCompile(`^[A-Za-z0-9+/_-]{20,}={0,2}$`) |
| 102 | reEmailNW = regexp.MustCompile(`^[A-Za-z0-9._%+-]+@[A-Za-z0-9.-]+\.[A-Za-z]{2,}$`) |
| 103 | ) |
| 104 | |
| 105 | // SanitizePath strips query and fragment and collapses token-shaped |
| 106 | // segments to ":token" (spec §3.3): a UUID, a hex run of 16+, a base64- |
| 107 | // looking run of 20+, or an email. "/blog/2024-review" and "/orders/42" |
| 108 | // survive; "/reset/8f3a…" does not. Empty is "/". |
| 109 | // |
| 110 | // The base64 segment rule requires both a digit and an upper-case letter |
| 111 | // so that ordinary long slugs ("some-long-page-name-here") survive. |
| 112 | func SanitizePath(p string) string { |
| 113 | if i := strings.IndexAny(p, "?#"); i >= 0 { |
| 114 | p = p[:i] |
| 115 | } |
| 116 | if p == "" { |
| 117 | return "/" |
| 118 | } |
| 119 | segs := strings.Split(p, "/") |
| 120 | for i, s := range segs { |
| 121 | if s == "" { |
| 122 | continue |
| 123 | } |
| 124 | if reUUID.MatchString(s) || reHex16.MatchString(s) || reEmailNW.MatchString(s) || |
| 125 | (reB64ish.MatchString(s) && strings.ContainsAny(s, "0123456789") && strings.ContainsAny(s, "ABCDEFGHIJKLMNOPQRSTUVWXYZ")) { |
| 126 | segs[i] = ":token" |
| 127 | } |
| 128 | } |
| 129 | return strings.Join(segs, "/") |
| 130 | } |
| 131 | |
amadan