auth-sanitizer 0.2.3 → 0.2.4

data/lib/auth/sanitizer/sanitized_logger.rb

@@ -2,12 +2,11 @@
 
 module Auth
   module Sanitizer
-    # Logger wrapper that redacts sensitive values from debug output before
-    # delegating to the underlying logger instance.
+    # Logger wrapper that redacts sensitive values from debug output before delegating to the
+    # underlying logger instance.
     #
-    # This class is intentionally narrow in scope: it only sanitizes string
-    # messages emitted through the logging path and leaves request/response
-    # behavior unchanged.
+    # This class is intentionally narrow in scope: it only sanitizes string messages emitted
+    # through the logging path and leaves request/response behavior unchanged.
     #
     # The underlying {ThingFilter} is initialized once when the logger wrapper is
     # created, so later config changes do not alter the behavior of existing
@@ -15,12 +14,12 @@ module Auth
     class SanitizedLogger
       # Create a new sanitized logger wrapper.
       #
-      # @param [#add, #debug, #info, #warn, #error, #fatal, #unknown] logger
+      # @param logger [#add, #debug, #info, #warn, #error, #fatal, #unknown]
       #   The underlying logger instance that will receive sanitized messages.
-      # @param [Array<String>] filtered_keys
+      # @param filtered_keys [Array<String>]
       #   Key names whose values should be redacted in debug output.
       #   Defaults to {Auth::Sanitizer.default_filtered_keys}.
-      # @param [String] label
+      # @param label [String]
       #   Replacement label for redacted values.
       #   Defaults to {Auth::Sanitizer.filtered_label}.
       def initialize(logger, filtered_keys: Auth::Sanitizer.default_filtered_keys, label: Auth::Sanitizer.filtered_label)
@@ -30,9 +29,9 @@ module Auth
 
       # Add a log entry after sanitizing any string payloads.
       #
-      # @param [Integer, Symbol, String, nil] severity Logger severity
-      # @param [Object, nil] message Optional log message
-      # @param [Object, nil] progname Optional program name
+      # @param severity [Integer, Symbol, String, nil] Logger severity
+      # @param message [Object, nil] Optional log message
+      # @param progname [Object, nil] Optional program name
       # @yieldreturn [Object] Deferred log message
       # @return [Object] The underlying logger result
       def add(severity, message = nil, progname = nil)
@@ -45,7 +44,7 @@ module Auth
 
       # Append a message to the underlying logger after sanitization.
       #
-      # @param [String] message Message to append
+      # @param message [String] Message to append
       # @return [Object] The underlying logger result
       def <<(message)
         @logger << sanitize(message)
@@ -53,7 +52,7 @@ module Auth
 
       # Log a debug message after sanitization.
       #
-      # @param [Object, nil] progname Optional program name
+      # @param progname [Object, nil] Optional program name
       # @yieldreturn [Object] Deferred log message
       # @return [Object] The underlying logger result
       def debug(progname = nil, &block)
@@ -62,7 +61,7 @@ module Auth
 
       # Log an info message after sanitization.
       #
-      # @param [Object, nil] progname Optional program name
+      # @param progname [Object, nil] Optional program name
       # @yieldreturn [Object] Deferred log message
       # @return [Object] The underlying logger result
       def info(progname = nil, &block)
@@ -71,7 +70,7 @@ module Auth
 
       # Log a warning message after sanitization.
       #
-      # @param [Object, nil] progname Optional program name
+      # @param progname [Object, nil] Optional program name
       # @yieldreturn [Object] Deferred log message
       # @return [Object] The underlying logger result
       def warn(progname = nil, &block)
@@ -80,7 +79,7 @@ module Auth
 
       # Log an error message after sanitization.
       #
-      # @param [Object, nil] progname Optional program name
+      # @param progname [Object, nil] Optional program name
       # @yieldreturn [Object] Deferred log message
       # @return [Object] The underlying logger result
       def error(progname = nil, &block)
@@ -89,7 +88,7 @@ module Auth
 
       # Log a fatal message after sanitization.
       #
-      # @param [Object, nil] progname Optional program name
+      # @param progname [Object, nil] Optional program name
       # @yieldreturn [Object] Deferred log message
       # @return [Object] The underlying logger result
       def fatal(progname = nil, &block)
@@ -98,7 +97,7 @@ module Auth
 
       # Log an unknown-severity message after sanitization.
       #
-      # @param [Object, nil] progname Optional program name
+      # @param progname [Object, nil] Optional program name
       # @yieldreturn [Object] Deferred log message
       # @return [Object] The underlying logger result
       def unknown(progname = nil, &block)
@@ -121,7 +120,7 @@ module Auth
 
       # Set the formatter of the underlying logger if supported.
       #
-      # @param [Object] formatter Formatter object
+      # @param formatter [Object] Formatter object
       # @return [void]
       def formatter=(formatter)
         @logger.formatter = formatter if @logger.respond_to?(:formatter=)
@@ -136,7 +135,7 @@ module Auth
 
       # Set the logger level if supported.
       #
-      # @param [Object] level Logger level
+      # @param level [Object] Logger level
       # @return [void]
       def level=(level)
         @logger.level = level if @logger.respond_to?(:level=)
@@ -151,7 +150,7 @@ module Auth
 
       # Set the logger progname if supported.
       #
-      # @param [Object] progname Logger progname
+      # @param progname [Object] Logger progname
       # @return [void]
       def progname=(progname)
         @logger.progname = progname if @logger.respond_to?(:progname=)
@@ -159,8 +158,8 @@ module Auth
 
       # Report support for methods provided by the wrapped logger.
       #
-      # @param [Symbol] method_name Method name to check
-      # @param [Boolean] include_private Whether private methods are considered
+      # @param method_name [Symbol] Method name to check
+      # @param include_private [Boolean] Whether private methods are considered
       # @return [Boolean]
       def respond_to_missing?(method_name, include_private = false)
         @logger.respond_to?(method_name, include_private) || super
@@ -168,8 +167,8 @@ module Auth
 
       # Delegate unsupported methods to the wrapped logger.
       #
-      # @param [Symbol] method_name Method to invoke
-      # @param [Array<Object>] args Method arguments
+      # @param method_name [Symbol] Method to invoke
+      # @param args [Array<Object>] Method arguments
       # @yield Deferred block forwarded to the wrapped logger
       # @return [Object] The delegated result
       def method_missing(method_name, *args, &block)
@@ -182,8 +181,8 @@ module Auth
 
       # Dispatch a severity-specific log call after sanitization.
       #
-      # @param [Symbol] level Logger method name
-      # @param [Object, nil] progname Optional program name
+      # @param level [Symbol] Logger method name
+      # @param progname [Object, nil] Optional program name
       # @yieldreturn [Object] Deferred log message
       # @return [Object] The underlying logger result
       def log(level, progname = nil)
@@ -196,14 +195,17 @@ module Auth
 
       # Sanitize a logger message when it is a String.
       #
-      # @param [Object] message Potential logger payload
+      # @param message [Object] Potential logger payload
       # @return [Object] Unchanged non-String payloads, sanitized String payloads
       def sanitize(message)
         return message unless message.is_a?(String)
 
-        sanitized = message.dup
+        # scrub replaces invalid byte sequences so the gsub calls below never
+        # raise on an invalid encoding while logging a request.
+        sanitized = message.dup.scrub
         sanitized = sanitize_authorization_header(sanitized)
         sanitized = sanitize_json_pairs(sanitized)
+        sanitized = sanitize_inspect_pairs(sanitized)
         sanitize_form_and_query_pairs(sanitized)
       end
 
@@ -216,7 +218,7 @@ module Auth
 
       # Redact Authorization header values.
       #
-      # @param [String] message Logger message
+      # @param message [String] Logger message
       # @return [String] Sanitized logger message
       def sanitize_authorization_header(message)
         message.gsub(/(Authorization:\s*)(?:"[^"]*"|[^\r\n]+)/i, "\\1\"#{thing_filter.label}\"")
@@ -224,7 +226,7 @@ module Auth
 
       # Redact JSON-style values for configured sensitive key names.
       #
-      # @param [String] message Logger message
+      # @param message [String] Logger message
       # @return [String] Sanitized logger message
       def sanitize_json_pairs(message)
         message.gsub(/(["'])(#{thing_filter.pattern_source})\1(\s*:\s*)(["'])(.*?)\4/i) do
@@ -232,12 +234,36 @@ module Auth
         end
       end
 
+      # Redact values in Ruby `Hash#inspect` output for configured sensitive key names.
+      #
+      # Faraday's debug logger renders non-String bodies (such as the params Hash an OAuth client
+      # builds for a token request) with `pretty_inspect`, so secrets reach the logger in Ruby
+      # inspect syntax rather than JSON or form encoding. Handles both Ruby 3.4+ formats
+      # (`{"key" => "value"}`, `{key: "value"}`) and the pre-3.4 formats (`{"key"=>"value"}`,
+      # `{:key=>"value"}`), case-insensitively.
+      #
+      # @param message [String] Logger message
+      # @return [String] Sanitized logger message
+      def sanitize_inspect_pairs(message)
+        key = thing_filter.pattern_source
+        label = thing_filter.label
+        # Hash-rocket pairs: "key" => "value" / "key"=>"value" / :key=>"value"
+        message = message.gsub(/((?:"(?:#{key})"|:#{key})\s*=>\s*")[^"]*(")/i) { "#{$1}#{label}#{$2}" }
+        # Symbol shorthand pairs: key: "value" (not preceded by a quote, so
+        # already-sanitized JSON pairs are not reprocessed)
+        message.gsub(/(?<!["'])((?:\b(?:#{key})):\s*")[^"]*(")/i) { "#{$1}#{label}#{$2}" }
+      end
+
       # Redact form-encoded and query-string values for configured sensitive key names.
       #
-      # @param [String] message Logger message
+      # The value class excludes `"` and `>` so the pattern neither crosses
+      # into quoted strings nor mangles `Hash#inspect` hash-rocket pairs
+      # (`:key=>"value"`), which {sanitize_inspect_pairs} handles instead.
+      #
+      # @param message [String] Logger message
       # @return [String] Sanitized logger message
       def sanitize_form_and_query_pairs(message)
-        message.gsub(/(\b(?:#{thing_filter.pattern_source})=)([^&\s"]+)/i, "\\1#{thing_filter.label}")
+        message.gsub(/(\b(?:#{thing_filter.pattern_source})=)([^&\s">]+)/i, "\\1#{thing_filter.label}")
       end
     end
   end

data/lib/auth/sanitizer/thing_filter.rb

@@ -13,8 +13,8 @@ module Auth
     class ThingFilter
       # Create a new filter.
       #
-      # @param [Enumerable<#to_s>] things Names that should be filtered
-      # @param [String] label Replacement label to use for filtered values
+      # @param things [Enumerable<#to_s>] Names that should be filtered
+      # @param label [String] Replacement label to use for filtered values
       #
       # The provided values are duplicated and frozen so the filter remains
       # stable for the lifetime of the object.
@@ -39,7 +39,7 @@ module Auth
       # Matching is substring-based so it works naturally with instance-variable
       # names used by `#inspect`, such as `@secret` matching `secret`.
       #
-      # @param [#to_s] thing_name Candidate thing name
+      # @param thing_name [#to_s] Candidate thing name
       # @return [Boolean]
       def filtered?(thing_name)
         thing_name_str = thing_name.to_s

data/lib/auth/sanitizer/version.rb

@@ -2,9 +2,12 @@
 
 module Auth
   module Sanitizer
+    # Version namespace for this gem.
     module Version
-      VERSION = "0.2.3"
+      # Current gem version.
+      VERSION = "0.2.4"
     end
+    # Current gem version exposed at the traditional constant location.
     VERSION = Version::VERSION # Traditional Constant Location
   end
 end

data/lib/auth/sanitizer.rb

@@ -2,11 +2,11 @@
 
 require "version_gem"
 
-require_relative "sanitizer/version"
 require_relative "sanitizer/thing_filter"
 require_relative "sanitizer/core"
 require_relative "sanitizer/filtered_attributes"
 require_relative "sanitizer/sanitized_logger"
+require_relative "sanitizer/version"
 
 Auth::Sanitizer::Version.class_eval do
   extend VersionGem::Basic

data/lib/auth_sanitizer/loader.rb

@@ -1,9 +1,11 @@
 # frozen_string_literal: true
 
+# Namespace for the isolated loader surface of the auth-sanitizer gem.
 module AuthSanitizer
   # Loader for consumers that need Auth::Sanitizer without defining a top-level
   # Auth constant in the host application.
   module Loader
+    # Gem source files evaluated into the anonymous namespace, in load order.
     FILES = %w[
       auth/sanitizer/version.rb
       auth/sanitizer/thing_filter.rb
@@ -39,6 +41,9 @@ module AuthSanitizer
       # the anonymous Auth namespace. This keeps the normal files unchanged while
       # avoiding Object::Auth leakage on runtimes where Module#module_eval still
       # resolves nested module declarations through Object.
+      #
+      # @param path [String] Absolute path to the gem source file
+      # @return [String] The source with the top-level wrapper removed
       def isolated_source(path)
         lines = File.readlines(path)
         wrapper_index = lines.index("module Auth\n")

data/sig/auth/sanitizer.rbs

@@ -5,3 +5,12 @@ module AuthSanitizer
     def self.load_isolated: () -> Module
   end
 end
+
+module Auth
+  module Sanitizer
+    module Version
+      VERSION: String
+    end
+    VERSION: String
+  end
+end

data.tar.gz.sig

@@ -1 +1,2 @@
-,\����I'��:��ذ��+N~��]�E���߮�n|���V�����4����H��Ex�z�9)F��?W���q�	�7s�I�"��l����L‘s��L��6���G*��߁UR����~f��.%K����,�e<��K6-L�7��;F�5��]��G�C��1��j�	�ǽ�C���m=llٸ�������C��+4��L��Ya��ڽ"��iDW�c�v�w��đ�ӫ]v�O��B=�4��Sw��PB��߂w؎s9>˘/�l�yʟg.ꌯȲ pL���cHXV{v�hu�����~�|�E2��69��/	8V̄FE�Y�)JX	#@����.���c�(�7WȺt���(��$
+Ucp1�/>R�l{��8,�ͷF�i���p>oNv
+��h��jB%���p�P���q�����p���u�z�S�����e\�K���(D��݆yD���OO�Ȱn�&��^

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: auth-sanitizer
 version: !ruby/object:Gem::Version
-  version: 0.2.3
+  version: 0.2.4
 platform: ruby
 authors:
 - Peter H. Boling
@@ -46,7 +46,7 @@ dependencies:
         version: '1.1'
     - - ">="
       - !ruby/object:Gem::Version
-        version: 1.1.14
+        version: 1.1.16
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
@@ -56,27 +56,27 @@ dependencies:
         version: '1.1'
     - - ">="
       - !ruby/object:Gem::Version
-        version: 1.1.14
+        version: 1.1.16
 - !ruby/object:Gem::Dependency
   name: kettle-dev
   requirement: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '2.3'
+        version: '3.1'
     - - ">="
       - !ruby/object:Gem::Version
-        version: 2.3.3
+        version: 3.1.22
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '2.3'
+        version: '3.1'
     - - ">="
       - !ruby/object:Gem::Version
-        version: 2.3.3
+        version: 3.1.22
 - !ruby/object:Gem::Dependency
   name: bundler-audit
   requirement: !ruby/object:Gem::Requirement
@@ -125,26 +125,46 @@ dependencies:
     - - ">="
       - !ruby/object:Gem::Version
         version: 1.0.4
+- !ruby/object:Gem::Dependency
+  name: anonymous_loader
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '0.1'
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: 0.1.4
+  type: :development
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '0.1'
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: 0.1.4
 - !ruby/object:Gem::Dependency
   name: appraisal2
   requirement: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '3.1'
+        version: '3.2'
     - - ">="
       - !ruby/object:Gem::Version
-        version: 3.1.4
+        version: 3.2.6
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '3.1'
+        version: '3.2'
     - - ">="
       - !ruby/object:Gem::Version
-        version: 3.1.4
+        version: 3.2.6
 - !ruby/object:Gem::Dependency
   name: kettle-test
   requirement: !ruby/object:Gem::Requirement
@@ -154,7 +174,7 @@ dependencies:
         version: '2.0'
     - - ">="
       - !ruby/object:Gem::Version
-        version: 2.0.10
+        version: 2.0.27
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
@@ -164,27 +184,27 @@ dependencies:
         version: '2.0'
     - - ">="
       - !ruby/object:Gem::Version
-        version: 2.0.10
+        version: 2.0.27
 - !ruby/object:Gem::Dependency
   name: turbo_tests2
   requirement: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '3.1'
+        version: '4.0'
     - - ">="
       - !ruby/object:Gem::Version
-        version: 3.1.7
+        version: 4.0.0
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '3.1'
+        version: '4.0'
     - - ">="
       - !ruby/object:Gem::Version
-        version: 3.1.7
+        version: 4.0.0
 - !ruby/object:Gem::Dependency
   name: ruby-progressbar
   requirement: !ruby/object:Gem::Requirement
@@ -208,7 +228,7 @@ dependencies:
         version: '1.0'
     - - ">="
       - !ruby/object:Gem::Version
-        version: 1.0.6
+        version: 1.0.9
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
@@ -218,7 +238,7 @@ dependencies:
         version: '1.0'
     - - ">="
       - !ruby/object:Gem::Version
-        version: 1.0.6
+        version: 1.0.9
 - !ruby/object:Gem::Dependency
   name: gitmoji-regex
   requirement: !ruby/object:Gem::Requirement
@@ -228,7 +248,7 @@ dependencies:
         version: '2.0'
     - - ">="
       - !ruby/object:Gem::Version
-        version: 2.0.4
+        version: 2.0.15
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
@@ -238,34 +258,17 @@ dependencies:
         version: '2.0'
     - - ">="
       - !ruby/object:Gem::Version
-        version: 2.0.4
-description: "\U0001F48E Configurable KV output redaction. Sanitize/filter your secrets."
+        version: 2.0.15
+description: "\U0001F9FC Configurable KV output redaction. Sanitize/filter your secrets."
 email:
 - floss@galtzo.com
 executables: []
 extensions: []
-extra_rdoc_files:
-- CHANGELOG.md
-- CITATION.cff
-- CODE_OF_CONDUCT.md
-- CONTRIBUTING.md
-- FUNDING.md
-- LICENSE.md
-- README.md
-- RUBOCOP.md
-- SECURITY.md
+extra_rdoc_files: []
 files:
 - CHANGELOG.md
-- CITATION.cff
-- CODE_OF_CONDUCT.md
-- CONTRIBUTING.md
-- FUNDING.md
 - LICENSE.md
-- MIT.md
 - README.md
-- RUBOCOP.md
-- SECURITY.md
-- certs/pboling.pem
 - lib/auth/sanitizer.rb
 - lib/auth/sanitizer/core.rb
 - lib/auth/sanitizer/filtered_attributes.rb
@@ -274,24 +277,24 @@ files:
 - lib/auth/sanitizer/version.rb
 - lib/auth_sanitizer/loader.rb
 - sig/auth/sanitizer.rbs
-- sig/auth/sanitizer/version.rbs
 homepage: https://github.com/ruby-oauth/auth-sanitizer
 licenses:
 - MIT
 metadata:
   homepage_uri: https://auth-sanitizer.galtzo.com
-  source_code_uri: https://github.com/ruby-oauth/auth-sanitizer/tree/v0.2.3
-  changelog_uri: https://github.com/ruby-oauth/auth-sanitizer/blob/v0.2.3/CHANGELOG.md
+  source_code_uri: https://github.com/ruby-oauth/auth-sanitizer/tree/v0.2.4
+  changelog_uri: https://github.com/ruby-oauth/auth-sanitizer/blob/v0.2.4/CHANGELOG.md
   bug_tracker_uri: https://github.com/ruby-oauth/auth-sanitizer/issues
-  documentation_uri: https://www.rubydoc.info/gems/auth-sanitizer/0.2.3
+  documentation_uri: https://www.rubydoc.info/gems/auth-sanitizer/0.2.4
   funding_uri: https://github.com/sponsors/pboling
   wiki_uri: https://github.com/ruby-oauth/auth-sanitizer/wiki
   news_uri: https://www.railsbling.com/tags/auth-sanitizer
   discord_uri: https://discord.gg/3qme4XHNKN
+  mailing_list_uri: https://www.rubyforum.org/tag/ruby-oauth
   rubygems_mfa_required: 'true'
 rdoc_options:
 - "--title"
-- "auth-sanitizer - \U0001F48E Configurable KV output redaction"
+- "auth-sanitizer - \U0001F9FC Configurable KV output redaction"
 - "--main"
 - README.md
 - "--exclude"
@@ -312,7 +315,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 4.0.10
+rubygems_version: 4.0.20
 specification_version: 4
-summary: "\U0001F48E Configurable KV output redaction"
+summary: "\U0001F9FC Configurable KV output redaction"
 test_files: []

data/CITATION.cff

@@ -1,20 +0,0 @@
-cff-version: 1.2.0
-title: "auth-sanitizer"
-message: >-
-  If you use this work and you want to cite it,
-  then you can use the metadata from this file.
-type: software
-authors:
-  - given-names: "Peter H."
-    family-names: "Boling"
-    email: "floss@galtzo.com"
-    affiliation: "galtzo.com"
-    orcid: 'https://orcid.org/0009-0008-8519-441X'
-identifiers:
-  - type: url
-    value: 'https://github.com/ruby-oauth/auth-sanitizer'
-    description: "auth-sanitizer"
-repository-code: 'https://github.com/ruby-oauth/auth-sanitizer'
-abstract: >-
-  auth-sanitizer
-license: See license file