fluent-plugin-maskrx 0.0.1.beta1

checksums.yaml

@@ -0,0 +1,7 @@
+---
+SHA1:
+  metadata.gz: 45025880984ced2282ac66208cc5966fedc32496
+  data.tar.gz: fd67a25b59aca551f1a55dd5eaec70f465dd330a
+SHA512:
+  metadata.gz: d861b468466096d4b78c1ea844f6732e578bef7bc5aff7c337bfda86af937850dc8976b6ab830e58ee26b801d218b02840fddbe9a6835749b478120240d8aec8
+  data.tar.gz: fbef82c26eb680b4e25ea2614a0c2c478572b26863eeaf6fb99262c374d50d87c3a6f5c515eab3c5c464759c0ea3b472758f7b52812fbaa708a924386c62ec58

data/.gitignore

@@ -0,0 +1,2 @@
+.bundle
+Gemfile.lock

data/Gemfile

@@ -0,0 +1,4 @@
+source "http://rubygems.org"
+
+# Specify your gem's dependencies in fluent-plugin-maskrx.gemspec
+gemspec

data/LICENSE

@@ -0,0 +1,22 @@
+MIT License
+
+Copyright (c) 2021 Joshua Mervine
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.
+

data/README.md

@@ -0,0 +1,46 @@
+# fluentd-plugin-maskrx
+
+A simple Fluentd filter plugin to mask string events using a regex.
+
+### Configurations
+
+| Block | Config  | Default | Desc |
+| ----- | ------  | ------- | ---- |
+| mask  | keys    | nil     | (Array)  Keys to perform mask on, if none than all keys are filtered. |
+| mask  | pattern | nil     | (Regexp) REQUIRED: Ruby Regexp matching one or more strings within a record key. |
+| mask  | mask    | \*\*\*\*\*\*\*\* | (String) The mask string to be used in replacing the matched strings within the record. |
+
+#### Example configuration
+
+```
+<filter **>
+  @type maskrx
+
+  <mask>
+    pattern /password=([.[^ ]]+)(?: |$)/
+    mask    xxxxx
+  </mask>
+  <mask>
+    keys token, accesskey
+    pattern /^.+$/
+  </mask>
+</filter>
+```
+
+##### Example record
+```
+{
+    "message":"This is a password=foobarbah",
+    "password":"password=foobarbah",
+    "token": "some-token"
+}
+```
+
+##### Example output
+```
+{
+    "message":"This is a password=xxxxx",
+    "password":"password=foobarbah",
+    "token": "some-token"
+}
+```

data/Rakefile

@@ -0,0 +1,9 @@
+require "bundler/gem_tasks"
+require "rake/testtask"
+Rake::TestTask.new(:test) do |test|
+  test.libs << 'lib' << 'test'
+  test.pattern = 'test/**/test_*.rb'
+  test.verbose = true
+end
+
+task :default => :test

data/filter-plugin-maskrx.gemspec

@@ -0,0 +1,25 @@
+# coding: utf-8
+lib = File.expand_path('../lib', __FILE__)
+$LOAD_PATH.unshift(lib) unless $LOAD_PATH.include?(lib)
+
+Gem::Specification.new do |spec|
+  spec.name          = "fluent-plugin-maskrx"
+  spec.version       = "0.0.1.beta1"
+  spec.authors       = ["Joshua Mervine"]
+  spec.email         = ["joshua@mervine.net"]
+  spec.summary       = %q{Fluentd filter plugin to mask strings within records.}
+  spec.homepage      = "https://github.com/jmervine/fluent-plugin-maskrx"
+  spec.license       = "MIT"
+
+  spec.files         = `git ls-files`.split($/)
+  spec.executables   = spec.files.grep(%r{^bin/}) { |f| File.basename(f) }
+  spec.test_files    = spec.files.grep(%r{^(test|spec|features)/})
+  spec.require_paths = ["lib"]
+
+  spec.add_development_dependency "bundler"
+  spec.add_development_dependency "rake"
+  spec.add_development_dependency "pry"
+  spec.add_development_dependency "test-unit", "~> 3"
+  spec.add_runtime_dependency "fluentd", [">= 0.14.0", "< 2"]
+end
+

data/lib/fluent/plugin/filter_maskrx.rb

@@ -0,0 +1,57 @@
+require 'fluent/plugin/filter'
+
+module Fluent::Plugin
+  class MaskRxFilter < Filter
+    Fluent::Plugin.register_filter('maskrx', self)
+
+    config_section :mask, param_name: :mask_config_list, required: true, multi: true do
+      config_param :keys,    :array,  default: nil
+      config_param :pattern, :regexp, default: nil
+      config_param :mask,    :string, default: '********'
+    end
+
+    def initialize
+      super
+    end
+
+    def configure(conf)
+      super
+    end
+
+    def filter(_, _, record)
+      @mask_config_list.each do |config|
+        raise Fluent::ConfigError, "pattern is required" if config.pattern.nil?
+
+        record = mask_record(config, record)
+      end
+
+      record
+    end
+
+    protected
+    def mask_record(config, record)
+      keys = (config.keys.nil? ? record.keys : config.keys)
+
+      keys.each do |key|
+        record[key] = mask_key_value(config.pattern, config.mask, record[key]) unless record[key].nil?
+      end
+
+      return record
+    end
+
+    def mask_key_value(pattern, mask, value)
+      match = value.match(pattern)
+
+      return value unless match
+
+      match = match.to_a
+      match = match.to_a.drop(1) if match.size > 1
+
+      match.each do |m|
+        value.gsub!(m, mask)
+      end
+
+      return value
+    end
+  end
+end

data/test/helper.rb

@@ -0,0 +1,8 @@
+require 'bundler/setup'
+require 'test/unit'
+require 'pry'
+
+$LOAD_PATH.unshift(File.join(__dir__, '..', 'lib'))
+$LOAD_PATH.unshift(__dir__)
+require 'fluent/test'
+require 'fluent/test/helpers'

data/test/plugin/test_filter_maskrx.rb

@@ -0,0 +1,69 @@
+require 'helper'
+require 'fluent/test/driver/filter'
+require 'fluent/plugin/filter_maskrx'
+
+class MaskRxFilterTest < Test::Unit::TestCase
+  CONFIG = %[
+    <mask>
+      pattern /password=([.[^ ]]+)(?: |$)/
+      mask    xxxxx
+    </mask>
+    <mask>
+      keys token, accesskey
+      pattern /^.+$/
+    </mask>
+  ]
+
+  def setup
+    omit_unless(Fluent.const_defined?(:Filter))
+    Fluent::Test.setup
+    @time = Fluent::Engine.now
+
+    @filtered = filter([{
+      "ident"     => "foo",
+      "message"   => "Loop iteration 5488, example password=th!s1sap@$$w0rd and it should be masked.",
+      "password"  => "password=th!s1sap@$$w0rd",
+      "token"     => "this-is-a-token",
+      "accesskey" => "this-is-an-access_key"
+    }]).first
+  end
+
+  def create_driver(conf=CONFIG)
+    Fluent::Test::Driver::Filter.new(Fluent::Plugin::MaskRxFilter).configure(conf)
+  end
+
+  def filter(messages, conf=CONFIG)
+    d = create_driver(conf)
+
+    d.run(default_tag: 'test', start: true, shutdown: false) do
+      messages.each do |message|
+        d.feed(message)
+      end
+    end
+
+    d.filtered_records
+  end
+
+  sub_test_case 'configuration' do
+    test 'empty config' do
+      assert_raise(Fluent::ConfigError) do
+        create_driver('')
+      end
+    end
+  end
+
+  sub_test_case 'masking' do
+    test 'without keys' do
+      assert_equal 'password=xxxxx', @filtered["password"]
+
+      assert_equal \
+        'Loop iteration 5488, example password=xxxxx and it should be masked.', \
+        @filtered["message"]
+    end
+
+    test 'with keys' do
+      assert_equal '********', @filtered["token"]
+      assert_equal '********', @filtered["accesskey"]
+    end
+  end
+end

metadata

@@ -0,0 +1,131 @@
+--- !ruby/object:Gem::Specification
+name: fluent-plugin-maskrx
+version: !ruby/object:Gem::Version
+  version: 0.0.1.beta1
+platform: ruby
+authors:
+- Joshua Mervine
+autorequire:
+bindir: bin
+cert_chain: []
+date: 2021-09-15 00:00:00.000000000 Z
+dependencies:
+- !ruby/object:Gem::Dependency
+  name: bundler
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '0'
+  type: :development
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '0'
+- !ruby/object:Gem::Dependency
+  name: rake
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '0'
+  type: :development
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '0'
+- !ruby/object:Gem::Dependency
+  name: pry
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '0'
+  type: :development
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '0'
+- !ruby/object:Gem::Dependency
+  name: test-unit
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '3'
+  type: :development
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '3'
+- !ruby/object:Gem::Dependency
+  name: fluentd
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: 0.14.0
+    - - "<"
+      - !ruby/object:Gem::Version
+        version: '2'
+  type: :runtime
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: 0.14.0
+    - - "<"
+      - !ruby/object:Gem::Version
+        version: '2'
+description:
+email:
+- joshua@mervine.net
+executables: []
+extensions: []
+extra_rdoc_files: []
+files:
+- ".gitignore"
+- Gemfile
+- LICENSE
+- README.md
+- Rakefile
+- filter-plugin-maskrx.gemspec
+- lib/fluent/plugin/filter_maskrx.rb
+- test/helper.rb
+- test/plugin/test_filter_maskrx.rb
+homepage: https://github.com/jmervine/fluent-plugin-maskrx
+licenses:
+- MIT
+metadata: {}
+post_install_message:
+rdoc_options: []
+require_paths:
+- lib
+required_ruby_version: !ruby/object:Gem::Requirement
+  requirements:
+  - - ">="
+    - !ruby/object:Gem::Version
+      version: '0'
+required_rubygems_version: !ruby/object:Gem::Requirement
+  requirements:
+  - - ">"
+    - !ruby/object:Gem::Version
+      version: 1.3.1
+requirements: []
+rubyforge_project:
+rubygems_version: 2.5.2
+signing_key:
+specification_version: 4
+summary: Fluentd filter plugin to mask strings within records.
+test_files:
+- test/helper.rb
+- test/plugin/test_filter_maskrx.rb