@oneuptime/common 12.0.12 → 12.0.13

package/build/dist/Server/Utils/LogRedaction.js

@@ -0,0 +1,449 @@
+/*
+ * Centralized, deny-by-default redaction for everything that reaches a log
+ * sink.
+ *
+ * Every log record this process emits is written to three places: process
+ * stdout/stderr, the in-memory recent-log ring buffer that the master-admin
+ * support bundle surfaces, and the configured OpenTelemetry log exporter. A
+ * credential that reaches a log statement therefore lands in three retention
+ * systems at once, and DEBUG is a normal troubleshooting level operators turn
+ * on in production.
+ *
+ * So call sites are not trusted to be careful. Logger runs every message body
+ * and every attribute through here first, at every level, and the rules below
+ * are the single place that decides what a secret looks like. Removing a
+ * careless `logger.debug(requestBody)` is still the right fix at the call
+ * site -- this is the net underneath it.
+ *
+ * Two matching strategies, both applied:
+ *
+ *   1. Structural. Objects are walked recursively and a value is replaced
+ *      whenever its KEY names a credential (`client_secret`, `access_token`,
+ *      `password`, `Authorization`, ...). This is the reliable one: it does
+ *      not care what the value looks like.
+ *
+ *   2. Textual. Strings are swept for credentials that were already flattened
+ *      into text -- `JSON.stringify(req.body)` in a template literal, an OAuth
+ *      callback URL with `?code=`, an `Authorization: Bearer` header dump -- and
+ *      for values that are self-identifying regardless of key (JWTs, Slack
+ *      `xoxb-` tokens, PEM private key blocks).
+ *
+ * Over-redaction is the intended failure mode. Losing a token count from a
+ * debug line costs a little context; leaking a bot token costs the workspace.
+ */
+export const REDACTED = "[REDACTED]";
+// Deep enough for any real log payload, shallow enough to bound the walk.
+const MAX_DEPTH = 12;
+/*
+ * A key is sensitive when its normalized form (lowercased, separators
+ * stripped, so `client_secret`, `clientSecret` and `CLIENT-SECRET` all collapse
+ * to `clientsecret`) CONTAINS one of these fragments. Substring matching is
+ * deliberate: it catches `slackBotAccessToken`, `x-api-key`,
+ * `refresh_token_expires_in` and every other spelling nobody thought to list.
+ */
+const SENSITIVE_KEY_FRAGMENTS = [
+    "password",
+    "passwd",
+    "passphrase",
+    "secret",
+    "token",
+    "credential",
+    "authorization",
+    "cookie",
+    "apikey",
+    "privatekey",
+    "accesskey",
+    "secretkey",
+    "signingkey",
+    "encryptionkey",
+    "assertion",
+    "attestation",
+    "signature",
+    "salt",
+    "otp",
+    "jwt",
+    "bearer",
+    "sessionid",
+    "authcode",
+    "authorizationcode",
+    "verificationcode",
+    "backupcode",
+    "recoverycode",
+    "onetimecode",
+    "logincode",
+    "resetcode",
+];
+/*
+ * Keys that contain a sensitive fragment but never carry the secret itself.
+ * These are worth keeping: LLM token accounting and expiry timestamps are
+ * exactly the sort of thing someone turns DEBUG on to look at.
+ */
+const NON_SENSITIVE_KEYS = new Set([
+    "tokencount",
+    "tokencounts",
+    "tokensused",
+    "totaltokens",
+    "inputtokens",
+    "outputtokens",
+    "prompttokens",
+    "completiontokens",
+    "cachedtokens",
+    "reasoningtokens",
+    "maxtokens",
+    "tokenlimit",
+    "tokenusage",
+    "tokentype",
+    "hastoken",
+    "hasaccesstoken",
+    "hasrefreshtoken",
+    "tokenexpiresat",
+    "tokenexpiry",
+    "accesstokenexpiresat",
+    "refreshtokenexpiresat",
+    "expirestokenat",
+    "isauthorized",
+    "authorizationurl",
+    "authorizationendpoint",
+]);
+/*
+ * Keys whose sensitivity depends on the value. `code` is both the OAuth
+ * authorization code / TOTP code we must never log AND the `ECONNREFUSED` on
+ * every network error, so it is decided by looksLikeSecretCode below.
+ */
+const VALUE_DEPENDENT_KEYS = new Set(["code", "codes"]);
+/*
+ * Keys that are always secret but carry no fragment above -- WebAuthn
+ * assertion material, mostly.
+ */
+const SENSITIVE_EXACT_KEYS = new Set([
+    "pin",
+    "totp",
+    "mfa",
+    "rawid",
+    "clientdatajson",
+    "authenticatordata",
+    "userhandle",
+    "challenge",
+    "twofactorsecret",
+]);
+export const normalizeLogKey = (key) => {
+    return key.toLowerCase().replace(/[^a-z0-9]/g, "");
+};
+/*
+ * Error codes (`ECONNREFUSED`, `ERR_BAD_REQUEST`), exception codes
+ * (`BadDataException`) and short status-ish strings are identifiers, never
+ * credentials. Anything else under a `code` key -- digits (a TOTP), or a long
+ * opaque string with separators (an OAuth authorization code) -- is treated as
+ * a secret.
+ */
+const IDENTIFIER_CODE_REGEX = /^[A-Za-z][A-Za-z0-9]*$/;
+const looksLikeSecretCode = (value) => {
+    if (typeof value === "number") {
+        // HTTP status / exit codes are small; a 6-digit TOTP is not.
+        return Math.abs(value) >= 1000;
+    }
+    if (typeof value !== "string") {
+        return false;
+    }
+    if (value.length === 0) {
+        return false;
+    }
+    return !(IDENTIFIER_CODE_REGEX.test(value) && value.length < 32);
+};
+export const isSensitiveLogKey = (key, value) => {
+    const normalized = normalizeLogKey(key);
+    if (!normalized) {
+        return false;
+    }
+    if (NON_SENSITIVE_KEYS.has(normalized)) {
+        return false;
+    }
+    if (SENSITIVE_EXACT_KEYS.has(normalized)) {
+        return true;
+    }
+    if (VALUE_DEPENDENT_KEYS.has(normalized)) {
+        return looksLikeSecretCode(value);
+    }
+    return SENSITIVE_KEY_FRAGMENTS.some((fragment) => {
+        return normalized.includes(fragment);
+    });
+};
+/*
+ * ---------------------------------------------------------------------------
+ * String rules
+ * ---------------------------------------------------------------------------
+ */
+/*
+ * Credential words as they appear INSIDE text. Kept separate from the key
+ * fragment list because a couple of the structural fragments (`salt`, `otp`)
+ * are too short to match safely against free-form prose.
+ */
+const TEXT_SECRET_WORDS = "password|passwd|passphrase|secret|token|credential|credentials|authorization|cookie|api[_-]?key|private[_-]?key|access[_-]?key|assertion|attestation|signature|raw[_-]?id|client[_-]?data[_-]?json|authenticator[_-]?data|user[_-]?handle|two[_-]?factor[_-]?secret";
+// Bounded, so a long non-matching run cannot blow up on backtracking.
+const KEY_PREFIX = "[A-Za-z0-9_.-]{0,40}";
+const KEY_SUFFIX = "[A-Za-z0-9_.-]{0,40}";
+const STRING_REDACTION_RULES = [
+    {
+        /*
+         * Runs first: a bare `Bearer <token>` with no key in front of it would
+         * otherwise survive every rule below.
+         *
+         * The lookahead requires the value to carry a digit or a separator, so the
+         * scheme words keep working as English -- "Basic authentication failed" and
+         * "Token exchange completed" are log lines, not credentials.
+         */
+        name: "authorization-scheme",
+        regex: /\b(Bearer|Basic|Token)\s+(?=[A-Za-z0-9._~+/=-]*[0-9._~+/=-])[A-Za-z0-9._~+/=-]{8,}/gi,
+        replacement: `$1 ${REDACTED}`,
+    },
+    {
+        /*
+         * JSON string members: {"client_secret":"abc"} -- the shape produced by
+         * JSON.stringify(req.body) inside a log message. The value pattern allows
+         * escaped quotes so an escaped-quote-bearing password cannot end the match
+         * early and leave its tail in the clear.
+         */
+        name: "json-string-member",
+        regex: new RegExp(`"(${KEY_PREFIX}(?:${TEXT_SECRET_WORDS})${KEY_SUFFIX})"(\\s*:\\s*)"(?:[^"\\\\]|\\\\.)*"`, "gi"),
+        replacement: `"$1"$2"${REDACTED}"`,
+    },
+    {
+        // JSON numeric members: {"password":123456}
+        name: "json-number-member",
+        regex: new RegExp(`"(${KEY_PREFIX}(?:${TEXT_SECRET_WORDS})${KEY_SUFFIX})"(\\s*:\\s*)-?\\d+(?:\\.\\d+)?`, "gi"),
+        replacement: `"$1"$2"${REDACTED}"`,
+    },
+    {
+        /*
+         * Unquoted key/value text: form bodies (`client_secret=abc&...`), query
+         * strings, header dumps (`Authorization: Bearer abc`) and prose
+         * (`password: hunter2`).
+         *
+         * The value alternation tries `Bearer <token>` first, so a header dump is
+         * consumed whole -- stopping at the scheme word would leave the token
+         * itself sitting in the clear right after the placeholder.
+         */
+        name: "key-value-text",
+        regex: new RegExp(`\\b(${KEY_PREFIX}(?:${TEXT_SECRET_WORDS})${KEY_SUFFIX})(\\s*[=:]\\s*)(?:"[^"]*"|'[^']*'|(?:Bearer|Basic|Token)\\s+[^\\s,;&)\\]}"']+|[^\\s,;&)\\]}"']+)`, "gi"),
+        replacement: `$1$2${REDACTED}`,
+    },
+    {
+        /*
+         * OAuth authorization codes and OTPs as query/form parameters. Restricted
+         * to the `code=` form so ordinary prose ("error code: ECONNREFUSED") keeps
+         * its meaning -- structural redaction covers the JSON case.
+         */
+        name: "code-parameter",
+        regex: /\b(code|pin|otp|totp)(=)[^\s&#"'<>]+/gi,
+        replacement: `$1$2${REDACTED}`,
+    },
+    {
+        // {"code":"..."} in flattened JSON.
+        name: "json-code-member",
+        regex: /"(code|pin|otp|totp)"(\s*:\s*)"(?:[^"\\]|\\.)*"/gi,
+        replacement: `"$1"$2"${REDACTED}"`,
+    },
+    {
+        name: "jwt",
+        regex: /\beyJ[A-Za-z0-9_-]{5,}\.[A-Za-z0-9_-]{5,}\.[A-Za-z0-9_-]{5,}/g,
+        replacement: REDACTED,
+    },
+    {
+        name: "slack-token",
+        regex: /\bxox[abeprs]-[A-Za-z0-9-]{8,}/gi,
+        replacement: REDACTED,
+    },
+    {
+        name: "slack-app-token",
+        regex: /\bxapp-[A-Za-z0-9-]{8,}/gi,
+        replacement: REDACTED,
+    },
+    {
+        name: "github-token",
+        regex: /\b(?:ghp|gho|ghu|ghs|ghr)_[A-Za-z0-9]{20,}\b|\bgithub_pat_[A-Za-z0-9_]{20,}\b/g,
+        replacement: REDACTED,
+    },
+    {
+        name: "aws-access-key-id",
+        regex: /\b(?:AKIA|ASIA|AGPA|AIDA|AROA|AIPA|ANPA|ANVA|ASCA)[0-9A-Z]{16}\b/g,
+        replacement: REDACTED,
+    },
+    {
+        name: "google-api-key",
+        regex: /\bAIza[0-9A-Za-z_-]{35}\b/g,
+        replacement: REDACTED,
+    },
+    {
+        name: "private-key-block",
+        regex: /-----BEGIN (?:[A-Z0-9]+ )*PRIVATE KEY-----[\s\S]*?-----END (?:[A-Z0-9]+ )*PRIVATE KEY-----/g,
+        replacement: REDACTED,
+    },
+    {
+        // Credentials embedded in a URL: postgres://user:password@host/db
+        name: "url-basic-auth",
+        regex: /\b([a-z][a-z0-9+.-]*:\/\/)([^\s/:@]+):[^\s/@]+@/gi,
+        replacement: `$1$2:${REDACTED}@`,
+    },
+];
+/*
+ * Cheap pre-filter. Almost every log line contains none of these, and skipping
+ * fifteen regexes for those keeps redaction off the cost of ordinary logging.
+ * It must stay a superset of every rule above -- a word missing here is a
+ * credential that never gets redacted.
+ */
+const SENSITIVE_TEXT_HINT_REGEX = new RegExp([
+    TEXT_SECRET_WORDS,
+    "code=",
+    "pin=",
+    "otp=",
+    "totp=",
+    '"code"',
+    '"pin"',
+    '"otp"',
+    '"totp"',
+    "bearer\\s",
+    "basic\\s",
+    "eyJ",
+    "xox",
+    "xapp-",
+    "gh[opusr]_",
+    "github_pat_",
+    "AKIA|ASIA|AGPA|AIDA|AROA|AIPA|ANPA|ANVA|ASCA",
+    "AIza",
+    "-----BEGIN",
+    "://",
+].join("|"), "i");
+export const redactLogString = (value) => {
+    if (!value) {
+        return value;
+    }
+    if (!SENSITIVE_TEXT_HINT_REGEX.test(value)) {
+        return value;
+    }
+    let redacted = value;
+    for (const rule of STRING_REDACTION_RULES) {
+        /*
+         * The rules carry the /g flag and are module-level, so lastIndex has to be
+         * reset -- String.replace does that itself, but .test() on the hint regex
+         * above and any future .test() here would not.
+         */
+        rule.regex.lastIndex = 0;
+        redacted = redacted.replace(rule.regex, rule.replacement);
+    }
+    return redacted;
+};
+const redactValue = (value, depth, seen) => {
+    if (value === null || value === undefined) {
+        return value;
+    }
+    if (typeof value === "string") {
+        return redactLogString(value);
+    }
+    if (typeof value === "number" ||
+        typeof value === "boolean" ||
+        typeof value === "bigint") {
+        return value;
+    }
+    if (typeof value === "function") {
+        return "[Function]";
+    }
+    if (typeof value === "symbol") {
+        return value.toString();
+    }
+    if (value instanceof Date) {
+        return value;
+    }
+    if (typeof Buffer !== "undefined" && Buffer.isBuffer(value)) {
+        // Buffers hold key material as often as they hold anything readable.
+        return `[Buffer ${value.length} bytes]`;
+    }
+    if (depth >= MAX_DEPTH) {
+        return "[Truncated]";
+    }
+    if (seen.has(value)) {
+        return "[Circular]";
+    }
+    seen.add(value);
+    try {
+        if (value instanceof Error) {
+            const redactedError = {
+                name: value.name,
+                message: redactLogString(value.message),
+            };
+            if (value.stack) {
+                redactedError["stack"] = redactLogString(value.stack);
+            }
+            for (const key of Object.keys(value)) {
+                redactedError[key] = isSensitiveLogKey(key, value[key])
+                    ? REDACTED
+                    : redactValue(value[key], depth + 1, seen);
+            }
+            return redactedError;
+        }
+        if (Array.isArray(value)) {
+            return value.map((item) => {
+                return redactValue(item, depth + 1, seen);
+            });
+        }
+        if (value instanceof Map) {
+            const fromMap = {};
+            for (const [mapKey, mapValue] of value.entries()) {
+                const keyAsString = String(mapKey);
+                fromMap[keyAsString] = isSensitiveLogKey(keyAsString, mapValue)
+                    ? REDACTED
+                    : redactValue(mapValue, depth + 1, seen);
+            }
+            return fromMap;
+        }
+        if (value instanceof Set) {
+            return Array.from(value).map((item) => {
+                return redactValue(item, depth + 1, seen);
+            });
+        }
+        /*
+         * Models, ObjectIDs and the other Common types serialize through toJSON.
+         * Honouring it keeps redacted output shaped exactly like what
+         * JSON.stringify would have produced without this pass.
+         */
+        const maybeToJSON = value["toJSON"];
+        if (typeof maybeToJSON === "function") {
+            try {
+                const json = maybeToJSON.call(value);
+                if (json !== value) {
+                    return redactValue(json, depth, seen);
+                }
+            }
+            catch (_a) {
+                // Fall through to the plain-object walk below.
+            }
+        }
+        const redactedObject = {};
+        for (const key of Object.keys(value)) {
+            const propertyValue = value[key];
+            redactedObject[key] = isSensitiveLogKey(key, propertyValue)
+                ? REDACTED
+                : redactValue(propertyValue, depth + 1, seen);
+        }
+        return redactedObject;
+    }
+    finally {
+        /*
+         * Only the path currently being walked is "seen", so a value referenced
+         * twice in a tree is redacted twice instead of being reported as circular.
+         */
+        seen.delete(value);
+    }
+};
+export const redactLogValue = (value) => {
+    try {
+        return redactValue(value, 0, new Set());
+    }
+    catch (_a) {
+        /*
+         * A getter that throws, an exotic proxy... nothing here is worth crashing
+         * a log call for, but the body cannot be passed through unredacted either.
+         */
+        return REDACTED;
+    }
+};
+//# sourceMappingURL=LogRedaction.js.map

package/build/dist/Server/Utils/LogRedaction.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"LogRedaction.js","sourceRoot":"","sources":["../../../../Server/Utils/LogRedaction.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AAEH,MAAM,CAAC,MAAM,QAAQ,GAAW,YAAY,CAAC;AAE7C,0EAA0E;AAC1E,MAAM,SAAS,GAAW,EAAE,CAAC;AAE7B;;;;;;GAMG;AACH,MAAM,uBAAuB,GAAkB;IAC7C,UAAU;IACV,QAAQ;IACR,YAAY;IACZ,QAAQ;IACR,OAAO;IACP,YAAY;IACZ,eAAe;IACf,QAAQ;IACR,QAAQ;IACR,YAAY;IACZ,WAAW;IACX,WAAW;IACX,YAAY;IACZ,eAAe;IACf,WAAW;IACX,aAAa;IACb,WAAW;IACX,MAAM;IACN,KAAK;IACL,KAAK;IACL,QAAQ;IACR,WAAW;IACX,UAAU;IACV,mBAAmB;IACnB,kBAAkB;IAClB,YAAY;IACZ,cAAc;IACd,aAAa;IACb,WAAW;IACX,WAAW;CACZ,CAAC;AAEF;;;;GAIG;AACH,MAAM,kBAAkB,GAAgB,IAAI,GAAG,CAAS;IACtD,YAAY;IACZ,aAAa;IACb,YAAY;IACZ,aAAa;IACb,aAAa;IACb,cAAc;IACd,cAAc;IACd,kBAAkB;IAClB,cAAc;IACd,iBAAiB;IACjB,WAAW;IACX,YAAY;IACZ,YAAY;IACZ,WAAW;IACX,UAAU;IACV,gBAAgB;IAChB,iBAAiB;IACjB,gBAAgB;IAChB,aAAa;IACb,sBAAsB;IACtB,uBAAuB;IACvB,gBAAgB;IAChB,cAAc;IACd,kBAAkB;IAClB,uBAAuB;CACxB,CAAC,CAAC;AAEH;;;;GAIG;AACH,MAAM,oBAAoB,GAAgB,IAAI,GAAG,CAAS,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;AAE7E;;;GAGG;AACH,MAAM,oBAAoB,GAAgB,IAAI,GAAG,CAAS;IACxD,KAAK;IACL,MAAM;IACN,KAAK;IACL,OAAO;IACP,gBAAgB;IAChB,mBAAmB;IACnB,YAAY;IACZ,WAAW;IACX,iBAAiB;CAClB,CAAC,CAAC;AAIH,MAAM,CAAC,MAAM,eAAe,GAA4B,CACtD,GAAW,EACH,EAAE;IACV,OAAO,GAAG,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,YAAY,EAAE,EAAE,CAAC,CAAC;AACrD,CAAC,CAAC;AAEF;;;;;;GAMG;AACH,MAAM,qBAAqB,GAAW,wBAAwB,CAAC;AAI/D,MAAM,mBAAmB,GAAgC,CACvD,KAAc,EACL,EAAE;IACX,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC9B,6DAA6D;QAC7D,OAAO,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,IAAI,CAAC;IACjC,CAAC;IAED,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC9B,OAAO,KAAK,CAAC;IACf,CAAC;IAED,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACvB,OAAO,KAAK,CAAC;IACf,CAAC;IAED,OAAO,CAAC,CAAC,qBAAqB,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,MAAM,GAAG,EAAE,CAAC,CAAC;AACnE,CAAC,CAAC;AAOF,MAAM,CAAC,MAAM,iBAAiB,GAA8B,CAC1D,GAAW,EACX,KAAe,EACN,EAAE;IACX,MAAM,UAAU,GAAW,eAAe,CAAC,GAAG,CAAC,CAAC;IAEhD,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,OAAO,KAAK,CAAC;IACf,CAAC;IAED,IAAI,kBAAkB,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,CAAC;QACvC,OAAO,KAAK,CAAC;IACf,CAAC;IAED,IAAI,oBAAoB,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,CAAC;QACzC,OAAO,IAAI,CAAC;IACd,CAAC;IAED,IAAI,oBAAoB,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,CAAC;QACzC,OAAO,mBAAmB,CAAC,KAAK,CAAC,CAAC;IACpC,CAAC;IAED,OAAO,uBAAuB,CAAC,IAAI,CAAC,CAAC,QAAgB,EAAE,EAAE;QACvD,OAAO,UAAU,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;IACvC,CAAC,CAAC,CAAC;AACL,CAAC,CAAC;AAEF;;;;GAIG;AAEH;;;;GAIG;AACH,MAAM,iBAAiB,GACrB,qQAAqQ,CAAC;AAExQ,sEAAsE;AACtE,MAAM,UAAU,GAAW,sBAAsB,CAAC;AAClD,MAAM,UAAU,GAAW,sBAAsB,CAAC;AAQlD,MAAM,sBAAsB,GAA+B;IACzD;QACE;;;;;;;WAOG;QACH,IAAI,EAAE,sBAAsB;QAC5B,KAAK,EACH,sFAAsF;QACxF,WAAW,EAAE,MAAM,QAAQ,EAAE;KAC9B;IACD;QACE;;;;;WAKG;QACH,IAAI,EAAE,oBAAoB;QAC1B,KAAK,EAAE,IAAI,MAAM,CACf,KAAK,UAAU,MAAM,iBAAiB,IAAI,UAAU,oCAAoC,EACxF,IAAI,CACL;QACD,WAAW,EAAE,UAAU,QAAQ,GAAG;KACnC;IACD;QACE,4CAA4C;QAC5C,IAAI,EAAE,oBAAoB;QAC1B,KAAK,EAAE,IAAI,MAAM,CACf,KAAK,UAAU,MAAM,iBAAiB,IAAI,UAAU,iCAAiC,EACrF,IAAI,CACL;QACD,WAAW,EAAE,UAAU,QAAQ,GAAG;KACnC;IACD;QACE;;;;;;;;WAQG;QACH,IAAI,EAAE,gBAAgB;QACtB,KAAK,EAAE,IAAI,MAAM,CACf,OAAO,UAAU,MAAM,iBAAiB,IAAI,UAAU,kGAAkG,EACxJ,IAAI,CACL;QACD,WAAW,EAAE,OAAO,QAAQ,EAAE;KAC/B;IACD;QACE;;;;WAIG;QACH,IAAI,EAAE,gBAAgB;QACtB,KAAK,EAAE,wCAAwC;QAC/C,WAAW,EAAE,OAAO,QAAQ,EAAE;KAC/B;IACD;QACE,oCAAoC;QACpC,IAAI,EAAE,kBAAkB;QACxB,KAAK,EAAE,mDAAmD;QAC1D,WAAW,EAAE,UAAU,QAAQ,GAAG;KACnC;IACD;QACE,IAAI,EAAE,KAAK;QACX,KAAK,EAAE,+DAA+D;QACtE,WAAW,EAAE,QAAQ;KACtB;IACD;QACE,IAAI,EAAE,aAAa;QACnB,KAAK,EAAE,kCAAkC;QACzC,WAAW,EAAE,QAAQ;KACtB;IACD;QACE,IAAI,EAAE,iBAAiB;QACvB,KAAK,EAAE,2BAA2B;QAClC,WAAW,EAAE,QAAQ;KACtB;IACD;QACE,IAAI,EAAE,cAAc;QACpB,KAAK,EACH,gFAAgF;QAClF,WAAW,EAAE,QAAQ;KACtB;IACD;QACE,IAAI,EAAE,mBAAmB;QACzB,KAAK,EAAE,mEAAmE;QAC1E,WAAW,EAAE,QAAQ;KACtB;IACD;QACE,IAAI,EAAE,gBAAgB;QACtB,KAAK,EAAE,4BAA4B;QACnC,WAAW,EAAE,QAAQ;KACtB;IACD;QACE,IAAI,EAAE,mBAAmB;QACzB,KAAK,EACH,6FAA6F;QAC/F,WAAW,EAAE,QAAQ;KACtB;IACD;QACE,kEAAkE;QAClE,IAAI,EAAE,gBAAgB;QACtB,KAAK,EAAE,mDAAmD;QAC1D,WAAW,EAAE,QAAQ,QAAQ,GAAG;KACjC;CACF,CAAC;AAEF;;;;;GAKG;AACH,MAAM,yBAAyB,GAAW,IAAI,MAAM,CAClD;IACE,iBAAiB;IACjB,OAAO;IACP,MAAM;IACN,MAAM;IACN,OAAO;IACP,QAAQ;IACR,OAAO;IACP,OAAO;IACP,QAAQ;IACR,WAAW;IACX,UAAU;IACV,KAAK;IACL,KAAK;IACL,OAAO;IACP,YAAY;IACZ,aAAa;IACb,8CAA8C;IAC9C,MAAM;IACN,YAAY;IACZ,KAAK;CACN,CAAC,IAAI,CAAC,GAAG,CAAC,EACX,GAAG,CACJ,CAAC;AAIF,MAAM,CAAC,MAAM,eAAe,GAA4B,CACtD,KAAa,EACL,EAAE;IACV,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,OAAO,KAAK,CAAC;IACf,CAAC;IAED,IAAI,CAAC,yBAAyB,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QAC3C,OAAO,KAAK,CAAC;IACf,CAAC;IAED,IAAI,QAAQ,GAAW,KAAK,CAAC;IAE7B,KAAK,MAAM,IAAI,IAAI,sBAAsB,EAAE,CAAC;QAC1C;;;;WAIG;QACH,IAAI,CAAC,KAAK,CAAC,SAAS,GAAG,CAAC,CAAC;QACzB,QAAQ,GAAG,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,WAAW,CAAC,CAAC;IAC5D,CAAC;IAED,OAAO,QAAQ,CAAC;AAClB,CAAC,CAAC;AAcF,MAAM,WAAW,GAAwB,CACvC,KAAc,EACd,KAAa,EACb,IAAkB,EACT,EAAE;IACX,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QAC1C,OAAO,KAAK,CAAC;IACf,CAAC;IAED,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC9B,OAAO,eAAe,CAAC,KAAK,CAAC,CAAC;IAChC,CAAC;IAED,IACE,OAAO,KAAK,KAAK,QAAQ;QACzB,OAAO,KAAK,KAAK,SAAS;QAC1B,OAAO,KAAK,KAAK,QAAQ,EACzB,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;IAED,IAAI,OAAO,KAAK,KAAK,UAAU,EAAE,CAAC;QAChC,OAAO,YAAY,CAAC;IACtB,CAAC;IAED,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC9B,OAAO,KAAK,CAAC,QAAQ,EAAE,CAAC;IAC1B,CAAC;IAED,IAAI,KAAK,YAAY,IAAI,EAAE,CAAC;QAC1B,OAAO,KAAK,CAAC;IACf,CAAC;IAED,IAAI,OAAO,MAAM,KAAK,WAAW,IAAI,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;QAC5D,qEAAqE;QACrE,OAAO,WAAW,KAAK,CAAC,MAAM,SAAS,CAAC;IAC1C,CAAC;IAED,IAAI,KAAK,IAAI,SAAS,EAAE,CAAC;QACvB,OAAO,aAAa,CAAC;IACvB,CAAC;IAED,IAAI,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;QACpB,OAAO,YAAY,CAAC;IACtB,CAAC;IAED,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;IAEhB,IAAI,CAAC;QACH,IAAI,KAAK,YAAY,KAAK,EAAE,CAAC;YAC3B,MAAM,aAAa,GAA4B;gBAC7C,IAAI,EAAE,KAAK,CAAC,IAAI;gBAChB,OAAO,EAAE,eAAe,CAAC,KAAK,CAAC,OAAO,CAAC;aACxC,CAAC;YAEF,IAAI,KAAK,CAAC,KAAK,EAAE,CAAC;gBAChB,aAAa,CAAC,OAAO,CAAC,GAAG,eAAe,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;YACxD,CAAC;YAED,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;gBACrC,aAAa,CAAC,GAAG,CAAC,GAAG,iBAAiB,CACpC,GAAG,EACF,KAA4C,CAAC,GAAG,CAAC,CACnD;oBACC,CAAC,CAAC,QAAQ;oBACV,CAAC,CAAC,WAAW,CACR,KAA4C,CAAC,GAAG,CAAC,EAClD,KAAK,GAAG,CAAC,EACT,IAAI,CACL,CAAC;YACR,CAAC;YAED,OAAO,aAAa,CAAC;QACvB,CAAC;QAED,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;YACzB,OAAO,KAAK,CAAC,GAAG,CAAC,CAAC,IAAa,EAAE,EAAE;gBACjC,OAAO,WAAW,CAAC,IAAI,EAAE,KAAK,GAAG,CAAC,EAAE,IAAI,CAAC,CAAC;YAC5C,CAAC,CAAC,CAAC;QACL,CAAC;QAED,IAAI,KAAK,YAAY,GAAG,EAAE,CAAC;YACzB,MAAM,OAAO,GAA4B,EAAE,CAAC;YAE5C,KAAK,MAAM,CAAC,MAAM,EAAE,QAAQ,CAAC,IAAI,KAAK,CAAC,OAAO,EAAE,EAAE,CAAC;gBACjD,MAAM,WAAW,GAAW,MAAM,CAAC,MAAM,CAAC,CAAC;gBAE3C,OAAO,CAAC,WAAW,CAAC,GAAG,iBAAiB,CAAC,WAAW,EAAE,QAAQ,CAAC;oBAC7D,CAAC,CAAC,QAAQ;oBACV,CAAC,CAAC,WAAW,CAAC,QAAQ,EAAE,KAAK,GAAG,CAAC,EAAE,IAAI,CAAC,CAAC;YAC7C,CAAC;YAED,OAAO,OAAO,CAAC;QACjB,CAAC;QAED,IAAI,KAAK,YAAY,GAAG,EAAE,CAAC;YACzB,OAAO,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,IAAa,EAAE,EAAE;gBAC7C,OAAO,WAAW,CAAC,IAAI,EAAE,KAAK,GAAG,CAAC,EAAE,IAAI,CAAC,CAAC;YAC5C,CAAC,CAAC,CAAC;QACL,CAAC;QAED;;;;WAIG;QACH,MAAM,WAAW,GAAa,KAAiC,CAAC,QAAQ,CAAC,CAAC;QAE1E,IAAI,OAAO,WAAW,KAAK,UAAU,EAAE,CAAC;YACtC,IAAI,CAAC;gBACH,MAAM,IAAI,GAAa,WAA6B,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;gBAEjE,IAAI,IAAI,KAAK,KAAK,EAAE,CAAC;oBACnB,OAAO,WAAW,CAAC,IAAI,EAAE,KAAK,EAAE,IAAI,CAAC,CAAC;gBACxC,CAAC;YACH,CAAC;YAAC,WAAM,CAAC;gBACP,+CAA+C;YACjD,CAAC;QACH,CAAC;QAED,MAAM,cAAc,GAA4B,EAAE,CAAC;QAEnD,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,KAAgC,CAAC,EAAE,CAAC;YAChE,MAAM,aAAa,GAAa,KAAiC,CAAC,GAAG,CAAC,CAAC;YAEvE,cAAc,CAAC,GAAG,CAAC,GAAG,iBAAiB,CAAC,GAAG,EAAE,aAAa,CAAC;gBACzD,CAAC,CAAC,QAAQ;gBACV,CAAC,CAAC,WAAW,CAAC,aAAa,EAAE,KAAK,GAAG,CAAC,EAAE,IAAI,CAAC,CAAC;QAClD,CAAC;QAED,OAAO,cAAc,CAAC;IACxB,CAAC;YAAS,CAAC;QACT;;;WAGG;QACH,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IACrB,CAAC;AACH,CAAC,CAAC;AAQF,MAAM,CAAC,MAAM,cAAc,GAA2B,CACpD,KAAc,EACL,EAAE;IACX,IAAI,CAAC;QACH,OAAO,WAAW,CAAC,KAAK,EAAE,CAAC,EAAE,IAAI,GAAG,EAAW,CAAC,CAAC;IACnD,CAAC;IAAC,WAAM,CAAC;QACP;;;WAGG;QACH,OAAO,QAAQ,CAAC;IAClB,CAAC;AACH,CAAC,CAAC"}

package/build/dist/Server/Utils/Logger.js

@@ -4,6 +4,7 @@ import TelemetryContext from "./Telemetry/TelemetryContext";
 import { SeverityNumber } from "@opentelemetry/api-logs";
 import Exception from "../../Types/Exception/Exception";
 import ConfigLogLevel from "../Types/ConfigLogLevel";
+import { REDACTED, isSensitiveLogKey, redactLogString, redactLogValue, } from "./LogRedaction";
 export function getLogAttributesFromRequest(req) {
     var _a;
     if (!req) {
@@ -27,9 +28,10 @@ export function getLogAttributesFromRequest(req) {
     }
 }
 class logger {
+    // `body` has already been through redactBody -- see the level methods.
     static record(level, body) {
         try {
-            const message = this.serializeLogBody(body);
+            const message = this.serializeRedactedBody(body);
             this.recentLogs.push({
                 time: new Date().toISOString(),
                 level: level,
@@ -64,14 +66,66 @@ class logger {
         }
         return LogLevel;
     }
-    static serializeLogBody(body) {
-        if (typeof body === "string") {
-            return body;
+    /*
+     * Turns a body into a redacted copy, once, before it is handed to any sink.
+     * Every level method calls this and then passes the RESULT to console, to
+     * the recent-log buffer and to telemetry, so a log record is redacted a
+     * single time no matter how many places it ends up in.
+     *
+     * Objects come back as plain redacted copies, so console keeps printing them
+     * as objects rather than as a JSON string.
+     *
+     * Errors are special-cased: when nothing in the message or the stack needed
+     * redacting -- the overwhelmingly common case -- the original Error is
+     * returned untouched, so console still renders a real stack trace.
+     */
+    static redactBody(body) {
+        try {
+            if (typeof body === "string") {
+                return redactLogString(body);
+            }
+            if (body instanceof Exception || body instanceof Error) {
+                const originalStack = body.stack || "";
+                const message = redactLogString(body.message);
+                const stack = redactLogString(originalStack);
+                if (message === body.message && stack === originalStack) {
+                    return body;
+                }
+                return stack || `${body.name}: ${message}`;
+            }
+            return redactLogValue(body);
+        }
+        catch (_a) {
+            // Never pass on a body we could not prove was redacted.
+            return REDACTED;
+        }
+    }
+    // Serialization only. The body must already have been through redactBody.
+    static serializeRedactedBody(body) {
+        try {
+            if (typeof body === "string") {
+                return body;
+            }
+            else if (body instanceof Exception || body instanceof Error) {
+                return body.message;
+            }
+            /*
+             * redactBody swept every string inside this copy already, so stringifying
+             * it needs no second textual pass.
+             */
+            const serialized = JSON.stringify(body);
+            return serialized === undefined ? "" : serialized;
         }
-        else if (body instanceof Exception || body instanceof Error) {
-            return body.message;
+        catch (_a) {
+            return REDACTED;
         }
-        return JSON.stringify(body);
+    }
+    /*
+     * Redacts and serializes in one step, for callers outside the level methods
+     * that hold a raw body.
+     */
+    static serializeLogBody(body) {
+        return this.serializeRedactedBody(this.redactBody(body));
     }
     static sanitizeAttributes(attributes) {
         if (!attributes) {
@@ -81,7 +135,17 @@ class logger {
             const sanitized = {};
             for (const key in attributes) {
                 const value = attributes[key];
-                if (value !== undefined && value !== null) {
+                if (value === undefined || value === null) {
+                    continue;
+                }
+                // Attributes are a log sink too, and they travel to telemetry verbatim.
+                if (isSensitiveLogKey(key, value)) {
+                    sanitized[key] = REDACTED;
+                }
+                else if (typeof value === "string") {
+                    sanitized[key] = redactLogString(value);
+                }
+                else {
                     sanitized[key] = value;
                 }
             }
@@ -94,14 +158,11 @@ class logger {
     static info(message, attributes) {
         const logLevel = this.getLogLevel();
         if (logLevel === ConfigLogLevel.DEBUG || logLevel === ConfigLogLevel.INFO) {
+            const body = this.redactBody(message);
             // eslint-disable-next-line no-console
-            console.info(message);
-            this.record("INFO", message);
-            this.emit({
-                body: message,
-                severityNumber: SeverityNumber.INFO,
-                attributes,
-            });
+            console.info(body);
+            this.record("INFO", body);
+            this.emitRedacted(body, SeverityNumber.INFO, attributes);
         }
     }
     static error(message, attributes) {
@@ -110,14 +171,11 @@ class logger {
             logLevel === ConfigLogLevel.INFO ||
             logLevel === ConfigLogLevel.WARN ||
             logLevel === ConfigLogLevel.ERROR) {
+            const body = this.redactBody(message);
             // eslint-disable-next-line no-console
-            console.error(message);
-            this.record("ERROR", message);
-            this.emit({
-                body: message,
-                severityNumber: SeverityNumber.ERROR,
-                attributes,
-            });
+            console.error(body);
+            this.record("ERROR", body);
+            this.emitRedacted(body, SeverityNumber.ERROR, attributes);
         }
     }
     static warn(message, attributes) {
@@ -125,30 +183,28 @@ class logger {
         if (logLevel === ConfigLogLevel.DEBUG ||
             logLevel === ConfigLogLevel.INFO ||
             logLevel === ConfigLogLevel.WARN) {
+            const body = this.redactBody(message);
             // eslint-disable-next-line no-console
-            console.warn(message);
-            this.record("WARN", message);
-            this.emit({
-                body: message,
-                severityNumber: SeverityNumber.WARN,
-                attributes,
-            });
+            console.warn(body);
+            this.record("WARN", body);
+            this.emitRedacted(body, SeverityNumber.WARN, attributes);
         }
     }
     static debug(message, attributes) {
         const logLevel = this.getLogLevel();
         if (logLevel === ConfigLogLevel.DEBUG) {
+            const body = this.redactBody(message);
             // eslint-disable-next-line no-console
-            console.debug(message);
-            this.record("DEBUG", message);
-            this.emit({
-                body: message,
-                severityNumber: SeverityNumber.DEBUG,
-                attributes,
-            });
+            console.debug(body);
+            this.record("DEBUG", body);
+            this.emitRedacted(body, SeverityNumber.DEBUG, attributes);
         }
     }
     static emit(data) {
+        this.emitRedacted(this.redactBody(data.body), data.severityNumber, data.attributes);
+    }
+    // `body` must already have been through redactBody.
+    static emitRedacted(body, severityNumber, attributes) {
         try {
             const logger = OneUptimeTelemetry.getLogger();
             if (logger === null) {
@@ -159,9 +215,9 @@ class logger {
              * monitorId, requestId, ...) into every log record. Attributes passed
              * explicitly to the log call take precedence over the ambient context.
              */
-            const mergedAttributes = Object.assign(Object.assign({}, TelemetryContext.getAttributes()), (data.attributes || {}));
+            const mergedAttributes = Object.assign(Object.assign({}, TelemetryContext.getAttributes()), (attributes || {}));
             const sanitizedAttributes = this.sanitizeAttributes(mergedAttributes);
-            logger.emit(Object.assign({ body: this.serializeLogBody(data.body), severityNumber: data.severityNumber }, (sanitizedAttributes ? { attributes: sanitizedAttributes } : {})));
+            logger.emit(Object.assign({ body: this.serializeRedactedBody(body), severityNumber: severityNumber }, (sanitizedAttributes ? { attributes: sanitizedAttributes } : {})));
         }
         catch (_a) {
             // Never let logging errors propagate
@@ -170,14 +226,11 @@ class logger {
     static trace(message, attributes) {
         const logLevel = this.getLogLevel();
         if (logLevel === ConfigLogLevel.DEBUG) {
+            const body = this.redactBody(message);
             // eslint-disable-next-line no-console
-            console.trace(message);
-            this.record("TRACE", message);
-            this.emit({
-                body: message,
-                severityNumber: SeverityNumber.DEBUG,
-                attributes,
-            });
+            console.trace(body);
+            this.record("TRACE", body);
+            this.emitRedacted(body, SeverityNumber.DEBUG, attributes);
         }
     }
 }