@superblocksteam/shared 0.9332.0 → 0.9334.0

package/src/tracing/errorSanitizer.test.ts

@@ -0,0 +1,323 @@
+import { sanitizeError } from './errorSanitizer';
+
+describe('Error Sanitization', () => {
+  it('should redact JWT tokens from error messages', () => {
+    const error = new Error(
+      'Invalid token: eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiaWF0IjoxNTE2MjM5MDIyfQ.SflKxwRJSMeKKF2QT4fwpMeJf36POk6yJV_adQssw5c'
+    );
+
+    const sanitized = sanitizeError(error);
+
+    expect(sanitized.message).toBe('Invalid token: [REDACTED]');
+    expect(sanitized.message).not.toContain('eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9');
+  });
+
+  it('should redact bearer tokens from error messages', () => {
+    const error = new Error('Authentication failed with bearer abc123token456');
+
+    const sanitized = sanitizeError(error);
+
+    expect(sanitized.message).toBe('Authentication failed with bearer [REDACTED]');
+  });
+
+  it('should redact API keys from error messages', () => {
+    const error = new Error('API request failed: api_key=sk_live_abc123def456');
+
+    const sanitized = sanitizeError(error);
+
+    expect(sanitized.message).toBe('API request failed: api_key=[REDACTED]');
+  });
+
+  it('should remove sensitive fields from error objects', () => {
+    const error = new Error('Test error') as Error & {
+      token?: string;
+      apiKey?: string;
+      password?: string;
+      requestData?: { username: string; authorization: string };
+    };
+    error.token = 'secret-token-123';
+    error.apiKey = 'api-key-456';
+    error.password = 'mypassword';
+    error.requestData = {
+      username: 'john',
+      authorization: 'Bearer token123'
+    };
+
+    const sanitized = sanitizeError(error) as Error & Record<string, unknown>;
+
+    expect(sanitized.token).toBe('[REDACTED]');
+    expect(sanitized.apiKey).toBe('[REDACTED]');
+    expect(sanitized.password).toBe('[REDACTED]');
+    expect((sanitized.requestData as Record<string, unknown>).username).toBe('john'); // Non-sensitive field preserved
+    expect((sanitized.requestData as Record<string, unknown>).authorization).toBe('Bearer [REDACTED]');
+  });
+
+  it('should sanitize stack traces', () => {
+    const error = new Error('Test error');
+    error.stack = `Error: Invalid token eyJhbGciOiJIUzI1NiI...
+    at AuthService.validateToken (/app/src/auth.js:42:15)
+    at api_key=sk_live_abc123 (/app/src/api.js:20:10)`;
+
+    const sanitized = sanitizeError(error);
+
+    expect(sanitized.stack).toContain('[REDACTED]');
+    expect(sanitized.stack).not.toContain('eyJhbGciOiJIUzI1NiI');
+    expect(sanitized.stack).not.toContain('sk_live_abc123');
+  });
+
+  it('should preserve error type and non-sensitive properties', () => {
+    const error = new TypeError('Invalid token: abc123def456ghi789') as TypeError & {
+      statusCode?: number;
+      userId?: string;
+    };
+    error.statusCode = 401;
+    error.userId = 'user-123';
+
+    const sanitized = sanitizeError(error) as unknown as Error & Record<string, unknown>;
+
+    expect(sanitized.name).toBe('TypeError');
+    expect(sanitized.statusCode).toBe(401);
+    expect(sanitized.userId).toBe('user-123');
+    expect(sanitized.message).toBe('Invalid token: [REDACTED]');
+  });
+
+  it('should handle non-Error objects', () => {
+    const errorObj = {
+      message: 'Auth failed with token abc123',
+      token: 'secret-token',
+      data: {
+        user: 'john',
+        password: 'secret123'
+      }
+    };
+
+    const sanitized = sanitizeError(errorObj) as unknown as Record<string, unknown>;
+
+    expect(sanitized.message).toBe('Auth failed with token [REDACTED]');
+    expect(sanitized.token).toBe('[REDACTED]');
+    expect((sanitized.data as Record<string, unknown>).user).toBe('john');
+    expect((sanitized.data as Record<string, unknown>).password).toBe('[REDACTED]');
+  });
+
+  it('should not double-sanitize already sanitized errors', () => {
+    const error = new Error('Invalid token: eyJhbGciOiJIUzI1NiI...');
+
+    const firstSanitization = sanitizeError(error) as Error & { _sanitized?: boolean };
+    const secondSanitization = sanitizeError(firstSanitization);
+
+    expect(firstSanitization.message).toBe(secondSanitization.message);
+    expect(firstSanitization._sanitized).toBe(true);
+  });
+
+  it('should handle null and undefined gracefully', () => {
+    expect(sanitizeError(null)).toBe(null);
+    expect(sanitizeError(undefined)).toBe(undefined);
+  });
+
+  describe('Headers Sanitization', () => {
+    it('should sanitize authorization headers while preserving structure', () => {
+      const error = new Error('Request failed') as Error & {
+        headers?: Record<string, string>;
+      };
+      error.headers = {
+        authorization: 'Bearer eyJhbGciOiJIUzI1NiI...',
+        'content-type': 'application/json',
+        'x-api-key': 'sk_live_abc123'
+      };
+
+      const sanitized = sanitizeError(error) as Error & Record<string, unknown>;
+
+      expect((sanitized.headers as Record<string, unknown>).authorization).toBe('Bearer [REDACTED]');
+      expect((sanitized.headers as Record<string, unknown>)['content-type']).toBe('application/json'); // Non-sensitive preserved
+      expect((sanitized.headers as Record<string, unknown>)['x-api-key']).toBe('[REDACTED]'); // Contains 'key' -> completely redacted
+    });
+
+    it('should sanitize headers in HTTP request/response objects', () => {
+      const error = new Error('HTTP request failed') as Error & {
+        request?: { url: string; method: string; headers: Record<string, string> };
+        response?: { status: number; headers: Record<string, string> };
+      };
+      error.request = {
+        url: 'https://api.example.com/users',
+        method: 'GET',
+        headers: {
+          Authorization: 'Bearer token123',
+          Cookie: 'session=abc123; auth_token=xyz789',
+          'User-Agent': 'MyApp/1.0'
+        }
+      };
+      error.response = {
+        status: 401,
+        headers: {
+          'WWW-Authenticate': 'Bearer realm="api"',
+          'Set-Cookie': 'refresh_token=def456; HttpOnly',
+          'Content-Type': 'application/json'
+        }
+      };
+
+      const sanitized = sanitizeError(error) as Error & Record<string, unknown>;
+
+      // Request headers
+      expect(((sanitized.request as Record<string, unknown>).headers as Record<string, unknown>).Authorization).toBe('Bearer [REDACTED]');
+      expect(((sanitized.request as Record<string, unknown>).headers as Record<string, unknown>).Cookie).toBe('[REDACTED]'); // Contains 'cookie' -> completely redacted
+      expect(((sanitized.request as Record<string, unknown>).headers as Record<string, unknown>)['User-Agent']).toBe('MyApp/1.0');
+
+      // Response headers
+      expect(((sanitized.response as Record<string, unknown>).headers as Record<string, unknown>)['WWW-Authenticate']).toBe('[REDACTED]'); // Contains 'bearer' pattern -> redacted
+      expect(((sanitized.response as Record<string, unknown>).headers as Record<string, unknown>)['Set-Cookie']).toBe('[REDACTED]'); // Contains 'cookie' -> completely redacted
+      expect(((sanitized.response as Record<string, unknown>).headers as Record<string, unknown>)['Content-Type']).toBe('application/json');
+    });
+
+    it('should handle case-insensitive header names', () => {
+      const error = new Error('Request failed') as Error & {
+        Headers?: Record<string, string>;
+      };
+      error.Headers = {
+        // Capital H - this field name doesn't contain sensitive keywords
+        AUTHORIZATION: 'Bearer token123',
+        authorization: 'Basic user:pass',
+        'X-API-KEY': 'secret-key'
+      };
+
+      const sanitized = sanitizeError(error) as Error & Record<string, unknown>;
+
+      // Headers (capital H) is not in VALUE_SANITIZED_FIELDS, so individual fields get processed normally
+      // But Basic auth pattern still applies for string value sanitization
+      expect((sanitized.Headers as Record<string, unknown>).AUTHORIZATION).toBe('Bearer [REDACTED]'); // Pattern matching on string value
+      expect((sanitized.Headers as Record<string, unknown>).authorization).toBe('Basic [REDACTED]'); // Basic auth pattern applies
+      expect((sanitized.Headers as Record<string, unknown>)['X-API-KEY']).toBe('[REDACTED]'); // Contains 'key' -> completely redacted
+    });
+
+    it('should sanitize headers with various token formats', () => {
+      const errorObj = {
+        message: 'Authentication failed',
+        headers: {
+          authorization: 'JWT eyJhbGciOiJIUzI1NiI...',
+          'x-auth-token': 'Bearer abc123def456',
+          'api-key': 'sk_test_1234567890',
+          cookie: 'sessionId=sess_abc123; csrfToken=csrf_xyz789',
+          'x-forwarded-for': '192.168.1.1' // Should be preserved
+        }
+      };
+
+      const sanitized = sanitizeError(errorObj) as unknown as Record<string, unknown>;
+
+      expect((sanitized.headers as Record<string, unknown>).authorization).toBe('JWT [REDACTED]');
+      expect((sanitized.headers as Record<string, unknown>)['x-auth-token']).toBe('[REDACTED]'); // Contains 'auth' -> completely redacted
+      expect((sanitized.headers as Record<string, unknown>)['api-key']).toBe('[REDACTED]'); // Contains 'key' -> completely redacted
+      expect((sanitized.headers as Record<string, unknown>).cookie).toBe('[REDACTED]'); // Contains 'cookie' -> completely redacted
+      expect((sanitized.headers as Record<string, unknown>)['x-forwarded-for']).toBe('192.168.1.1');
+    });
+
+    it('should handle nested headers in complex objects', () => {
+      const error = new Error('Network error') as Error & {
+        requestConfig?: {
+          baseURL: string;
+          timeout: number;
+          headers: Record<string, string>;
+          data: { username: string; password: string };
+        };
+      };
+      error.requestConfig = {
+        baseURL: 'https://api.example.com',
+        timeout: 5000,
+        headers: {
+          Authorization: 'Bearer eyJhbGciOiJIUzI1NiI...',
+          'Content-Type': 'application/json'
+        },
+        data: {
+          username: 'john',
+          password: 'secret123'
+        }
+      };
+
+      const sanitized = sanitizeError(error) as Error & Record<string, unknown>;
+
+      expect((sanitized.requestConfig as Record<string, unknown>).baseURL).toBe('https://api.example.com');
+      expect((sanitized.requestConfig as Record<string, unknown>).timeout).toBe(5000);
+      expect(((sanitized.requestConfig as Record<string, unknown>).headers as Record<string, unknown>).Authorization).toBe(
+        'Bearer [REDACTED]'
+      );
+      expect(((sanitized.requestConfig as Record<string, unknown>).headers as Record<string, unknown>)['Content-Type']).toBe(
+        'application/json'
+      );
+      expect(((sanitized.requestConfig as Record<string, unknown>).data as Record<string, unknown>).username).toBe('john');
+      expect(((sanitized.requestConfig as Record<string, unknown>).data as Record<string, unknown>).password).toBe('[REDACTED]');
+    });
+
+    it('should handle headers as strings vs objects', () => {
+      const error = new Error('Invalid headers') as Error & {
+        headers?: string;
+        requestHeaders?: Record<string, string>;
+      };
+      error.headers = 'Authorization: Bearer token123\r\nContent-Type: application/json';
+      error.requestHeaders = {
+        authorization: 'Basic dXNlcjpwYXNz', // base64 encoded user:pass
+        'user-agent': 'MyApp/1.0'
+      };
+
+      const sanitized = sanitizeError(error) as Error & Record<string, unknown>;
+
+      // String headers get pattern-based sanitization (Bearer preserves prefix)
+      expect(sanitized.headers).toBe('Authorization: Bearer [REDACTED]\r\nContent-Type: application/json');
+
+      // Any field named 'authorization' should be value-sanitized regardless of parent object name
+      expect((sanitized.requestHeaders as Record<string, unknown>).authorization).toBe('Basic [REDACTED]');
+      expect((sanitized.requestHeaders as Record<string, unknown>)['user-agent']).toBe('MyApp/1.0');
+    });
+
+    it('should redact GitHub tokens', () => {
+      const errorObj = {
+        message: 'GitHub API failed',
+        personalToken: 'ghp_1234567890abcdef1234567890abcdef12345678',
+        appToken: 'ghs_abcdef1234567890abcdef1234567890abcdef12',
+        finegrainedToken: 'github_pat_11ABCDEFG0001234567890_abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ1234567890',
+        config: {
+          auth: 'token ghp_1234567890abcdef1234567890abcdef12345678'
+        }
+      };
+
+      const sanitized = sanitizeError(errorObj) as unknown as Record<string, unknown>;
+
+      expect(sanitized.personalToken).toBe('[REDACTED]');
+      expect(sanitized.appToken).toBe('[REDACTED]');
+      expect(sanitized.finegrainedToken).toBe('[REDACTED]');
+      expect((sanitized.config as Record<string, unknown>).auth).toBe('[REDACTED]'); // "token <value>" pattern matches the whole thing
+    });
+
+    it('should handle mixed secrets in complex error objects', () => {
+      const error = new Error('Multiple services failed') as Error & {
+        aws?: { accessKeyId: string; secretAccessKey: string; sessionToken: string };
+        github?: { token: string };
+        database?: { url: string };
+        nonSensitive?: { userId: string; timestamp: string };
+      };
+      error.aws = {
+        accessKeyId: 'AKIAIOSFODNN7EXAMPLE',
+        secretAccessKey: 'wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY',
+        sessionToken: 'aws_session_token_12345abcdef'
+      };
+      error.github = {
+        token: 'ghp_1234567890abcdef1234567890abcdef12345678'
+      };
+      error.nonSensitive = {
+        userId: 'user123',
+        timestamp: '2023-01-01T00:00:00Z'
+      };
+
+      const sanitized = sanitizeError(error) as Error & Record<string, unknown>;
+
+      // AWS credentials should be redacted
+      expect((sanitized.aws as Record<string, unknown>).accessKeyId).toBe('[REDACTED]');
+      expect((sanitized.aws as Record<string, unknown>).secretAccessKey).toBe('[REDACTED]');
+      expect((sanitized.aws as Record<string, unknown>).sessionToken).toBe('[REDACTED]');
+
+      // GitHub token should be redacted
+      expect((sanitized.github as Record<string, unknown>).token).toBe('[REDACTED]');
+
+      // Non-sensitive data should be preserved
+      expect((sanitized.nonSensitive as Record<string, unknown>).userId).toBe('user123');
+      expect((sanitized.nonSensitive as Record<string, unknown>).timestamp).toBe('2023-01-01T00:00:00Z');
+    });
+  });
+});

package/src/tracing/errorSanitizer.ts

@@ -0,0 +1,215 @@
+/**
+ * Sanitizes errors before recording them in OpenTelemetry spans to prevent
+ * sensitive information from being sent to DataDog or other observability platforms.
+ */
+
+// Patterns that indicate sensitive information
+const SENSITIVE_PATTERNS = [
+  // Tokens and keys - capture groups to preserve prefixes
+  /(\bbearer\s+)[a-zA-Z0-9\-._~+/]+=*/gi,
+  /(\bbasic\s+)\S+/gi, // Basic auth can contain any non-whitespace characters
+  /(\bjwt\s+)[a-zA-Z0-9\-._~+/]+=*/gi,
+  /(\btoken[:\s=]+)[a-zA-Z0-9\-._~+/]+=*/gi,
+  /(\bapi[_\s]?key[:\s=]+)[a-zA-Z0-9\-._~+/]+=*/gi,
+  /(\baccess[_\s]?token[:\s=]+)[a-zA-Z0-9\-._~+/]+=*/gi,
+  /(\brefresh[_\s]?token[:\s=]+)[a-zA-Z0-9\-._~+/]+=*/gi,
+
+  // JWT pattern (base64.base64.base64) - standalone tokens
+  /\b[A-Za-z0-9-_]{20,}\.[A-Za-z0-9-_]{20,}\.[A-Za-z0-9-_]{20,}\b/g
+];
+
+// Fields to completely remove from error objects
+const COMPLETELY_REDACTED_FIELDS = [
+  'token',
+  'accesstoken',
+  'access_token',
+  'refreshtoken',
+  'refresh_token',
+  'jwt',
+  'bearer',
+  'apikey',
+  'api_key',
+  'secret',
+  'password',
+  'passwd',
+  'key',
+  'private_key',
+  'privatekey',
+  'credentials',
+  'auth',
+  'session',
+  'cookie'
+];
+
+// Fields that should have their values sanitized but structure preserved
+const VALUE_SANITIZED_FIELDS = ['authorization', 'headers'];
+
+/**
+ * Sanitizes a message string by replacing sensitive patterns
+ */
+function sanitizeMessage(message: string): string {
+  if (!message) return message;
+
+  let sanitized = message;
+  for (const pattern of SENSITIVE_PATTERNS) {
+    if (pattern.global) {
+      pattern.lastIndex = 0; // Reset regex state
+    }
+
+    if (pattern.source.includes('(')) {
+      // Pattern has capture groups - preserve prefix
+      sanitized = sanitized.replace(pattern, '$1[REDACTED]');
+    } else {
+      // Pattern matches entire sensitive value
+      sanitized = sanitized.replace(pattern, '[REDACTED]');
+    }
+  }
+
+  return sanitized;
+}
+
+/**
+ * Sanitizes a stack trace by replacing sensitive patterns
+ */
+function sanitizeStackTrace(stack: string): string {
+  if (!stack) return stack;
+  return sanitizeMessage(stack);
+}
+
+/**
+ * Recursively sanitizes an object by removing/redacting sensitive fields
+ */
+function sanitizeObject(obj: unknown, depth = 0): unknown {
+  if (depth > 5) {
+    // Prevent infinite recursion
+    return '[MAX_DEPTH_REACHED]';
+  }
+
+  if (obj === null || obj === undefined) {
+    return obj;
+  }
+
+  if (typeof obj === 'string') {
+    return sanitizeMessage(obj);
+  }
+
+  if (typeof obj === 'number' || typeof obj === 'boolean') {
+    return obj;
+  }
+
+  if (typeof obj !== 'object') {
+    return obj;
+  }
+
+  if (Array.isArray(obj)) {
+    return obj.map((item) => sanitizeObject(item, depth + 1));
+  }
+
+  const sanitized: Record<string, unknown> = {};
+
+  for (const [key, value] of Object.entries(obj)) {
+    const lowerKey = key.toLowerCase();
+
+    // Check for value-sanitized fields first (more specific)
+    if (VALUE_SANITIZED_FIELDS.some((field) => lowerKey === field)) {
+      if (typeof value === 'string') {
+        sanitized[key] = sanitizeMessage(value);
+      } else {
+        sanitized[key] = sanitizeObject(value, depth + 1);
+      }
+      continue;
+    }
+
+    // Then check for completely redacted fields
+    if (COMPLETELY_REDACTED_FIELDS.some((field) => lowerKey === field || lowerKey.includes(field))) {
+      sanitized[key] = '[REDACTED]';
+      continue;
+    }
+
+    // Special handling for common error properties
+    if (key === 'message') {
+      sanitized[key] = sanitizeMessage(value as string);
+    } else if (key === 'stack') {
+      sanitized[key] = sanitizeStackTrace(value as string);
+    } else {
+      sanitized[key] = sanitizeObject(value, depth + 1);
+    }
+  }
+
+  return sanitized;
+}
+
+/**
+ * Sanitizes an error object for safe recording in OpenTelemetry spans
+ */
+export function sanitizeError(error: unknown): Error {
+  if (!error) {
+    return error as Error;
+  }
+
+  // If it's already a sanitized error, return as-is
+  const errorWithSanitized = error as Error & { _sanitized?: boolean };
+  if (errorWithSanitized._sanitized) {
+    return errorWithSanitized;
+  }
+
+  let sanitized: Error & { _sanitized?: boolean; [key: string]: unknown };
+
+  if (error instanceof Error) {
+    // Create a new error with sanitized properties
+    sanitized = new Error(sanitizeMessage(error.message)) as Error & { _sanitized?: boolean; [key: string]: unknown };
+    sanitized.name = error.name;
+    sanitized.stack = sanitizeStackTrace(error.stack || '');
+
+    // Copy and sanitize all enumerable properties
+    Object.keys(error).forEach((prop) => {
+      if (prop !== 'message' && prop !== 'name' && prop !== 'stack') {
+        const lowerProp = prop.toLowerCase();
+        const errorWithProps = error as unknown as Record<string, unknown>;
+
+        // Check for value-sanitized fields first (more specific)
+        if (VALUE_SANITIZED_FIELDS.some((field) => lowerProp === field)) {
+          if (typeof errorWithProps[prop] === 'string') {
+            sanitized[prop] = sanitizeMessage(errorWithProps[prop] as string);
+          } else {
+            sanitized[prop] = sanitizeObject(errorWithProps[prop]);
+          }
+        } else if (COMPLETELY_REDACTED_FIELDS.some((field) => lowerProp === field || lowerProp.includes(field))) {
+          sanitized[prop] = '[REDACTED]';
+        } else {
+          sanitized[prop] = sanitizeObject(errorWithProps[prop]);
+        }
+      }
+    });
+
+    // Also check non-enumerable properties that might have been added
+    Object.getOwnPropertyNames(error).forEach((prop) => {
+      if (prop !== 'message' && prop !== 'name' && prop !== 'stack' && !Object.prototype.propertyIsEnumerable.call(error, prop)) {
+        const lowerProp = prop.toLowerCase();
+        const errorWithProps = error as unknown as Record<string, unknown>;
+
+        // Check for value-sanitized fields first (more specific)
+        if (VALUE_SANITIZED_FIELDS.some((field) => lowerProp === field)) {
+          if (typeof errorWithProps[prop] === 'string') {
+            sanitized[prop] = sanitizeMessage(errorWithProps[prop] as string);
+          } else {
+            sanitized[prop] = sanitizeObject(errorWithProps[prop]);
+          }
+        } else if (COMPLETELY_REDACTED_FIELDS.some((field) => lowerProp === field || lowerProp.includes(field))) {
+          sanitized[prop] = '[REDACTED]';
+        } else {
+          sanitized[prop] = sanitizeObject(errorWithProps[prop]);
+        }
+      }
+    });
+  } else {
+    // For non-Error objects, sanitize the entire object
+    const sanitizedObj = sanitizeObject(error);
+    sanitized = sanitizedObj as Error & { _sanitized?: boolean; [key: string]: unknown };
+  }
+
+  // Mark as sanitized to prevent double-processing
+  sanitized._sanitized = true;
+
+  return sanitized;
+}

package/src/tracing/methodTracing.ts

@@ -1,4 +1,5 @@
 import { Context, context, Span, trace, Tracer } from '@opentelemetry/api';
+import { sanitizeError } from './errorSanitizer';
 
 /**
  * helper function to wrap a class method with tracing
@@ -35,7 +36,7 @@ export function traceMethod(className: string, methodName: string, descriptor: P
                 return res;
               })
               .catch((err) => {
-                span.recordException(err);
+                span.recordException(sanitizeError(err));
                 span.end();
                 throw err;
               });
@@ -45,7 +46,7 @@ export function traceMethod(className: string, methodName: string, descriptor: P
           span.end();
           return result;
         } catch (err) {
-          span.recordException(err);
+          span.recordException(sanitizeError(err));
           span.end();
           throw err;
         }
@@ -81,7 +82,7 @@ export function traceFunction<T>({
               return res;
             })
             .catch((err) => {
-              span.recordException(err);
+              span.recordException(sanitizeError(err));
               span.end();
               throw err;
             });
@@ -90,7 +91,7 @@ export function traceFunction<T>({
         span.end();
         return result;
       } catch (err) {
-        span.recordException(err);
+        span.recordException(sanitizeError(err));
         span.end();
         throw err;
       }