@dx-do/client 6.3.4 → 6.4.0

package/dist/index.cjs.js

@@ -2036,7 +2036,7 @@ utils$3.reduceDescriptors(AxiosHeaders$1.prototype, ({ value }, key) => {
 
 utils$3.freezeMethods(AxiosHeaders$1);
 
-const REDACTED = '[REDACTED ****]';
+const REDACTED$1 = '[REDACTED ****]';
 
 function hasOwnOrPrototypeToJSON(source) {
   if (utils$3.hasOwnProp(source, 'toJSON')) {
@@ -2091,7 +2091,7 @@ function redactConfig(config, redactKeys) {
 
       result = Object.create(null);
       for (const [key, value] of Object.entries(source)) {
-        const reducedValue = lowerKeys.has(key.toLowerCase()) ? REDACTED : visit(value);
+        const reducedValue = lowerKeys.has(key.toLowerCase()) ? REDACTED$1 : visit(value);
         if (!utils$3.isUndefined(reducedValue)) {
           result[key] = reducedValue;
         }
@@ -14712,6 +14712,18 @@ var setToStringTag = esSetTostringtag;
 var hasOwn$1 = hasown;
 var populate = populate$1;
 
+/**
+ * Escape CR, LF, and `"` in a multipart `name`/`filename` parameter, so a field
+ * name or filename can not break out of its header line to inject headers or
+ * smuggle additional parts. Matches the WHATWG HTML multipart/form-data encoding.
+ *
+ * @param {string} str - the parameter value to escape
+ * @returns {string} the escaped value
+ */
+function escapeHeaderParam(str) {
+  return String(str).replace(/\r/g, '%0D').replace(/\n/g, '%0A').replace(/"/g, '%22');
+}
+
 /**
  * Create readable "multipart/form-data" streams.
  * Can be used to submit forms
@@ -14877,7 +14889,7 @@ FormData$1.prototype._multiPartHeader = function (field, value, options) {
   var contents = '';
   var headers = {
     // add custom disposition as third element or keep it two elements if not
-    'Content-Disposition': ['form-data', 'name="' + field + '"'].concat(contentDisposition || []),
+    'Content-Disposition': ['form-data', 'name="' + escapeHeaderParam(field) + '"'].concat(contentDisposition || []),
     // if no content type. allow it to be empty array
     'Content-Type': [].concat(contentType || [])
   };
@@ -14931,7 +14943,7 @@ FormData$1.prototype._getContentDisposition = function (value, options) { // esl
   }
 
   if (filename) {
-    return 'filename="' + filename + '"';
+    return 'filename="' + escapeHeaderParam(filename) + '"';
   }
 };
 
@@ -61955,6 +61967,99 @@ class StrictMap extends Map {
     }
 }
 
+/**
+ * Redaction helpers for keeping auth tokens and other secrets out of logs.
+ *
+ * Auth tokens live in axios `error.config.headers` — e.g. `Authorization: Bearer
+ * <userToken>` and `X-Asm-Auth: <dxASMToken>`. Anything that serializes a whole
+ * error / config / headers object (`JSON.stringify`, an AxiosError's `.toJSON()`,
+ * `console.log(err)`, or a logger that deep-prints its argument) will spill them.
+ * These helpers strip the secrets before anything is logged or re-thrown.
+ */
+const REDACTED = '[REDACTED]';
+/** Lowercased object-key names whose values must never be logged. */
+const SENSITIVE_KEYS = new Set([
+    'authorization',
+    'x-asm-auth',
+    'cookie',
+    'set-cookie',
+    'proxy-authorization',
+    'usertoken',
+    'dxasmtoken',
+    'tenanttoken',
+    'agenttoken',
+    'accesstoken',
+    'refreshtoken',
+    'password',
+    'apikey',
+    'x-api-key',
+]);
+/** Matches `Bearer <token>` anywhere in a string. */
+const BEARER = /Bearer\s+\S+/gi;
+function redactString(value) {
+    return value.replace(BEARER, `Bearer ${REDACTED}`);
+}
+/**
+ * Returns a deep copy of `value` with sensitive object keys masked and any
+ * `Bearer <token>` substrings scrubbed. Safe to pass anything: it is
+ * circular-reference safe (axios errors are circular), and `Error` instances are
+ * reduced to `{ name, message, stack }` (all scrubbed) so their token-bearing
+ * `config`/`request`/`response` are dropped entirely.
+ */
+function redactValue(value, seen = new WeakSet()) {
+    if (typeof value === 'string')
+        return redactString(value);
+    if (value === null || typeof value !== 'object')
+        return value;
+    if (seen.has(value))
+        return '[Circular]';
+    seen.add(value);
+    if (Array.isArray(value)) {
+        return value.map((entry) => redactValue(entry, seen));
+    }
+    if (value instanceof Error) {
+        return {
+            name: value.name,
+            message: redactString(value.message),
+            stack: value.stack ? redactString(value.stack) : undefined,
+        };
+    }
+    const out = {};
+    for (const [key, entry] of Object.entries(value)) {
+        out[key] = SENSITIVE_KEYS.has(key.toLowerCase())
+            ? REDACTED
+            : redactValue(entry, seen);
+    }
+    return out;
+}
+/**
+ * Strips auth tokens from an (possibly Axios) error IN PLACE and returns it, so it
+ * stays a throwable `Error` with its stack intact but no longer carries the token
+ * in `config.headers`, `response.config.headers`, or the raw request header string.
+ * Non-error / non-axios values are returned unchanged.
+ *
+ * Use this at the axios boundary (a response error interceptor) so every catch,
+ * re-throw, and top-level handler downstream sees a token-free error.
+ */
+function sanitizeAxiosError(err) {
+    if (!err || typeof err !== 'object')
+        return err;
+    const e = err;
+    // Only touch things that look like axios errors.
+    if (!e.isAxiosError && !e.config && !e.response)
+        return err;
+    if (e.config?.headers)
+        e.config.headers = redactValue(e.config.headers);
+    if (e.response?.config?.headers) {
+        e.response.config.headers = redactValue(e.response.config.headers);
+    }
+    // Node's ClientRequest keeps the raw request (incl. the Authorization line) in `_header`.
+    if (e.request && typeof e.request._header === 'string') {
+        e.request._header = redactString(e.request._header);
+    }
+    return err;
+}
+
 /**
  * Service for APM agents: query by name/regex, list names/statuses, traces,
  * thread dumps, and license/device reporting.
@@ -64597,12 +64702,15 @@ class AsmService {
                 baseURL =
                     this.dxSaaSService.dxdoConfiguration.dxConfiguration.dxASMbaseAPIURL;
             }
-            this.localClient = createClient({
+            const client = createClient({
                 baseURL,
                 headers: {
                     'X-Asm-Auth': this.dxSaaSService.dxdoConfiguration.dxConfiguration.dxASMToken,
                 },
             });
+            // Strip the X-Asm-Auth token from any error before it can be logged/propagated.
+            client.instance.interceptors.response.use((response) => response, (error) => Promise.reject(sanitizeAxiosError(error)));
+            this.localClient = client;
         }
         return this.localClient;
     }
@@ -64615,7 +64723,7 @@ class AsmService {
             return foldersList.data;
         })
             .catch((error) => {
-            this.log.error(error);
+            this.log.error('ASM foldersList failed', error instanceof Error ? error.message : String(error));
             throw error;
         });
     }
@@ -67352,56 +67460,47 @@ const coerce$1 = (version, options) => {
 };
 var coerce_1 = coerce$1;
 
-var lrucache;
-var hasRequiredLrucache;
-
-function requireLrucache () {
-	if (hasRequiredLrucache) return lrucache;
-	hasRequiredLrucache = 1;
-
-	class LRUCache {
-	  constructor () {
-	    this.max = 1000;
-	    this.map = new Map();
-	  }
-
-	  get (key) {
-	    const value = this.map.get(key);
-	    if (value === undefined) {
-	      return undefined
-	    } else {
-	      // Remove the key from the map and add it to the end
-	      this.map.delete(key);
-	      this.map.set(key, value);
-	      return value
-	    }
-	  }
+class LRUCache {
+  constructor () {
+    this.max = 1000;
+    this.map = new Map();
+  }
 
-	  delete (key) {
-	    return this.map.delete(key)
-	  }
+  get (key) {
+    const value = this.map.get(key);
+    if (value === undefined) {
+      return undefined
+    } else {
+      // Remove the key from the map and add it to the end
+      this.map.delete(key);
+      this.map.set(key, value);
+      return value
+    }
+  }
 
-	  set (key, value) {
-	    const deleted = this.delete(key);
+  delete (key) {
+    return this.map.delete(key)
+  }
 
-	    if (!deleted && value !== undefined) {
-	      // If cache is full, delete the least recently used item
-	      if (this.map.size >= this.max) {
-	        const firstKey = this.map.keys().next().value;
-	        this.delete(firstKey);
-	      }
+  set (key, value) {
+    const deleted = this.delete(key);
 
-	      this.map.set(key, value);
-	    }
+    if (!deleted && value !== undefined) {
+      // If cache is full, delete the least recently used item
+      if (this.map.size >= this.max) {
+        const firstKey = this.map.keys().next().value;
+        this.delete(firstKey);
+      }
 
-	    return this
-	  }
-	}
+      this.map.set(key, value);
+    }
 
-	lrucache = LRUCache;
-	return lrucache;
+    return this
+  }
 }
 
+var lrucache = LRUCache;
+
 var range;
 var hasRequiredRange;
 
@@ -67623,7 +67722,7 @@ function requireRange () {
 
 	range = Range;
 
-	const LRU = requireLrucache();
+	const LRU = lrucache;
 	const cache = new LRU();
 
 	const parseOptions = parseOptions_1;
@@ -70251,6 +70350,9 @@ class DxSaasService {
             .replace(/-/g, '')
             .toLowerCase();
         this.initializeProxyIfNecessary();
+        // Strip auth tokens from any error this client surfaces, so nothing downstream
+        // (handleAxiosError, re-throws, top-level catches) can log the Authorization header.
+        this._httpClient.interceptors.response.use((response) => response, (error) => Promise.reject(sanitizeAxiosError(error)));
         if (process__namespace.env.DXDO_LOG_REQUESTS) {
             log.info('Logging requests');
             const requestLogFile = process__namespace.env.DXDO_REQUEST_LOG_FILE ??
@@ -71210,20 +71312,21 @@ class DxSaasService {
     }
     static handleAxiosError(reason, isStream = false) {
         if (reason.isAxiosError && reason.response) {
-            DxSaasService.staticLog.debug('[Axios Error  DEBUG]', reason.toJSON());
-            DxSaasService.staticLog.error('[Axios Error  BASIC]', `${reason.request.method} ${reason.config?.url}  ${JSON.stringify(reason.config?.params ?? {})}`);
-            DxSaasService.staticLog.error('[Axios Error HEADER]', `${JSON.stringify(reason.config?.headers)}`);
-            DxSaasService.staticLog.error('[Axios Error   BODY]', reason.config?.data ?? {});
+            // NB: request headers are already token-scrubbed by the response interceptor;
+            // redactValue is belt-and-suspenders in case this is ever called off-path.
+            DxSaasService.staticLog.debug('[Axios Error  DEBUG]', redactValue(reason.toJSON()));
+            DxSaasService.staticLog.error('[Axios Error  BASIC]', `${reason.request.method} ${reason.config?.url}  ${JSON.stringify(redactValue(reason.config?.params ?? {}))}`);
+            DxSaasService.staticLog.error('[Axios Error   BODY]', redactValue(reason.config?.data ?? {}));
             if (isStream) {
                 DxSaasService.staticLog.error(`[Axios Error STATUS] ${reason.response.status} / ${reason.message} `);
             }
             else {
-                DxSaasService.staticLog.error(`[Axios Error STATUS] ${reason.response.status} / ${reason.message} / ${JSON.stringify(reason.response.data)}`);
+                DxSaasService.staticLog.error(`[Axios Error STATUS] ${reason.response.status} / ${reason.message} / ${JSON.stringify(redactValue(reason.response.data))}`);
             }
             return new SimpleHTTPError(reason.response.status, reason.message);
         }
         else
-            return reason; // stupid.
+            return sanitizeAxiosError(reason); // scrub before propagating
     }
     static async legacyAuth(v3Configuration) {
         return this.legacyAxaRequest(v3Configuration, 'GET', 'ess/security/v1/me', false, false);