@contrail/flexplm 1.7.4-alpha.b869ea5 → 1.7.4

package/lib/util/flexplm-connect.js

@@ -89,9 +89,9 @@ class FlexPLMConnect {
             console.info('vibeEventsURL: ' + vibeEventsURL);
             const logOptions = JSON.parse(JSON.stringify(xferOptions));
             if (logOptions?.headers?.Authorization)
-                logOptions.headers.Authorization = '***masked***';
+                logOptions.headers.Authorization = logOptions?.headers?.Authorization.substring(0, 9);
             if (csrf?.nonce_key)
-                logOptions.headers[csrf.nonce_key] = '***masked***';
+                logOptions.headers[csrf.nonce_key] = csrf.nonce ? `***masked(length:${csrf.nonce.length})***` : '***masked(empty)***';
             console.info('csrfOptions: ' + JSON.stringify(logOptions));
             console.info('Making call to xfer data to FlexPLM');
         }

package/lib/util/flexplm-connect.spec.js

@@ -1,6 +1,7 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 const flexplm_connect_1 = require("./flexplm-connect");
+const app_framework_1 = require("@contrail/app-framework");
 const mockJsonData = { items: [{ id: '123', name: 'test' }] };
 const mockResponse = (status, json = mockJsonData) => ({
     status,
@@ -87,3 +88,36 @@ describe('FlexPLMConnect.getRequest', () => {
         await expect(connect.getRequest()).rejects.toThrow('Error getting json data from FlexPLM: Invalid JSON');
     });
 });
+describe('FlexPLMConnect.sendRequest', () => {
+    it('should mask csrf nonce value in logged request options', async () => {
+        const loggerIsInfoOnSpy = jest.spyOn(app_framework_1.Logger, 'isInfoOn').mockReturnValue(true);
+        const consoleInfoSpy = jest.spyOn(console, 'info').mockImplementation();
+        const csrf = { nonce_key: 'CSRF_NONCE', nonce: 'raw-secret-nonce' };
+        const payload = { id: '123' };
+        const connect = new flexplm_connect_1.FlexPLMConnect(createConfig());
+        await connect.sendRequest(csrf, payload);
+        const csrfOptionsLogMessages = consoleInfoSpy.mock.calls
+            .map(([message]) => String(message ?? ''))
+            .filter(message => message.startsWith('csrfOptions: '));
+        const sendRequestOptionsLogMessage = csrfOptionsLogMessages.find(message => message.includes('"CSRF_NONCE":'));
+        expect(sendRequestOptionsLogMessage).toBeDefined();
+        expect(sendRequestOptionsLogMessage ?? '').not.toContain('raw-secret-nonce');
+        expect(sendRequestOptionsLogMessage ?? '').toContain(`"CSRF_NONCE":"***masked(length:${'raw-secret-nonce'.length})***"`);
+        loggerIsInfoOnSpy.mockRestore();
+        consoleInfoSpy.mockRestore();
+    });
+    it('should log masked(empty) when csrf nonce is empty', async () => {
+        const loggerIsInfoOnSpy = jest.spyOn(app_framework_1.Logger, 'isInfoOn').mockReturnValue(true);
+        const consoleInfoSpy = jest.spyOn(console, 'info').mockImplementation();
+        const csrf = { nonce_key: 'CSRF_NONCE', nonce: '' };
+        const connect = new flexplm_connect_1.FlexPLMConnect(createConfig());
+        await connect.sendRequest(csrf, { id: '123' });
+        const csrfOptionsLog = consoleInfoSpy.mock.calls
+            .map(([message]) => String(message ?? ''))
+            .find(message => message.includes('"CSRF_NONCE":'));
+        expect(csrfOptionsLog).toBeDefined();
+        expect(csrfOptionsLog ?? '').toContain('"CSRF_NONCE":"***masked(empty)***"');
+        loggerIsInfoOnSpy.mockRestore();
+        consoleInfoSpy.mockRestore();
+    });
+});

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@contrail/flexplm",
-  "version": "1.7.4-alpha.b869ea5",
+  "version": "1.7.4",
   "description": "Library used for integration with flexplm.",
   "main": "lib/index.js",
   "types": "lib/index.d.ts",