@dynamicu/chromedebug-mcp 2.2.0

package/chrome-extension/pii-redactor.js

@@ -0,0 +1,405 @@
+// PII Redactor for Chrome Debug Full Data Recording
+// Sanitizes sensitive information before data leaves the client
+
+class PIIRedactor {
+  constructor() {
+    // Regex patterns for common PII
+    this.patterns = {
+      email: /\b[A-Za-z0-9._%+-]+@[A-Za-z0-9.-]+\.[A-Z|a-z]{2,}\b/g,
+      phone: /(\+?\d{1,3}[-.\s]?)?\(?\d{1,4}\)?[-.\s]?\d{1,4}[-.\s]?\d{1,9}/g,
+      ssn: /\b\d{3}-\d{2}-\d{4}\b|\b\d{9}\b/g,
+      creditCard: /\b(?:\d{4}[-\s]?){3}\d{4}\b/g,
+      ipAddress: /\b(?:\d{1,3}\.){3}\d{1,3}\b/g,
+      apiKey: /\b[A-Za-z0-9]{32,}\b/g, // Common API key pattern
+      jwt: /\beyJ[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\b/g,
+      password: /password["\s]*[:=]["\s]*[^",\s}]+/gi,
+      token: /token["\s]*[:=]["\s]*[^",\s}]+/gi,
+      secret: /secret["\s]*[:=]["\s]*[^",\s}]+/gi
+    };
+    
+    // CSS selectors for sensitive elements
+    this.sensitiveSelectors = [
+      'input[type="password"]',
+      'input[type="email"]',
+      'input[name*="password"]',
+      'input[name*="pwd"]',
+      'input[name*="email"]',
+      'input[name*="ssn"]',
+      'input[name*="credit"]',
+      'input[name*="card"]',
+      'input[name*="cvv"]',
+      'input[name*="account"]',
+      'input[name*="routing"]',
+      '[data-sensitive="true"]',
+      '[data-pii="true"]'
+    ];
+    
+    // Custom redaction rules (user-configurable)
+    this.customRules = [];
+    this.loadCustomRules();
+  }
+  
+  async loadCustomRules() {
+    if (chrome?.storage?.local) {
+      chrome.storage.local.get(['piiCustomRules'], (result) => {
+        if (result.piiCustomRules) {
+          this.customRules = result.piiCustomRules;
+        }
+      });
+    }
+  }
+  
+  redactText(text) {
+    if (!text || typeof text !== 'string') return text;
+    
+    let redacted = text;
+    
+    // Apply standard patterns
+    for (const [type, pattern] of Object.entries(this.patterns)) {
+      redacted = redacted.replace(pattern, (match) => {
+        return this.maskValue(match, type);
+      });
+    }
+    
+    // Apply custom rules
+    for (const rule of this.customRules) {
+      if (rule.pattern && rule.enabled) {
+        try {
+          const regex = new RegExp(rule.pattern, rule.flags || 'gi');
+          redacted = redacted.replace(regex, (match) => {
+            return this.maskValue(match, 'custom');
+          });
+        } catch (error) {
+          console.error('[PIIRedactor] Invalid custom regex:', error);
+        }
+      }
+    }
+    
+    return redacted;
+  }
+  
+  redactObject(obj, depth = 0, maxDepth = 10) {
+    if (depth > maxDepth) return '[MAX_DEPTH_EXCEEDED]';
+    if (!obj) return obj;
+    
+    // Handle different types
+    if (typeof obj === 'string') {
+      return this.redactText(obj);
+    }
+    
+    if (Array.isArray(obj)) {
+      return obj.map(item => this.redactObject(item, depth + 1, maxDepth));
+    }
+    
+    if (typeof obj === 'object') {
+      const redacted = {};
+      
+      for (const [key, value] of Object.entries(obj)) {
+        // Check if key indicates sensitive data
+        if (this.isSensitiveKey(key)) {
+          redacted[key] = this.maskValue(value, 'sensitive');
+        } else {
+          redacted[key] = this.redactObject(value, depth + 1, maxDepth);
+        }
+      }
+      
+      return redacted;
+    }
+    
+    return obj;
+  }
+  
+  redactDOMSnapshot(domData) {
+    if (!domData) return domData;
+    
+    const redacted = { ...domData };
+    
+    // Redact form values
+    if (redacted.forms) {
+      redacted.forms = redacted.forms.map(form => {
+        const redactedForm = { ...form };
+        
+        if (redactedForm.fields) {
+          redactedForm.fields = redactedForm.fields.map(field => {
+            if (this.isFieldSensitive(field)) {
+              return {
+                ...field,
+                value: this.maskValue(field.value, 'form-field')
+              };
+            }
+            return field;
+          });
+        }
+        
+        return redactedForm;
+      });
+    }
+    
+    // Redact text content
+    if (redacted.textContent) {
+      redacted.textContent = this.redactText(redacted.textContent);
+    }
+    
+    // Redact HTML if present
+    if (redacted.html) {
+      redacted.html = this.redactHTML(redacted.html);
+    }
+    
+    return redacted;
+  }
+  
+  redactHTML(html) {
+    if (!html || typeof html !== 'string') return html;
+    
+    // Create a temporary DOM element to parse HTML
+    const tempDiv = document.createElement('div');
+    tempDiv.innerHTML = html;
+    
+    // Find and redact sensitive elements
+    const sensitiveElements = tempDiv.querySelectorAll(this.sensitiveSelectors.join(','));
+    
+    sensitiveElements.forEach(element => {
+      if (element.value) {
+        element.value = this.maskValue(element.value, 'html-input');
+      }
+      if (element.textContent) {
+        element.textContent = this.redactText(element.textContent);
+      }
+    });
+    
+    // Redact all text nodes
+    const walker = document.createTreeWalker(
+      tempDiv,
+      NodeFilter.SHOW_TEXT,
+      null,
+      false
+    );
+    
+    const textNodes = [];
+    while (walker.nextNode()) {
+      textNodes.push(walker.currentNode);
+    }
+    
+    textNodes.forEach(node => {
+      node.textContent = this.redactText(node.textContent);
+    });
+    
+    return tempDiv.innerHTML;
+  }
+  
+  redactNetworkRequest(request) {
+    if (!request) return request;
+    
+    const redacted = { ...request };
+    
+    // Redact headers
+    if (redacted.headers) {
+      redacted.headers = this.redactHeaders(redacted.headers);
+    }
+    
+    // Redact body
+    if (redacted.body) {
+      if (typeof redacted.body === 'string') {
+        redacted.body = this.redactText(redacted.body);
+      } else {
+        redacted.body = this.redactObject(redacted.body);
+      }
+    }
+    
+    // Redact URL query parameters
+    if (redacted.url) {
+      redacted.url = this.redactURL(redacted.url);
+    }
+    
+    return redacted;
+  }
+  
+  redactHeaders(headers) {
+    if (!headers) return headers;
+    
+    const sensitiveHeaders = [
+      'authorization',
+      'cookie',
+      'x-api-key',
+      'x-auth-token',
+      'x-csrf-token',
+      'x-access-token'
+    ];
+    
+    const redacted = { ...headers };
+    
+    for (const [key, value] of Object.entries(redacted)) {
+      const lowerKey = key.toLowerCase();
+      
+      if (sensitiveHeaders.some(h => lowerKey.includes(h))) {
+        redacted[key] = this.maskValue(value, 'header');
+      } else {
+        redacted[key] = this.redactText(value);
+      }
+    }
+    
+    return redacted;
+  }
+  
+  redactURL(url) {
+    if (!url || typeof url !== 'string') return url;
+    
+    try {
+      const urlObj = new URL(url);
+      
+      // Redact query parameters
+      const params = new URLSearchParams(urlObj.search);
+      const redactedParams = new URLSearchParams();
+      
+      for (const [key, value] of params) {
+        if (this.isSensitiveKey(key)) {
+          redactedParams.set(key, this.maskValue(value, 'url-param'));
+        } else {
+          redactedParams.set(key, this.redactText(value));
+        }
+      }
+      
+      urlObj.search = redactedParams.toString();
+      return urlObj.toString();
+    } catch (error) {
+      // If URL parsing fails, just redact as text
+      return this.redactText(url);
+    }
+  }
+  
+  isSensitiveKey(key) {
+    if (!key || typeof key !== 'string') return false;
+    
+    const lowerKey = key.toLowerCase();
+    const sensitiveKeywords = [
+      'password',
+      'pwd',
+      'pass',
+      'secret',
+      'token',
+      'key',
+      'api',
+      'auth',
+      'credit',
+      'card',
+      'cvv',
+      'ssn',
+      'account',
+      'routing',
+      'pin'
+    ];
+    
+    return sensitiveKeywords.some(keyword => lowerKey.includes(keyword));
+  }
+  
+  isFieldSensitive(field) {
+    if (!field) return false;
+    
+    // Check field type
+    if (field.type === 'password' || field.type === 'email') {
+      return true;
+    }
+    
+    // Check field name
+    if (field.name && this.isSensitiveKey(field.name)) {
+      return true;
+    }
+    
+    // Check field ID
+    if (field.id && this.isSensitiveKey(field.id)) {
+      return true;
+    }
+    
+    return false;
+  }
+  
+  maskValue(value, type = 'generic') {
+    if (!value) return value;
+    
+    const str = String(value);
+    const len = str.length;
+    
+    // Different masking strategies based on type
+    switch (type) {
+      case 'email':
+        const atIndex = str.indexOf('@');
+        if (atIndex > 1) {
+          return str[0] + '*'.repeat(atIndex - 1) + str.substring(atIndex);
+        }
+        break;
+        
+      case 'creditCard':
+        if (len >= 12) {
+          return '*'.repeat(len - 4) + str.substring(len - 4);
+        }
+        break;
+        
+      case 'phone':
+        if (len >= 10) {
+          return '*'.repeat(len - 4) + str.substring(len - 4);
+        }
+        break;
+        
+      case 'ssn':
+        return '***-**-' + (len >= 4 ? str.substring(len - 4) : '****');
+        
+      case 'password':
+      case 'token':
+      case 'secret':
+      case 'apiKey':
+      case 'jwt':
+        return '[REDACTED]';
+        
+      default:
+        // Generic masking - show first and last character if long enough
+        if (len > 4) {
+          return str[0] + '*'.repeat(len - 2) + str[len - 1];
+        }
+    }
+    
+    // Fallback to complete masking
+    return '*'.repeat(len);
+  }
+  
+  // Main redaction method for all data types
+  redactData(data, dataType) {
+    switch (dataType) {
+      case 'dom_mutation':
+      case 'dom_snapshot':
+        return this.redactDOMSnapshot(data);
+        
+      case 'network_request':
+        return this.redactNetworkRequest(data);
+        
+      case 'console_log':
+        if (data.message) {
+          data.message = this.redactText(data.message);
+        }
+        return data;
+        
+      case 'variable_state':
+        if (data.variables) {
+          data.variables = this.redactObject(data.variables);
+        }
+        return data;
+        
+      case 'execution_trace':
+        if (data.arguments) {
+          data.arguments = this.redactObject(data.arguments);
+        }
+        if (data.return_value) {
+          data.return_value = this.redactObject(data.return_value);
+        }
+        return data;
+        
+      default:
+        // Generic object redaction
+        return this.redactObject(data);
+    }
+  }
+}
+
+// Export for use in content and background scripts
+if (typeof module !== 'undefined' && module.exports) {
+  module.exports = PIIRedactor;
+}