Skip to content

Commit 31c5bdc

Browse files
timrogerstimrogers
committed
Use a case-insensitive search when redacting sensitive patterns in logs
1 parent ec528ae commit 31c5bdc

File tree

3 files changed

+55
-37
lines changed

3 files changed

+55
-37
lines changed

‎RELEASENOTES.md‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1 +1,2 @@
11
- Redact `X-Amz-Credential` querystring parameters in AWS S3 URLs included in logs
2+
- When redacting sensitive patterns in log output, use a non-case sensitive search

‎src/Octoshift/Services/OctoLogger.cs‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -97,7 +97,7 @@ private string Redact(string msg)
9797

9898
foreach (var redactionPattern in _redactionPatterns)
9999
{
100-
result = Regex.Replace(result, redactionPattern, "***");
100+
result = Regex.Replace(result, redactionPattern, "***", RegexOptions.IgnoreCase);
101101
}
102102

103103
return result;

‎src/OctoshiftCLI.Tests/Octoshift/Services/OctoLoggerTests.cs‎

Lines changed: 53 additions & 36 deletions
Original file line numberDiff line numberDiff line change
@@ -63,51 +63,68 @@ public void Secrets_Should_Be_Masked_From_Logs_And_Console()
6363
[Fact]
6464
public void Ghes_Archive_Url_Tokens_Should_Be_Replaced_In_Logs_And_Console()
6565
{
66-
6766
var ghesArchiveUrl = "https://files.github.acmeinc.com/foo?token=foobar";
68-
69-
_octoLogger.Verbose = false;
70-
_octoLogger.LogInformation($"Archive URL: {ghesArchiveUrl}");
71-
_octoLogger.LogVerbose($"Archive URL: {ghesArchiveUrl}");
72-
_octoLogger.LogWarning($"Archive URL: {ghesArchiveUrl}");
73-
_octoLogger.LogSuccess($"Archive URL: {ghesArchiveUrl}");
74-
_octoLogger.LogError($"Archive URL: {ghesArchiveUrl}");
75-
_octoLogger.LogError(new OctoshiftCliException($"Archive URL: {ghesArchiveUrl}"));
76-
_octoLogger.LogError(new InvalidOperationException($"Archive URL: {ghesArchiveUrl}"));
77-
78-
_octoLogger.Verbose = true;
79-
_octoLogger.LogVerbose($"Archive URL: {ghesArchiveUrl}");
80-
81-
_consoleOutput.Should().NotContain(ghesArchiveUrl);
82-
_logOutput.Should().NotContain(ghesArchiveUrl);
83-
_verboseLogOutput.Should().NotContain(ghesArchiveUrl);
84-
_consoleError.Should().NotContain(ghesArchiveUrl);
67+
var variants = new[]
68+
{
69+
ghesArchiveUrl,
70+
ghesArchiveUrl.ToUpper(),
71+
ghesArchiveUrl.ToLower()
72+
};
73+
74+
foreach (var variant in variants)
75+
{
76+
_octoLogger.Verbose = false;
77+
_octoLogger.LogInformation($"Archive URL: {variant}");
78+
_octoLogger.LogVerbose($"Archive URL: {variant}");
79+
_octoLogger.LogWarning($"Archive URL: {variant}");
80+
_octoLogger.LogSuccess($"Archive URL: {variant}");
81+
_octoLogger.LogError($"Archive URL: {variant}");
82+
_octoLogger.LogError(new OctoshiftCliException($"Archive URL: {variant}"));
83+
_octoLogger.LogError(new InvalidOperationException($"Archive URL: {variant}"));
84+
85+
_octoLogger.Verbose = true;
86+
_octoLogger.LogVerbose($"Archive URL: {variant}");
87+
88+
_consoleOutput.Should().NotContain(variant);
89+
_logOutput.Should().NotContain(variant);
90+
_verboseLogOutput.Should().NotContain(variant);
91+
_consoleError.Should().NotContain(variant);
92+
}
8593

8694
_consoleOutput.Should().Contain("Archive URL: https://files.github.acmeinc.com/foo?token=***");
8795
}
8896

8997
[Fact]
9098
public void Aws_Url_X_Aws_Credential_Parameters_Should_Be_Replaced_In_Logs_And_Console()
9199
{
92-
93100
var awsUrl = "https://example-s3-bucket-name.s3.amazonaws.com/uuid-uuid-uuid.tar.gz?X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Credential=AAAAAAAAAAAAAAAAAAAAAAA&X-Amz-Date=20231025T104425Z&X-Amz-Expires=172800&X-Amz-Signature=AAAAAAAAAAAAAAAAAAAAAAA&X-Amz-SignedHeaders=host&actor_id=1&key_id=0&repo_id=0&response-content-disposition=filename%3Duuid-uuid-uuid.tar.gz&response-content-type=application%2Fx-gzip";
94-
95-
_octoLogger.Verbose = false;
96-
_octoLogger.LogInformation($"Archive (metadata) download url: {awsUrl}");
97-
_octoLogger.LogVerbose($"Archive (metadata) download url: {awsUrl}");
98-
_octoLogger.LogWarning($"Archive (metadata) download url: {awsUrl}");
99-
_octoLogger.LogSuccess($"Archive (metadata) download url: {awsUrl}");
100-
_octoLogger.LogError($"Archive (metadata) download url: {awsUrl}");
101-
_octoLogger.LogError(new OctoshiftCliException($"Archive (metadata) download url: {awsUrl}"));
102-
_octoLogger.LogError(new InvalidOperationException($"Archive (metadata) download url: {awsUrl}"));
103-
104-
_octoLogger.Verbose = true;
105-
_octoLogger.LogVerbose($"Archive (metadata) download url: {awsUrl}");
106-
107-
_consoleOutput.Should().NotContain(awsUrl);
108-
_logOutput.Should().NotContain(awsUrl);
109-
_verboseLogOutput.Should().NotContain(awsUrl);
110-
_consoleError.Should().NotContain(awsUrl);
101+
var variants = new[]
102+
{
103+
awsUrl,
104+
awsUrl.ToUpper(),
105+
awsUrl.ToLower()
106+
};
107+
108+
foreach (var variant in variants)
109+
{
110+
_octoLogger.Verbose = false;
111+
_octoLogger.LogInformation($"Archive (metadata) download url: {variant}");
112+
_octoLogger.LogVerbose($"Archive (metadata) download url: {variant}");
113+
_octoLogger.LogWarning($"Archive (metadata) download url: {variant}");
114+
_octoLogger.LogSuccess($"Archive (metadata) download url: {variant}");
115+
_octoLogger.LogError($"Archive (metadata) download url: {variant}");
116+
_octoLogger.LogError(new OctoshiftCliException($"Archive (metadata) download url: {variant}"));
117+
_octoLogger.LogError(new InvalidOperationException($"Archive (metadata) download url: {variant}"));
118+
_octoLogger.LogInformation($"Archive (metadata) download url: {variant.ToLower()}");
119+
120+
_octoLogger.Verbose = true;
121+
_octoLogger.LogVerbose($"Archive (metadata) download url: {variant}");
122+
123+
_consoleOutput.Should().NotContain(variant);
124+
_logOutput.Should().NotContain(variant);
125+
_verboseLogOutput.Should().NotContain(variant);
126+
_consoleError.Should().NotContain(variant);
127+
}
111128

112129
_consoleOutput.Should().Contain("https://example-s3-bucket-name.s3.amazonaws.com/uuid-uuid-uuid.tar.gz?X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Credential=***&X-Amz-Date=20231025T104425Z&X-Amz-Expires=172800&X-Amz-Signature=AAAAAAAAAAAAAAAAAAAAAAA&X-Amz-SignedHeaders=host&actor_id=1&key_id=0&repo_id=0&response-content-disposition=filename%3Duuid-uuid-uuid.tar.gz&response-content-type=application%2Fx-gzip");
113130
}

0 commit comments

Comments
 (0)