@meshconnect/uwc-core 1.0.3 → 1.1.0

package/src/observability/scrub.test.ts

@@ -0,0 +1,183 @@
+import { describe, it, expect } from 'vitest'
+import { scrubValue, scrubMessage, scrubArgs } from './scrub'
+
+describe('scrub', () => {
+  it('redacts sensitive object keys (substring match, case-insensitive)', () => {
+    const out = scrubValue({
+      walletPrivateKey: '0xabc',
+      authToken: 'jwt',
+      'x-api-key': 'k',
+      mnemonic: 'a b c',
+      signature: '0xsig',
+      message: 'sign me',
+      chainId: 'eip155:1'
+    }) as Record<string, unknown>
+    expect(out.walletPrivateKey).toBe('[Redacted]')
+    expect(out.authToken).toBe('[Redacted]')
+    expect(out['x-api-key']).toBe('[Redacted]')
+    expect(out.mnemonic).toBe('[Redacted]')
+    expect(out.signature).toBe('[Redacted]')
+    expect(out.message).toBe('[Redacted]')
+    // Non-sensitive keys pass through.
+    expect(out.chainId).toBe('eip155:1')
+  })
+
+  it('redacts secrets embedded in free-form strings (hex blobs, k/v params, bearer)', () => {
+    // EVM address (40 nibbles) and a longer signature/key blob.
+    expect(
+      scrubMessage(
+        'insufficient funds for 0x1234567890abcdef1234567890abcdef12345678'
+      )
+    ).toBe('insufficient funds for 0x[redacted-hex]')
+    expect(
+      scrubMessage('relay https://r.io/?token=abc123secret&chain=1 failed')
+    ).toContain('token=[redacted]')
+    expect(scrubMessage('Authorization: Bearer eyJabc.def-ghi')).toContain(
+      'Bearer [redacted]'
+    )
+  })
+
+  it('redacts a Solana base58 address embedded in a free-form string', () => {
+    const out = scrubMessage(
+      'transfer to EPjFWdd5AufqSSqeM2qN1xzybapC8G4wEGGkZwyTDt1v failed'
+    )
+    expect(out).toContain('[redacted-base58]')
+    expect(out).not.toContain('EPjFWdd5AufqSSqeM2qN1xzybapC8G4wEGGkZwyTDt1v')
+  })
+
+  it('redacts base58 runs LONGER than a bare address (signatures, serialized blobs)', () => {
+    // A Solana signature is ~88 base58 chars. The old `{32,44}\b` rule could
+    // never match a contiguous run >44 chars (no word boundary lands inside a
+    // run), so signatures egressed verbatim — contradicting the documented
+    // over-redaction contract.
+    const sig = 'A2b'.repeat(30) // 90-char base58 run (no 0/O/I/l)
+    const out = scrubMessage(`Transaction ${sig} failed to confirm`)
+    expect(out).not.toContain(sig)
+    expect(out).toContain('[redacted-base58]')
+  })
+
+  it('redacts a base58 address even when GLUED to a base58-excluded word char', () => {
+    // `0`, `O`, `I`, `l`, `_` are word chars OUTSIDE the base58 alphabet: they
+    // break the character class AND defeat a `\b` anchor, so an address glued
+    // to one slipped through. Anchor-free matching closes that shape.
+    const addr = 'EPjFWdd5AufqSSqeM2qN1xzybapC8G4wEGGkZwyTDt1v'
+    expect(scrubMessage(`account_${addr}`)).not.toContain(addr)
+    expect(scrubMessage(`${addr}0suffix`)).not.toContain(addr)
+    expect(scrubMessage(`l${addr}`)).not.toContain(addr)
+  })
+
+  it('redacts raw-form TON addresses (workchain:hex), both 0: and -1:', () => {
+    const raw = '0:' + 'ab12'.repeat(16)
+    const neg = '-1:' + 'ab12'.repeat(16)
+    const out = scrubMessage(`bounce from ${raw} and ${neg}`)
+    expect(out).not.toContain(raw)
+    expect(out).not.toContain(neg)
+    expect(out).toContain('[redacted-ton-address]')
+  })
+
+  it('redacts a raw-form TON address GLUED to word chars (no \\b anchoring)', () => {
+    // Digits and `_` are word chars, so a `\b`-anchored pattern never matched
+    // `account_0:<hex>` — the same glue failure as the base58 case above.
+    const raw = '0:' + 'ab12'.repeat(16)
+    const glued = scrubMessage(`account_${raw}`)
+    expect(glued).not.toContain(raw)
+    expect(glued).toContain('[redacted-ton-address]')
+    expect(scrubMessage(`${raw}_suffix`)).not.toContain(raw)
+  })
+
+  it('does not treat a LONGER hex run as a raw-form TON address', () => {
+    // 65+ hex chars after the colon is some other blob, not a raw address.
+    // (The broad base58 rule may still over-redact it — by design — so assert
+    // only that the TON-specific marker is not applied.)
+    const longer = '0:' + 'ab12'.repeat(16) + 'f'
+    expect(scrubMessage(`id ${longer}`)).not.toContain('[redacted-ton-address]')
+  })
+
+  it('redacts a TON user-friendly address (EQ…/UQ…)', () => {
+    const ton = 'EQ' + 'D'.repeat(46)
+    expect(scrubMessage(`bounce from ${ton}`)).toContain(
+      '[redacted-ton-address]'
+    )
+    const uq = 'UQ' + 'a'.repeat(46)
+    expect(scrubMessage(`to ${uq}`)).toContain('[redacted-ton-address]')
+  })
+
+  it('does not redact a short ordinary word', () => {
+    expect(scrubMessage('transfer failed: insufficient balance')).toBe(
+      'transfer failed: insufficient balance'
+    )
+  })
+
+  it('redacts embedded secrets inside object string values too', () => {
+    const out = scrubValue({
+      note: 'sent to 0xabcdefabcdefabcdefabcdefabcdefabcdefabcd'
+    }) as Record<string, unknown>
+    expect(out.note).toBe('sent to 0x[redacted-hex]')
+  })
+
+  it('caps long strings', () => {
+    // '0' is outside the base58 alphabet, so this exercises the cap alone.
+    const long = '0'.repeat(600)
+    const out = scrubMessage(long)
+    expect(out.length).toBeLessThan(600)
+    expect(out.endsWith('…[truncated]')).toBe(true)
+  })
+
+  it('redacts a hex blob before the length cap can slice it (no surviving tail)', () => {
+    // The secret must be redacted whole BEFORE truncation — never sliced so a
+    // partial address survives the cut. The address sits past the 500-char cap.
+    const addr = '0x' + 'a'.repeat(40)
+    const out = scrubMessage('y'.repeat(600) + addr)
+    expect(out).not.toContain(addr)
+    // And when the placeholder fits, it's present (redaction actually ran).
+    const out2 = scrubMessage('y'.repeat(100) + addr + 'z'.repeat(600))
+    expect(out2).not.toContain(addr)
+    expect(out2).toContain('0x[redacted-hex]')
+  })
+
+  it('uses a null prototype so __proto__ keys cannot pollute Object.prototype', () => {
+    const malicious = JSON.parse('{"__proto__": {"polluted": true}}')
+    const out = scrubValue(malicious) as Record<string, unknown>
+    expect(Object.getPrototypeOf(out)).toBeNull()
+    expect(({} as Record<string, unknown>).polluted).toBeUndefined()
+  })
+
+  it('renders bigint, function and symbol inertly', () => {
+    expect(scrubValue(10n)).toBe('10')
+    expect(scrubValue(() => 1)).toBe('[function]')
+    expect(scrubValue(Symbol('s'))).toBe('[symbol]')
+  })
+
+  it('reduces Error instances to name + message (no stack)', () => {
+    const out = scrubValue(new Error('kaboom')) as Record<string, unknown>
+    expect(out).toEqual({ name: 'Error', message: 'kaboom' })
+    // Same null-prototype guarantee as the generic object branch.
+    expect(Object.getPrototypeOf(out)).toBe(null)
+    expect(out.stack).toBeUndefined()
+  })
+
+  it('stops recursing past max depth', () => {
+    const deep = { a: { b: { c: { d: { e: { f: 1 } } } } } }
+    const out = scrubValue(deep) as Record<string, unknown>
+    // 5 levels down we hit the cap.
+    const a = out.a as Record<string, unknown>
+    const b = a.b as Record<string, unknown>
+    const c = b.c as Record<string, unknown>
+    const d = c.d as Record<string, unknown>
+    expect(d.e).toBe('[Truncated: max depth]')
+  })
+
+  it('scrubArgs maps every arg', () => {
+    const out = scrubArgs(['ok', { secret: 's', id: 1 }])
+    expect(out[0]).toBe('ok')
+    expect((out[1] as Record<string, unknown>).secret).toBe('[Redacted]')
+    expect((out[1] as Record<string, unknown>).id).toBe(1)
+  })
+
+  it('passes null/undefined/primitives through', () => {
+    expect(scrubValue(null)).toBeNull()
+    expect(scrubValue(undefined)).toBeUndefined()
+    expect(scrubValue(true)).toBe(true)
+    expect(scrubValue(5)).toBe(5)
+  })
+})

package/src/observability/scrub.ts

@@ -0,0 +1,174 @@
+/**
+ * PII / secret scrubber for data leaving UWC through the observer seam.
+ *
+ * Security-first: the normalized `UWCTelemetryEvent` excludes signing payloads
+ * and addresses by construction — its STRUCTURED fields have no slot for them
+ * (§ telemetry.ts). This scrubber is the second line of defence for the two
+ * surfaces that CAN still carry free-form data on the observer path: the
+ * `WalletError.message` forwarded to `observer.onEvent`, and the `args` forwarded
+ * to `observer.onLog`. (The console / custom-logger sink receives raw data — it's
+ * local, not egress.)
+ *
+ * Two detection layers:
+ *  - KEY-based redaction of sensitive object keys — substring match (not regex),
+ *    avoiding the ReDoS class that Wiz flags on user-input regexes.
+ *  - CONTENT-based redaction of secrets embedded in free-form strings (hex blobs,
+ *    secret k/v params, bearer tokens) — via linear regexes with no nested or
+ *    overlapping quantifiers (see SECRET_CONTENT_PATTERNS), so they carry no
+ *    catastrophic-backtracking risk.
+ */
+
+/**
+ * Separator-free, lower-cased fragments that mark a value as sensitive. Keys are
+ * normalized (separators stripped) before matching, so `walletPrivateKey`,
+ * `private_key`, `x-api-key`, and `authToken` all hit the same short list. This
+ * over-redacts by design (a `security`-first scrubber prefers a false redaction
+ * to a leak).
+ */
+const SENSITIVE_KEY_FRAGMENTS = [
+  'seed',
+  'mnemonic',
+  'privatekey',
+  'secret',
+  'password',
+  'passphrase',
+  'signature',
+  'message',
+  'payload',
+  'token',
+  'apikey',
+  'authorization',
+  'auth'
+]
+
+const MAX_STRING_LENGTH = 500
+const MAX_DEPTH = 4
+const REDACTED = '[Redacted]'
+
+function isSensitiveKey(key: string): boolean {
+  // Strip separators so `private_key` / `x-api-key` normalize to the bare form.
+  const normalized = key.toLowerCase().split('-').join('').split('_').join('')
+  return SENSITIVE_KEY_FRAGMENTS.some(fragment => normalized.includes(fragment))
+}
+
+// Content patterns for secrets embedded in FREE-FORM strings (error messages,
+// log args) where key-based redaction can't reach. All are linear expressions
+// with no nested/overlapping quantifiers, so they carry no catastrophic-
+// backtracking (ReDoS) risk on attacker-controlled input.
+const SECRET_CONTENT_PATTERNS: ReadonlyArray<readonly [RegExp, string]> = [
+  // 0x-prefixed hex blobs: EVM addresses (40 nibbles) and longer
+  // signatures/keys/hashes/calldata (64+). Over-redacts public hashes by design.
+  [/0x[a-fA-F0-9]{40,}/g, '0x[redacted-hex]'],
+  // `secret=…` / `token=…` / `key=…` query-string or k/v fragments.
+  [
+    /\b(token|key|secret|auth|sig|signature|password|passphrase|mnemonic|seed|apikey)=[^\s&"']+/gi,
+    '$1=[redacted]'
+  ],
+  // `Bearer <opaque>` / `Basic <opaque>` authorization values.
+  [/\b(bearer|basic)\s+[A-Za-z0-9._~+/-]+=*/gi, '$1 [redacted]'],
+  // TON user-friendly addresses: `EQ…` / `UQ…` + 46 base64url chars (48 total).
+  // Trailing edge is a negative lookahead, not `\b`: a base64url address can end
+  // in `-`/`_`, where `\b` fails to anchor and the address would slip through.
+  [/\b[EU]Q[A-Za-z0-9_-]{46}(?![A-Za-z0-9_-])/g, '[redacted-ton-address]'],
+  // TON raw-form addresses: `workchain:64-hex` (`0:…`, `-1:…`). Before base58 so
+  // the hex tail gets the specific TON marker, not a generic base58 hit.
+  // Anchor-free like base58 below: digits and `_` are word chars, so a `\b`
+  // never anchors when the address is glued to one (`account_0:…` leaked).
+  // The trailing edge is a hex negative lookahead — a LONGER contiguous hex
+  // run is a different blob, not a 64-hex address.
+  [/-?\d+:[0-9a-fA-F]{64}(?![0-9a-fA-F])/g, '[redacted-ton-address]'],
+  // Solana / generic base58, 32 chars or MORE — bare addresses AND longer blobs
+  // (a signature is ~88 chars, a serialized tx longer still). No upper bound: a
+  // capped quantifier can never match inside a longer contiguous run. No `\b`
+  // anchors either: `0`/`O`/`I`/`l`/`_` are word chars OUTSIDE the base58
+  // alphabet, so they break the class AND defeat a boundary anchor — an address
+  // glued to one (`account_<addr>`) would slip through anchored matching.
+  // Over-redaction inside longer tokens is accepted by design. Placed LAST: it
+  // is the broadest pattern and would otherwise swallow narrower matches above.
+  [/[1-9A-HJ-NP-Za-km-z]{32,}/g, '[redacted-base58]']
+]
+
+/**
+ * Redact secrets that live INSIDE a free-form string. Best-effort and
+ * deliberately conservative toward over-redaction: a wallet error string can
+ * embed an address, a reverted-tx calldata blob, or a URL with a token, none of
+ * which key-based redaction sees.
+ *
+ * Base58 (Solana) and TON addresses (user-friendly `EQ…`/`UQ…` AND the raw
+ * `workchain:hex` form) are redacted as a security gate: a leaked
+ * recipient/wallet address on the egress path is treated as a defect, so we
+ * accept that any base58-looking token of 32+ chars (some ids, tx hashes,
+ * IPFS CIDs) is over-redacted by design. The narrower TON patterns run before
+ * the broad base58 one so TON addresses get the specific marker.
+ *
+ * One documented gap remains: BARE (non-`0x`) hex blobs — a raw 64-char hex
+ * string is far more often a legitimate id/hash than a secret, so only
+ * `0x`-prefixed hex is redacted. Structured telemetry fields never carry
+ * addresses regardless (see telemetry.ts); this pass only hardens the free-form
+ * `error.message` / log-arg surface.
+ */
+function redactSecretsInString(input: string): string {
+  let out = input
+  for (const [pattern, replacement] of SECRET_CONTENT_PATTERNS) {
+    out = out.replace(pattern, replacement)
+  }
+  return out
+}
+
+/**
+ * Recursively copy `value`, redacting sensitive object-keys, capping long
+ * strings, and rendering non-serializable values inert. The returned objects use
+ * a null prototype so a malicious `__proto__`/`constructor` key in attacker-shaped
+ * input can't pollute `Object.prototype` downstream.
+ */
+export function scrubValue(value: unknown, depth = 0): unknown {
+  if (depth > MAX_DEPTH) return '[Truncated: max depth]'
+
+  if (value === null || value === undefined) return value
+
+  const type = typeof value
+  if (type === 'string') {
+    // Redact embedded secrets BEFORE capping, so the cap can't slice a pattern
+    // in half and leak its tail.
+    const str = redactSecretsInString(value as string)
+    return str.length > MAX_STRING_LENGTH
+      ? str.slice(0, MAX_STRING_LENGTH) + '…[truncated]'
+      : str
+  }
+  if (type === 'number' || type === 'boolean') return value
+  if (type === 'bigint') return (value as bigint).toString()
+  if (type === 'function' || type === 'symbol') return `[${type}]`
+
+  if (Array.isArray(value)) {
+    return value.map(item => scrubValue(item, depth + 1))
+  }
+
+  if (type === 'object') {
+    // Error instances carry a useful message but also a stack we don't want.
+    // Null prototype here too — the doc above promises it for every returned
+    // object, and an Error-shaped attacker value lands in this branch.
+    if (value instanceof Error) {
+      const out: Record<string, unknown> = Object.create(null)
+      out['name'] = value.name
+      out['message'] = scrubValue(value.message, depth + 1)
+      return out
+    }
+    const out: Record<string, unknown> = Object.create(null)
+    for (const [key, val] of Object.entries(value as Record<string, unknown>)) {
+      out[key] = isSensitiveKey(key) ? REDACTED : scrubValue(val, depth + 1)
+    }
+    return out
+  }
+
+  return '[Unserializable]'
+}
+
+/** Scrub a free-form error message (string in → capped string out). */
+export function scrubMessage(message: string): string {
+  return scrubValue(message) as string
+}
+
+/** Scrub a variadic `args` array before it reaches `observer.onLog`. */
+export function scrubArgs(args: unknown[]): unknown[] {
+  return args.map(arg => scrubValue(arg))
+}