Christian Krakau-Louis
31 lines
1.1 KiB
Python
31 lines
1.1 KiB
Python
"""
|
|
Utilities for making diagnostic text safe to store or log.
|
|
"""
|
|
|
|
import re
|
|
|
|
SENSITIVE_VALUE = "**redacted**"
|
|
|
|
_SENSITIVE_KEY_PATTERN = re.compile(
|
|
r"(?i)([\"']?\b(?:access_token|api_key|apikey|bearer|client_secret|"
|
|
r"gmail_client_secret|id_token|passwd|password|refresh_token|secret|token)\b[\"']?"
|
|
r"\s*[:=]\s*[\"']?)([^\"'\s,;&}]+)([\"']?)"
|
|
)
|
|
_BEARER_TOKEN_PATTERN = re.compile(r"(?i)\b(bearer)\s+([A-Za-z0-9._~+/=-]{8,})")
|
|
_AUTHORIZATION_BEARER_PATTERN = re.compile(
|
|
r"(?i)\b(authorization\s*[:=]\s*bearer)\s+([A-Za-z0-9._~+/=-]{8,})"
|
|
)
|
|
|
|
|
|
def sanitize_for_log(value: object) -> str:
|
|
"""Remove CR/LF characters from a value to prevent log injection attacks."""
|
|
return str(value).replace("\r", "").replace("\n", " ")
|
|
|
|
|
|
def redact_sensitive_text(value: object) -> str:
|
|
"""Sanitize text and redact common secret-bearing key/value fragments."""
|
|
text = sanitize_for_log(value)
|
|
text = _AUTHORIZATION_BEARER_PATTERN.sub(r"\1 " + SENSITIVE_VALUE, text)
|
|
text = _SENSITIVE_KEY_PATTERN.sub(r"\1" + SENSITIVE_VALUE + r"\3", text)
|
|
return _BEARER_TOKEN_PATTERN.sub(r"\1 " + SENSITIVE_VALUE, text)
|