[PLAT-639] Add credentials obfuscation

README.md

@@ -76,6 +76,33 @@ values by `__SENSITIVE_DATA__` string. This feature is enabled by default but
 you can skip this (not recommanded) by setting the environment variable
 `LOGGER_USE_SENSITIVE_DATA_STREAM` to `false`.
 
+You also can add custom filter :
+```
+const sensitiveDataFragment = '(pass|password)'; // Will obfuscate 'pass' and 'password' data
+
+const newLogger = init({
+  logger: {
+    sensitiveDataFragment,
+  },
+});
+```
+
+Moreover, you can also add customize the way it replaces data :
+```
+const sensitiveDataPattern = [
+  {
+    regex: YOUR_NEW_REGEX,
+    substitute: SUBSTITUTION_CONTENT,
+  }
+]; // Will replace data matching with new regex by substitute content
+
+const newLogger = init({
+  logger: {
+    sensitiveDataPattern,
+  },
+});
+```
+
 In addition, you can update the pattern on which to make the match with the
 environment variable `LOGGER_SENSITIVE_DATA_PATTERN`. Its value must represent
 a valid [capturing regular expression](https://developer.mozilla.org/fr/docs/Web/JavaScript/Reference/Objets_globaux/RegExp#group_back).

index.js

@@ -49,7 +49,10 @@ function init(config) {
   } else if (finalConfig.logger.hideSensitiveData) {
     loggerConfig.streams.push({
       level: loggerLevel,
-      stream: new SensitiveDataStream(finalConfig.logger.sensitiveDataPattern),
+      stream: new SensitiveDataStream(
+        finalConfig.logger.sensitiveDataFragment,
+        finalConfig.logger.sensitiveDataPattern
+      ),
     });
   } else {
     loggerConfig.streams.push({ level: loggerLevel, stream: process.stdout });

streams/sensitive-data.js

@@ -4,12 +4,34 @@ const DEFAULT_SENSITIVE_DATA_FRAGMENTS =
   '(mdp|password|authorization|token|pwd|auth)';
 
 module.exports = class SensitiveDataStream {
-  constructor(fragments) {
+  constructor(fragments, patterns = []) {
     this.fragments = fragments || DEFAULT_SENSITIVE_DATA_FRAGMENTS;
-    this.pattern = new RegExp(`"${this.fragments}":"([^"]*)"`, 'ig');
+    this.replacer = '__SENSITIVE_DATA__';
+
+    // If a pattern is provided
+    if (patterns.length) {
+      this.patterns = patterns;
+    } else {
+      // If no pattern provided, then add 2 default regexes
+      this.patterns = [
+        {
+          regex: new RegExp(`"${this.fragments}":"([^"]*)"`, 'ig'), // @Match "mdp":"My super password"
+          substitute: `"$1":"${this.replacer}"`,
+        },
+        {
+          regex: new RegExp(`${this.fragments}=([\\w-]*)`, 'ig'), // @Match mdp=My-super-password
+          substitute: `$1=${this.replacer}`,
+        },
+      ];
+    }
   }
   write(input) {
-    const sanitized = input.replace(this.pattern, '"$1":"__SENSITIVE_DATA__"');
+    let sanitized = input;
+
+    // Apply replace on input looping through patterns array
+    for (let pattern of this.patterns) {
+      sanitized = sanitized.replace(pattern.regex, pattern.substitute);
+    }
 
     return process.stdout.write(sanitized);
   }

test/index.test.js

@@ -154,15 +154,20 @@ describe('index.js', () => {
             req: {
               token: 'My personal token',
             },
+            cmd: 'command docker build password=test',
           },
           'Logging amazingly sensitive data!'
         );
+
         const message = logs.shift();
 
         expect(message.password).to.equal('__SENSITIVE_DATA__');
         expect(message.headers['accept-language']).to.equal('fr-FR');
         expect(message.headers.authorization).to.equal('__SENSITIVE_DATA__');
         expect(message.req.token).to.equal('__SENSITIVE_DATA__');
+        expect(message.cmd).to.equal(
+          'command docker build password=__SENSITIVE_DATA__'
+        );
       });
     });
   });
@@ -182,7 +187,7 @@ describe('index.js', () => {
 
     it('should use the sensitive data stream with specific pattern fragments if set', () => {
       const newLogger = init({
-        logger: { sensitiveDataPattern: '(password)' },
+        logger: { sensitiveDataFragment: '(password)' },
       });
 
       expect(newLogger.streams).to.have.lengthOf(1);
@@ -192,6 +197,30 @@ describe('index.js', () => {
       expect(newLogger.streams[0].stream.fragments).to.equal('(password)');
     });
 
+    it('should use the sensitive data stream with specific replacement patterns if set', () => {
+      const sensitiveDataPattern = [
+        {
+          regex: new RegExp(`(testing_string)=([\\w-]*)`, 'ig'),
+          substitute: `"$1":"__TESTING_REPLACEMENT__"`,
+        },
+      ];
+
+      const newLogger = init({
+        logger: { sensitiveDataPattern },
+      });
+
+      expect(newLogger.streams).to.have.lengthOf(1);
+      expect(newLogger.streams[0]).to.have.property('stream');
+
+      expect(newLogger.streams[0].stream).to.be.instanceOf(SensitiveDataStream);
+      expect(newLogger.streams[0].stream.patterns).to.deep.equal([
+        {
+          regex: /(testing_string)=([\w-]*)/gi,
+          substitute: `"$1":"__TESTING_REPLACEMENT__"`,
+        },
+      ]);
+    });
+
     it('should use only the default stdout stream if LOGGER_USE_SENSITIVE_DATA_STREAM is false', () => {
       const newLogger = init({
         logger: { hideSensitiveData: false },