@redthreadlabs/tracelog 1.7.0 → 1.8.0

package/lib/filters/sanitize-field-names.js

@@ -10,6 +10,10 @@ const querystring = require('querystring');
 const HEADER_FORM_URLENCODED = 'application/x-www-form-urlencoded';
 const REDACTED = require('../constants').REDACTED;
 
+// Depth guard for deep JSON redaction. Far deeper than any sane request
+// body; protects against adversarial nesting.
+const MAX_REDACT_DEPTH = 32;
+
 /**
  * Handles req.body as object or string
  *
@@ -42,6 +46,80 @@ function redactKeysFromPostedFormVariables(body, requestHeaders, regexes) {
   return body;
 }
 
+/**
+ * Redact sensitive fields from a captured request body of any supported
+ * content type:
+ *
+ * - `application/x-www-form-urlencoded` — top-level form fields (the
+ *   historical Elastic APM behavior).
+ * - JSON content types (`application/json`, `application/*+json`, with or
+ *   without a charset suffix) — **deep** redaction: any key at any depth
+ *   matching the sanitizeFieldNames patterns is replaced, recursing through
+ *   nested objects and arrays. Stringified JSON bodies are parsed, redacted,
+ *   and re-stringified; strings that fail to parse are returned untouched.
+ * - anything else — returned as-is.
+ *
+ * @param {Object | String} body
+ * @param {Object} requestHeaders
+ * @param {Array<RegExp>} regexes
+ * @returns {Object | String} a copy of the body with redacted fields
+ */
+function redactKeysFromBody(body, requestHeaders, regexes) {
+  const contentType = String(requestHeaders['content-type'] || '');
+  if (!isJsonContentType(contentType)) {
+    return redactKeysFromPostedFormVariables(body, requestHeaders, regexes);
+  }
+  if (!Array.isArray(regexes)) {
+    return body;
+  }
+
+  if (body !== null && !Buffer.isBuffer(body) && typeof body === 'object') {
+    return redactDeep(body, regexes, 0, new WeakSet());
+  }
+
+  if (typeof body === 'string') {
+    let parsed;
+    try {
+      parsed = JSON.parse(body);
+    } catch (_err) {
+      return body; // claimed JSON but isn't; leave it alone
+    }
+    return JSON.stringify(redactDeep(parsed, regexes, 0, new WeakSet()));
+  }
+
+  return body;
+}
+
+function isJsonContentType(contentType) {
+  // 'application/json', 'application/json; charset=utf-8',
+  // 'application/vnd.api+json', …
+  const mime = contentType.split(';')[0].trim().toLowerCase();
+  return mime === 'application/json' || mime.endsWith('+json');
+}
+
+function redactDeep(value, regexes, depth, seen) {
+  if (value === null || typeof value !== 'object') {
+    return value;
+  }
+  if (depth >= MAX_REDACT_DEPTH || seen.has(value)) {
+    return REDACTED; // too deep / circular: redact rather than risk leaking
+  }
+  seen.add(value);
+
+  if (Array.isArray(value)) {
+    return value.map((item) => redactDeep(item, regexes, depth + 1, seen));
+  }
+
+  const result = {};
+  for (const key of Object.keys(value)) {
+    const shouldRedact = regexes.some((regex) => regex.test(key));
+    result[key] = shouldRedact
+      ? REDACTED
+      : redactDeep(value[key], regexes, depth + 1, seen);
+  }
+  return result;
+}
+
 /**
  * Returns a copy of the provided object. Each entry of the copy will have
  * its value REDACTEd if the key matches any of the regexes
@@ -66,4 +144,5 @@ function redactKeysFromObject(obj, regexes, redactedStr = REDACTED) {
 module.exports = {
   redactKeysFromObject,
   redactKeysFromPostedFormVariables,
+  redactKeysFromBody,
 };

package/lib/parsers.js

@@ -17,7 +17,7 @@ const stringify = require('fast-safe-stringify');
 const REDACTED = require('./constants').REDACTED;
 const {
   redactKeysFromObject,
-  redactKeysFromPostedFormVariables,
+  redactKeysFromBody,
 } = require('./filters/sanitize-field-names');
 
 // When redacting individual cookie field values, this string is used instead
@@ -105,7 +105,7 @@ function getContextFromRequest(req, conf, type) {
       if (typeof body === 'string' && req.bodyIsBase64Encoded === true) {
         body = Buffer.from(body, 'base64').toString('utf8');
       }
-      body = redactKeysFromPostedFormVariables(
+      body = redactKeysFromBody(
         body,
         req.headers,
         conf.sanitizeFieldNamesRegExp,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@redthreadlabs/tracelog",
-  "version": "1.7.0",
+  "version": "1.8.0",
   "description": "Node.js APM instrumentation that writes traces to JSONL files",
   "publishConfig": {
     "access": "public"