@redthreadlabs/tracelog 1.7.0 → 1.9.0

package/lib/filters/sanitize-field-names.js

@@ -10,6 +10,10 @@ const querystring = require('querystring');
 const HEADER_FORM_URLENCODED = 'application/x-www-form-urlencoded';
 const REDACTED = require('../constants').REDACTED;
 
+// Depth guard for deep JSON redaction. Far deeper than any sane request
+// body; protects against adversarial nesting.
+const MAX_REDACT_DEPTH = 32;
+
 /**
  * Handles req.body as object or string
  *
@@ -42,6 +46,91 @@ function redactKeysFromPostedFormVariables(body, requestHeaders, regexes) {
   return body;
 }
 
+/**
+ * Redact sensitive fields from a captured request body, returning a
+ * structured value wherever the body is structured (since 1.9.0):
+ *
+ * - JSON content types (`application/json`, `application/*+json`, with or
+ *   without a charset suffix) — **deep** redaction: any key at any depth
+ *   matching the sanitizeFieldNames patterns is replaced, recursing through
+ *   nested objects and arrays. The result is an **embedded object/array**,
+ *   whether the body arrived parsed or as a JSON string. Strings that fail
+ *   to parse are returned untouched as strings.
+ * - `application/x-www-form-urlencoded` — also returned as an embedded,
+ *   deep-redacted object (extended parsers can nest); historically this
+ *   re-serialized to a query string.
+ * - anything else — returned as-is.
+ *
+ * @param {Object | String} body
+ * @param {Object} requestHeaders
+ * @param {Array<RegExp>} regexes
+ * @returns {Object | Array | String} redacted body, structured when possible
+ */
+function redactKeysFromBody(body, requestHeaders, regexes) {
+  // Operate even without patterns: redactDeep also normalizes circulars and
+  // pathological nesting, which must never reach the serializer.
+  const res = Array.isArray(regexes) ? regexes : [];
+  const contentType = String(requestHeaders['content-type'] || '');
+  const mime = contentType.split(';')[0].trim().toLowerCase();
+
+  // A body some middleware already parsed is structured data no matter what
+  // the content-type header claims — deep-redact and embed it.
+  if (body !== null && !Buffer.isBuffer(body) && typeof body === 'object') {
+    return redactDeep(body, res, 0, new WeakSet());
+  }
+
+  if (typeof body !== 'string') {
+    return body;
+  }
+
+  if (mime === HEADER_FORM_URLENCODED) {
+    // querystring.parse returns a null-prototype object; copy to a plain one
+    return redactDeep({ ...querystring.parse(body) }, res, 0, new WeakSet());
+  }
+
+  if (isJsonContentType(contentType)) {
+    let parsed;
+    try {
+      parsed = JSON.parse(body);
+    } catch (_err) {
+      return body; // claimed JSON but isn't; leave it alone
+    }
+    return redactDeep(parsed, res, 0, new WeakSet());
+  }
+
+  return body;
+}
+
+function isJsonContentType(contentType) {
+  // 'application/json', 'application/json; charset=utf-8',
+  // 'application/vnd.api+json', …
+  const mime = contentType.split(';')[0].trim().toLowerCase();
+  return mime === 'application/json' || mime.endsWith('+json');
+}
+
+function redactDeep(value, regexes, depth, seen) {
+  if (value === null || typeof value !== 'object') {
+    return value;
+  }
+  if (depth >= MAX_REDACT_DEPTH || seen.has(value)) {
+    return REDACTED; // too deep / circular: redact rather than risk leaking
+  }
+  seen.add(value);
+
+  if (Array.isArray(value)) {
+    return value.map((item) => redactDeep(item, regexes, depth + 1, seen));
+  }
+
+  const result = {};
+  for (const key of Object.keys(value)) {
+    const shouldRedact = regexes.some((regex) => regex.test(key));
+    result[key] = shouldRedact
+      ? REDACTED
+      : redactDeep(value[key], regexes, depth + 1, seen);
+  }
+  return result;
+}
+
 /**
  * Returns a copy of the provided object. Each entry of the copy will have
  * its value REDACTEd if the key matches any of the regexes
@@ -66,4 +155,5 @@ function redactKeysFromObject(obj, regexes, redactedStr = REDACTED) {
 module.exports = {
   redactKeysFromObject,
   redactKeysFromPostedFormVariables,
+  redactKeysFromBody,
 };

package/lib/parsers.js

@@ -12,12 +12,11 @@ const basicAuth = require('basic-auth');
 const getUrlFromRequest = require('original-url');
 const parseHttpHeadersFromReqOrRes = require('http-headers');
 const cookie = require('cookie');
-const stringify = require('fast-safe-stringify');
 
 const REDACTED = require('./constants').REDACTED;
 const {
   redactKeysFromObject,
-  redactKeysFromPostedFormVariables,
+  redactKeysFromBody,
 } = require('./filters/sanitize-field-names');
 
 // When redacting individual cookie field values, this string is used instead
@@ -97,23 +96,26 @@ function getContextFromRequest(req, conf, type) {
   var haveBody = body && (chunked || contentLength > 0);
 
   if (haveBody) {
+    const bodyContentType = String(req.headers['content-type'] || '');
     if (!captureBody) {
       context.body = '[REDACTED]';
+    } else if (bodyContentType.split(';')[0].trim().toLowerCase().startsWith('multipart/')) {
+      // File uploads: never record the raw multipart body — it can embed
+      // entire file contents and no per-field redaction applies to it.
+      context.body = '[REDACTED: multipart body]';
     } else if (Buffer.isBuffer(body)) {
       context.body = '<Buffer>';
     } else {
       if (typeof body === 'string' && req.bodyIsBase64Encoded === true) {
         body = Buffer.from(body, 'base64').toString('utf8');
       }
-      body = redactKeysFromPostedFormVariables(
+      // Structured bodies (JSON, form-encoded) come back as deep-redacted
+      // objects and are recorded embedded, not stringified (since 1.9.0).
+      context.body = redactKeysFromBody(
         body,
         req.headers,
         conf.sanitizeFieldNamesRegExp,
       );
-      if (typeof body !== 'string') {
-        body = tryJsonStringify(body) || stringify(body);
-      }
-      context.body = body;
     }
   }
 
@@ -211,11 +213,6 @@ function parseUrl(urlStr) {
   return new url.URL(urlStr, 'relative:///');
 }
 
-function tryJsonStringify(obj) {
-  try {
-    return JSON.stringify(obj);
-  } catch (e) {}
-}
 
 module.exports = {
   getContextFromRequest,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@redthreadlabs/tracelog",
-  "version": "1.7.0",
+  "version": "1.9.0",
   "description": "Node.js APM instrumentation that writes traces to JSONL files",
   "publishConfig": {
     "access": "public"