@devaccel-labs/app-comments-toolbar 1.1.0 → 1.3.0

package/src/runtime/debug-context-redact.ts

@@ -0,0 +1,259 @@
+/**
+ * Redaction for the debug context file. DOM-free: the toolbar runs it in the browser before upload, the
+ * service runs it again on every stored file, and native clients share it.
+ *
+ * Over-redact rather than under-redact. Every rule here is applied to text an app wrote (console lines, error
+ * messages, response excerpts, store values), so it has to catch secrets and personal data nobody labelled.
+ */
+
+/** A JSON object whose keys are not known ahead: store state, parsed bodies. Values are redacted before use. */
+export type JsonBag = { [key: string]: unknown };
+
+/** Counts what was taken out, so a reader knows something is missing instead of assuming it never happened. */
+export type RedactionTally = { masked: number; dropped: number };
+
+export function newTally(): RedactionTally {
+  return { masked: 0, dropped: 0 };
+}
+
+type Rule = readonly [RegExp, string];
+
+/**
+ * Secrets first, then personal data. Each pattern is global; order matters where one could match inside
+ * another (a JWT before a long token, a card number before a phone number).
+ */
+const RULES: readonly Rule[] = [
+  [/-----BEGIN [A-Z ]*PRIVATE KEY-----[\s\S]*?(?:-----END [A-Z ]*PRIVATE KEY-----|$)/g, "[secret]"],
+  [/\bbearer\s+[a-z0-9._~+/=-]{8,}/gi, "Bearer [secret]"],
+  [/\bbasic\s+[a-z0-9+/=]{12,}/gi, "Basic [secret]"],
+  [/\beyJ[a-zA-Z0-9_-]{8,}\.[a-zA-Z0-9_-]{8,}\.[a-zA-Z0-9_-]{8,}\b/g, "[secret]"],
+  [/\b(?:sk|pk|rk)_(?:live|test)_[a-zA-Z0-9]{8,}\b/g, "[secret]"],
+  [/\b(?:AKIA|ASIA)[0-9A-Z]{16}\b/g, "[secret]"],
+  [/\bgh[pousr]_[A-Za-z0-9]{30,}\b/g, "[secret]"],
+  [/\bgithub_pat_[A-Za-z0-9_]{30,}\b/g, "[secret]"],
+  [/\bxox[abposr]-[A-Za-z0-9-]{10,}\b/g, "[secret]"],
+  [/\bAIza[0-9A-Za-z_-]{35}\b/g, "[secret]"],
+  [/\b(?:ct|ctc|ctk)_[A-Za-z0-9_]{12,}\b/g, "[secret]"],
+  [/\bsk-(?:proj-|ant-)?[A-Za-z0-9_-]{20,}\b/g, "[secret]"],
+  // `password=hunter2`, `"api_key": "abc"`, `token: abc` inside free text.
+  [
+    /(["']?\b(?:pass(?:word|wd|phrase)?|pwd|secret|token|api[-_ ]?key|access[-_ ]?key|private[-_ ]?key|client[-_ ]?secret|auth(?:orization)?|session(?:id)?|cookie|otp|cvv|cvc|ssn)\b["']?\s*[:=]\s*)(["']?)(?!\[(?:secret|redacted)\])[^\s"'&,;}]{1,512}\2/gi,
+    "$1$2[secret]$2",
+  ],
+  // user:pass@ in a URL.
+  [/(\b[a-z][a-z0-9+.-]*:\/\/)[^\s/@:]+:[^\s/@]+@/gi, "$1[secret]@"],
+  [/\b[A-Z0-9._%+-]+@[A-Z0-9.-]+\.[A-Z]{2,}\b/gi, "[email]"],
+  [/\b\d{3}-\d{2}-\d{4}\b/g, "[ssn]"],
+  [/\b[A-Z]{2}\d{2}(?: ?[A-Z0-9]{4}){3,7}(?: ?[A-Z0-9]{1,3})?\b/g, "[iban]"],
+  // Octets only up to 255, so a four-part version number such as `142.0.7444.12` survives.
+  [/(?<![\d.])(?:(?:25[0-5]|2[0-4]\d|1?\d?\d)\.){3}(?:25[0-5]|2[0-4]\d|1?\d?\d)(?![\d.])/g, "[ip]"],
+];
+
+/** Card-like digit runs, checked with Luhn so order numbers and timestamps survive. */
+const CARD = /\b(?:\d[ -]?){12,18}\d\b/g;
+/** International or North American phone numbers with separators. Bare digit runs are left (ids). */
+const PHONE = /(?:\+\d{1,3}[\s.-]?)?(?:\(\d{2,4}\)[\s.-]?|\b\d{2,4}[\s.-])\d{3,4}[\s.-]\d{3,4}\b/g;
+
+function luhn(digits: string) {
+  let sum = 0;
+  let double = false;
+  for (let index = digits.length - 1; index >= 0; index -= 1) {
+    let value = digits.charCodeAt(index) - 48;
+    if (double) {
+      value *= 2;
+      if (value > 9) value -= 9;
+    }
+    sum += value;
+    double = !double;
+  }
+  return sum % 10 === 0;
+}
+
+/** Control characters other than tab and newline. */
+const CONTROL = /[\u0000-\u0008\u000b-\u001f\u007f]/g;
+
+/**
+ * `value` with secrets and personal data replaced, control characters removed and cut at `max`. Placeholders
+ * (`[secret]`, `[email]`, …) are stable, so running it twice changes nothing.
+ */
+export function scrubText(value: string, max: number, tally?: RedactionTally): string {
+  let text = value.length > max * 4 ? value.slice(0, max * 4) : value;
+  text = text.replace(CONTROL, "");
+  for (const [pattern, replacement] of RULES) {
+    text = text.replace(pattern, (...match: string[]) => {
+      if (tally) tally.masked += 1;
+      return replacement.replace(/\$(\d)/g, (_, group: string) => match[Number(group)] ?? "");
+    });
+  }
+  text = text.replace(CARD, (found) => {
+    const digits = found.replace(/[ -]/g, "");
+    if (digits.length < 13 || !luhn(digits)) return found;
+    if (tally) tally.masked += 1;
+    return "[card]";
+  });
+  text = text.replace(PHONE, (found) => {
+    if (found.replace(/\D/g, "").length < 9) return found;
+    if (tally) tally.masked += 1;
+    return "[phone]";
+  });
+  return text.length > max ? `${text.slice(0, max - 1)}…` : text;
+}
+
+/** Object keys whose values are never kept, at any depth. */
+export const SENSITIVE_KEY =
+  /pass(?:word|wd|phrase|code)?|pwd|secret|token|credential|api[-_ ]?key|access[-_ ]?key|private[-_ ]?key|auth|session|cookie|csrf|xsrf|\bssn\b|social.?security|\bpin\b|\botp\b|cvv|cvc|card.?number|\bpan\b|iban|account.?number|routing|signature|\bdob\b|birth|^email$|e-?mail|phone|mobile|address|postcode|zip.?code/i;
+
+/** Query keys whose values are never kept. `s` is Comment Tool's own signed-file signature. */
+const SECRET_PARAM =
+  /^s$|token|key|secret|auth|session|password|passwd|sig|code|credential|email|phone|otp/i;
+
+/**
+ * A URL with its userinfo removed, secret-looking query values replaced and the rest scrubbed as text. Same-
+ * origin URLs keep only path and query. Unparseable input is scrubbed as text.
+ */
+export function scrubUrl(
+  value: string,
+  max: number,
+  base?: string,
+  tally?: RedactionTally,
+): string {
+  // Userinfo is cut from the text itself: React Native's URL cannot write `username` or `password`.
+  const bare = value.replace(/^([a-z][a-z0-9+.-]*:\/\/)[^/?#@\s]*@/i, (_, scheme: string) => {
+    if (tally) tally.masked += 1;
+    return scheme;
+  });
+  let url: URL;
+  try {
+    url = new URL(bare, base);
+  } catch {
+    return scrubText(bare, max, tally);
+  }
+  const params = [...url.searchParams.keys()];
+  const query = new URLSearchParams();
+  for (const name of params) {
+    for (const item of url.searchParams.getAll(name)) {
+      if (SECRET_PARAM.test(name)) {
+        query.append(name, "[redacted]");
+        if (tally) tally.masked += 1;
+      } else query.append(name, item);
+    }
+  }
+  const search = query.toString()
+    ? `?${query.toString().replaceAll("%5Bredacted%5D", "[redacted]")}`
+    : "";
+  let sameOrigin = false;
+  if (base) {
+    try {
+      sameOrigin = new URL(base).origin === url.origin;
+    } catch {
+      sameOrigin = false;
+    }
+  }
+  // A native app's screen URL (`<scheme>://app/<route>`) has no web origin; it keeps its scheme and host.
+  const head = sameOrigin
+    ? ""
+    : /^https?:$/.test(url.protocol)
+      ? url.origin
+      : url.host
+        ? `${url.protocol}//${url.host}`
+        : "";
+  return scrubText(`${head}${url.pathname}${search}`, max, tally);
+}
+
+export type ScrubOptions = {
+  /** Deepest level kept; anything below becomes "[…]". */
+  depth?: number;
+  /** Longest string kept. */
+  text?: number;
+  /** Most entries kept per object or array. */
+  entries?: number;
+  /** Keep only the shape: types and sizes, no values. */
+  shapeOnly?: boolean;
+  tally?: RedactionTally;
+};
+
+/** Any JSON-like value, redacted at every depth: sensitive keys dropped, strings scrubbed, sizes bounded. */
+export function scrubValue(value: unknown, options: ScrubOptions = {}, level = 0): unknown {
+  const depth = options.depth ?? 6;
+  const max = options.text ?? 300;
+  const entries = options.entries ?? 50;
+  const tally = options.tally;
+  if (value === null || value === undefined) return null;
+  if (typeof value === "string")
+    return options.shapeOnly ? `string(${value.length})` : scrubText(value, max, tally);
+  if (typeof value === "number")
+    return options.shapeOnly ? "number" : Number.isFinite(value) ? value : null;
+  if (typeof value === "boolean") return options.shapeOnly ? "boolean" : value;
+  if (typeof value === "bigint") return options.shapeOnly ? "bigint" : value.toString();
+  if (typeof value !== "object") return options.shapeOnly ? typeof value : null;
+  if (level >= depth) {
+    if (tally) tally.dropped += 1;
+    return "[…]";
+  }
+  if (value instanceof Date) return options.shapeOnly ? "date" : value.toISOString();
+  if (value instanceof Map) return scrubValue(Object.fromEntries(value), options, level);
+  if (value instanceof Set) return scrubValue([...value], options, level);
+  if (Array.isArray(value)) {
+    const kept = value.slice(0, entries).map((item) => scrubValue(item, options, level + 1));
+    if (value.length > entries) {
+      kept.push(`[+${value.length - entries} more]`);
+      if (tally) tally.dropped += 1;
+    }
+    return options.shapeOnly ? { array: value.length, of: kept[0] ?? null } : kept;
+  }
+  const out: JsonBag = {};
+  let count = 0;
+  for (const key of Object.keys(value)) {
+    if (count >= entries) {
+      out["[more]"] = Object.keys(value).length - entries;
+      if (tally) tally.dropped += 1;
+      break;
+    }
+    const safeKey = scrubText(key, 80, tally);
+    if (SENSITIVE_KEY.test(key)) {
+      out[safeKey] = "[redacted]";
+      if (tally) tally.masked += 1;
+    } else {
+      let item: unknown;
+      try {
+        item = (value as JsonBag)[key];
+      } catch {
+        item = null;
+      }
+      if (typeof item === "function" || typeof item === "symbol") continue;
+      out[safeKey] = scrubValue(item, options, level + 1);
+    }
+    count += 1;
+  }
+  return out;
+}
+
+/** Response headers whose values are ids that join a request with backend logs. Values are opaque. */
+export const ID_HEADERS: readonly string[] = [
+  "x-request-id",
+  "x-correlation-id",
+  "traceparent",
+  "sentry-trace",
+  "cf-ray",
+  "x-amzn-requestid",
+  "x-amz-request-id",
+  "x-cloud-trace-context",
+  "x-trace-id",
+];
+
+const HEADER_NAME = /^[a-z0-9-]{1,64}$/;
+
+/** The id headers to read: the defaults plus a host's own, lowercased, invalid names dropped. */
+export function idHeaderNames(extra: readonly string[] = []): string[] {
+  const names = new Set(ID_HEADERS);
+  for (const name of extra) {
+    const lower = typeof name === "string" ? name.trim().toLowerCase() : "";
+    if (HEADER_NAME.test(lower) && !SENSITIVE_KEY.test(lower)) names.add(lower);
+  }
+  return [...names];
+}
+
+/** An id header's value: opaque, so only control characters and obvious secrets are removed. */
+export function scrubId(value: string): string {
+  return scrubText(value.trim(), 200);
+}