redacting-logger 1.0.0

checksums.yaml

@@ -0,0 +1,7 @@
+---
+SHA256:
+  metadata.gz: '0913f102f2fa739214c54f742359f8771cc84212e9a8fcdd05eeff041b54a42d'
+  data.tar.gz: 8bc325f2c2fb50c9e32f70abe8ba4d6ac8236597a8a3bb43c90179cdb516ea53
+SHA512:
+  metadata.gz: 5b3abad7e1a467c4bf63ee3aea78a790b04cd83799199c79bf91e6e1ae9617f6081cd83bcb09acafaee5e0ba579028ffb78a89f75b289bc0924fde6918eb92a7
+  data.tar.gz: f5ea63ec3062cc32284a73b05f991ae5b05e1987cfa0c009b7d3d3629cacd9854e71e375f099e5f5b0cfc2421e7f38964b9b11e32d0abd43547b897837b8c676

data/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2023 Grant Birkinbine
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

data/README.md

@@ -0,0 +1,84 @@
+# redacting-logger
+
+[![test](https://github.com/github/redacting-logger/actions/workflows/test.yml/badge.svg)](https://github.com/github/redacting-logger/actions/workflows/test.yml) [![lint](https://github.com/github/redacting-logger/actions/workflows/lint.yml/badge.svg)](https://github.com/github/redacting-logger/actions/workflows/lint.yml) [![build](https://github.com/github/redacting-logger/actions/workflows/build.yml/badge.svg)](https://github.com/github/redacting-logger/actions/workflows/build.yml) [![CodeQL](https://github.com/github/redacting-logger/actions/workflows/codeql-analysis.yml/badge.svg)](https://github.com/github/redacting-logger/actions/workflows/codeql-analysis.yml) [![release](https://github.com/github/redacting-logger/actions/workflows/release.yml/badge.svg)](https://github.com/github/redacting-logger/actions/workflows/release.yml)
+
+A redacting Ruby logger to prevent the leaking of secrets via logs
+
+> This Gem wraps the official Ruby [`logger`](https://github.com/ruby/logger) utility
+
+![Gem](docs/assets/gem.png)
+
+## Installation 💎
+
+You can download this Gem from [GitHub Packages](https://github.com/github/redacting-logger/pkgs/rubygems/redacting-logger) or [RubyGems](https://rubygems.org/gems/redacting-logger)
+
+Via a Gemfile:
+
+```ruby
+source "https://rubygems.org"
+
+gem "redacting-logger", "~> X.X.X" # Replace X.X.X with the latest version
+```
+
+## Usage 💻
+
+### Basic
+
+```ruby
+require "redacting_logger"
+
+# Create a new logger
+logger = RedactingLogger.new(redact_patterns: [/topsecret/])
+
+# Log a message that contains some redacted pattern
+logger.info("This is a topsecret message.")
+```
+
+This will output:
+
+```text
+I, [timestamp]  INFO -- : This is a [REDACTED] message.
+```
+
+### Advanced
+
+```ruby
+require "redacting_logger"
+
+# Create a new logger
+logger = RedactingLogger.new(
+  $stdout, # The device to log to (defaults to $stdout if not provided)
+  redact_patterns: [/REDACTED_PATTERN1/, /REDACTED_PATTERN2/], # An array of Regexp patterns to redact from the logs
+  level: Logger::INFO, # The log level to use
+  redacted_msg: "[REDACTED]", # The message to replace the redacted patterns with
+  use_default_patterns: true # Whether to use the default built-in patterns or not
+)
+
+# Log a message that contains some redacted patterns
+logger.info("This is a message with a REDACTED_PATTERN1 and REDACTED_PATTERN2 in it.")
+```
+
+This will output:
+
+```text
+I, [timestamp]  INFO -- : This is a message with a [REDACTED] and [REDACTED] in it.
+```
+
+## Default Redaction Patterns
+
+This Gem comes pre-built with a few redaction patterns to help you get started. These patterns can be located in [`lib/patterns/default.rb`](lib/patterns/default.rb)
+
+A few examples of these patterns are:
+
+- GitHub Personal Access Tokens
+- GitHub Temporary Actions Tokens
+- RSA Private Keys
+- JWT Tokens
+
+You can disable these default patterns with:
+
+```ruby
+logger = RedactingLogger.new(
+  use_default_patterns: false # Whether to use the default built-in patterns or not
+)
+```

data/lib/patterns/default.rb

@@ -0,0 +1,12 @@
+# frozen_string_literal: true
+
+# This module contains the default patterns to redact.
+module Patterns
+  DEFAULT = [
+    /ghp_[A-Za-z0-9]{36,}|[0-9A-Fa-f]{40,}/, # GitHub Personal Access Token
+    /github_pat_[a-zA-Z0-9]{22}_[a-zA-Z0-9]{59}/, # GitHub Personal Access Token (fine-grained)
+    /ghs_[a-zA-Z0-9]{36}/, # Temporary GitHub Actions Tokens
+    /\b(ey[a-zA-Z0-9]{17,}\.ey[a-zA-Z0-9\/\\_-]{17,}\.(?:[a-zA-Z0-9\/\\_-]{10,}={0,2})?)(?:['|\"|\n|\r|\s|\x60|;]|$)/, # JWT tokens
+    /(?i)-----BEGIN[ A-Z0-9_-]{0,100}PRIVATE KEY( BLOCK)?-----[\s\S-]*KEY( BLOCK)?----/ # private keys
+  ].freeze
+end

data/lib/redacting_logger.rb

@@ -0,0 +1,57 @@
+# frozen_string_literal: true
+
+require "logger"
+require_relative "patterns/default"
+
+# RedactingLogger is a custom logger that extends the standard Logger class.
+# It redacts specified patterns in the log messages.
+class RedactingLogger < Logger
+  # Initializes a new instance of the RedactingLogger class.
+  #
+  # @param logdev [Object] The log device. Defaults to $stdout.
+  # @param shift_age [Integer] The number of old log files to keep.
+  # @param shift_size [Integer] The maximum logfile size.
+  # @param redact_patterns [Array<String>] The patterns to redact from the log messages. Defaults to [].
+  # @param redacted_msg [String] The message to replace the redacted patterns with.
+  # @param use_default_patterns [Boolean] Whether to use the default patterns or not.
+  # @param kwargs [Hash] Additional options to pass to the Logger class.
+  #
+  # logdev, shift_age, and shift_size are all using the defaults from the standard Logger class. -> https://github.com/ruby/logger/blob/0996f90650fd95718f0ffe835b965de18654b71c/lib/logger.rb#L578-L580
+  def initialize(
+    logdev = $stdout,
+    shift_age = 0,
+    shift_size = 1048576,
+    redact_patterns: [],
+    redacted_msg: "[REDACTED]",
+    use_default_patterns: true,
+    **kwargs
+  )
+    super(logdev, shift_age, shift_size, **kwargs)
+    @redact_patterns = redact_patterns
+    @redacted_msg = redacted_msg
+    @redact_patterns += Patterns::DEFAULT if use_default_patterns
+  end
+
+  # Adds a message to the log.
+  #
+  # @param severity [Integer] The severity level of the message.
+  # @param message [String] The message to log.
+  # @param progname [String] The name of the program.
+  def add(severity, message = nil, progname = nil)
+    message, progname = yield if block_given?
+
+    if message
+      @redact_patterns.each do |pattern|
+        message = message.to_s.gsub(pattern, @redacted_msg)
+      end
+    end
+
+    if progname
+      @redact_patterns.each do |pattern|
+        progname = progname.to_s.gsub(pattern, @redacted_msg)
+      end
+    end
+
+    super(severity, message, progname)
+  end
+end

data/lib/version.rb

@@ -0,0 +1,7 @@
+# frozen_string_literal: true
+
+module RedactingLogger
+  module Version
+    VERSION = "1.0.0"
+  end
+end

data/redacting-logger.gemspec

@@ -0,0 +1,31 @@
+# frozen_string_literal: true
+
+require_relative "lib/version"
+
+Gem::Specification.new do |spec|
+  spec.name          = "redacting-logger"
+  spec.version       = RedactingLogger::Version::VERSION
+  spec.authors       = ["GitHub", "GitHub Security"]
+  spec.email         = "opensource@github.com"
+  spec.license       = "MIT"
+
+  spec.summary       = "A redacting Ruby logger to prevent the leaking of secrets via logs"
+  spec.description   = <<~SPEC_DESC
+    A redacting Ruby logger to prevent the leaking of secrets via logs
+  SPEC_DESC
+
+  spec.homepage = "https://github.com/github/redacting-logger"
+  spec.metadata = {
+    "source_code_uri" => "https://github.com/github/redacting-logger",
+    "documentation_uri" => "https://github.com/github/redacting-logger",
+    "bug_tracker_uri" => "https://github.com/github/redacting-logger/issues"
+  }
+
+  spec.add_dependency "logger", "~> 1.6"
+
+  spec.required_ruby_version = Gem::Requirement.new(">= 3.0.0")
+
+  spec.files = %w[LICENSE README.md redacting-logger.gemspec]
+  spec.files += Dir.glob("lib/**/*.rb")
+  spec.require_paths = ["lib"]
+end

metadata

@@ -0,0 +1,68 @@
+--- !ruby/object:Gem::Specification
+name: redacting-logger
+version: !ruby/object:Gem::Version
+  version: 1.0.0
+platform: ruby
+authors:
+- GitHub
+- GitHub Security
+autorequire: 
+bindir: bin
+cert_chain: []
+date: 2023-11-22 00:00:00.000000000 Z
+dependencies:
+- !ruby/object:Gem::Dependency
+  name: logger
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '1.6'
+  type: :runtime
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '1.6'
+description: 'A redacting Ruby logger to prevent the leaking of secrets via logs
+
+  '
+email: opensource@github.com
+executables: []
+extensions: []
+extra_rdoc_files: []
+files:
+- LICENSE
+- README.md
+- lib/patterns/default.rb
+- lib/redacting_logger.rb
+- lib/version.rb
+- redacting-logger.gemspec
+homepage: https://github.com/github/redacting-logger
+licenses:
+- MIT
+metadata:
+  source_code_uri: https://github.com/github/redacting-logger
+  documentation_uri: https://github.com/github/redacting-logger
+  bug_tracker_uri: https://github.com/github/redacting-logger/issues
+post_install_message: 
+rdoc_options: []
+require_paths:
+- lib
+required_ruby_version: !ruby/object:Gem::Requirement
+  requirements:
+  - - ">="
+    - !ruby/object:Gem::Version
+      version: 3.0.0
+required_rubygems_version: !ruby/object:Gem::Requirement
+  requirements:
+  - - ">="
+    - !ruby/object:Gem::Version
+      version: '0'
+requirements: []
+rubygems_version: 3.4.10
+signing_key: 
+specification_version: 4
+summary: A redacting Ruby logger to prevent the leaking of secrets via logs
+test_files: []