@vtex/api 3.77.2 → 3.77.5

package/CHANGELOG.md

@@ -7,6 +7,20 @@ and this project adheres to [Semantic Versioning](http://semver.org/spec/v2.0.0.
 
 ## [Unreleased]
 
+## [3.77.5] - 2022-02-24
+### Fixed
+- Remove sensitive data from logs.
+
+## [3.77.4] - 2021-10-22
+
+## [3.77.3] - 2021-10-22
+### Fixed
+- Extract session cookie in a safe manner
+
+## [3.77.2] - 2021-08-26
+### Fixed
+- Extract session cookie in a safe manner
+
 ## [3.77.1] - 2021-02-05
 - Increase HTTP agents connection pools freeSockets and lifetime
 

package/lib/clients/Segment.d.ts

@@ -34,7 +34,7 @@ export declare class Segment extends JanusClient {
     getSegmentByToken: (token: string | null) => Promise<SegmentData>;
     getOrCreateSegment: (query?: Record<string, string> | undefined, token?: string | undefined) => Promise<{
         segmentData: SegmentData;
-        segmentToken: string;
+        segmentToken: string | undefined;
     }>;
     private rawSegment;
 }

package/lib/clients/Segment.js

@@ -1,13 +1,9 @@
 "use strict";
-var __importDefault = (this && this.__importDefault) || function (mod) {
-    return (mod && mod.__esModule) ? mod : { "default": mod };
-};
 Object.defineProperty(exports, "__esModule", { value: true });
-const cookie_1 = __importDefault(require("cookie"));
 const ramda_1 = require("ramda");
 const constants_1 = require("../constants");
 const HttpClient_1 = require("../HttpClient");
-const SEGMENT_COOKIE = 'vtex_segment';
+const Session_1 = require("./Session");
 const SEGMENT_MAX_AGE_S = 60 * 60; // 60 minutes - segment is actually immutable
 const ALLOWED_QUERY_PREFIXES = ['utm', 'cultureInfo', 'supportedLocales'];
 const filterAndSortQuery = (query) => {
@@ -48,12 +44,10 @@ class Segment extends HttpClient_1.JanusClient {
          */
         this.getSegmentByToken = (token) => this.rawSegment(token).then(ramda_1.prop('data'));
         this.getOrCreateSegment = async (query, token) => {
-            const { data: segmentData, headers: { 'set-cookie': [setCookies], }, } = await this.rawSegment(token, query);
-            const parsedCookie = cookie_1.default.parse(setCookies);
-            const segmentToken = ramda_1.prop(SEGMENT_COOKIE, parsedCookie);
+            const { data: segmentData, headers, } = await this.rawSegment(token, query);
             return {
                 segmentData,
-                segmentToken,
+                segmentToken: Session_1.extractSessionCookie(headers) || token,
             };
         };
         this.rawSegment = (token, query) => {

package/lib/clients/Session.d.ts

@@ -12,3 +12,4 @@ export declare class Session extends JanusClient {
      */
     updateSession: (key: string, value: any, items: string[], token: any) => Promise<void>;
 }
+export declare function extractSessionCookie(headers: Record<string, string>): string | null;

package/lib/clients/Session.js

@@ -4,7 +4,6 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
 };
 Object.defineProperty(exports, "__esModule", { value: true });
 const cookie_1 = __importDefault(require("cookie"));
-const ramda_1 = require("ramda");
 const HttpClient_1 = require("./../HttpClient");
 const SESSION_COOKIE = 'vtex_session';
 const routes = {
@@ -17,7 +16,7 @@ class Session extends HttpClient_1.JanusClient {
          * Get the session data using the given token
          */
         this.getSession = async (token, items) => {
-            const { data: sessionData, headers: { 'set-cookie': [setCookies], }, } = await this.http.getRaw(routes.base, ({
+            const { data: sessionData, headers } = await this.http.getRaw(routes.base, ({
                 headers: {
                     'Content-Type': 'application/json',
                     'Cookie': `vtex_session=${token};`,
@@ -27,11 +26,9 @@ class Session extends HttpClient_1.JanusClient {
                     items: items.join(','),
                 },
             }));
-            const parsedCookie = cookie_1.default.parse(setCookies);
-            const sessionToken = ramda_1.prop(SESSION_COOKIE, parsedCookie);
             return {
                 sessionData,
-                sessionToken,
+                sessionToken: extractSessionCookie(headers) || token,
             };
         };
         /**
@@ -54,3 +51,14 @@ class Session extends HttpClient_1.JanusClient {
     }
 }
 exports.Session = Session;
+function extractSessionCookie(headers) {
+    for (const setCookie of headers['set-cookie'] || []) {
+        const parsedCookie = cookie_1.default.parse(setCookie);
+        const sessionCookie = parsedCookie[SESSION_COOKIE];
+        if (sessionCookie != null) {
+            return sessionCookie;
+        }
+    }
+    return null;
+}
+exports.extractSessionCookie = extractSessionCookie;

package/lib/service/graphql/middlewares/formatters.js

@@ -3,6 +3,7 @@ Object.defineProperty(exports, "__esModule", { value: true });
 const apollo_server_errors_1 = require("apollo-server-errors");
 const ramda_1 = require("ramda");
 const error_1 = require("../../../utils/error");
+const log_1 = require("../../../utils/log");
 const ERROR_FIELD_WHITELIST = ['message', 'path', 'stack', 'extensions', 'statusCode', 'name', 'headers', 'originalError', 'code'];
 // formatError overrides the default option in runHttpQuery, which
 // does not keep track of the error stack. All non-enumerable
@@ -21,11 +22,11 @@ const createFormatError = (details) => (error) => {
             delete formattedError.originalError.stack;
         }
         if (!formattedError.extensions.exception) {
-            formattedError.extensions.exception = Object.assign({ message: formattedError.originalError.message, name: formattedError.originalError.name }, ramda_1.omit(error_1.SENSITIVE_EXCEPTION_FIELDS, formattedError.originalError), { sensitive: ramda_1.pick(error_1.SENSITIVE_EXCEPTION_FIELDS, formattedError.originalError) });
+            formattedError.extensions.exception = Object.assign({ message: formattedError.originalError.message, name: formattedError.originalError.name }, ramda_1.omit(log_1.FIRST_LEVEL_SENSITIVE_FIELDS, formattedError.originalError), { sensitive: ramda_1.pick(log_1.FIRST_LEVEL_SENSITIVE_FIELDS, formattedError.originalError) });
         }
         else {
             const mergedExceptions = Object.assign({}, formattedError.originalError, formattedError.extensions.exception);
-            const extendedException = Object.assign({ message: formattedError.originalError.message, name: formattedError.originalError.name }, ramda_1.omit(error_1.SENSITIVE_EXCEPTION_FIELDS, mergedExceptions), { sensitive: ramda_1.pick(error_1.SENSITIVE_EXCEPTION_FIELDS, mergedExceptions) });
+            const extendedException = Object.assign({ message: formattedError.originalError.message, name: formattedError.originalError.name }, ramda_1.omit(log_1.FIRST_LEVEL_SENSITIVE_FIELDS, mergedExceptions), { sensitive: ramda_1.pick(log_1.FIRST_LEVEL_SENSITIVE_FIELDS, mergedExceptions) });
             formattedError.extensions.exception = error_1.cleanError(extendedException);
         }
         // Make originalError not enumerable to prevent duplicated log and response information

package/lib/service/http/middlewares/error.js

@@ -5,6 +5,7 @@ const constants_1 = require("../../../constants");
 const RequestCancelledError_1 = require("../../../errors/RequestCancelledError");
 const TooManyRequestsError_1 = require("../../../errors/TooManyRequestsError");
 const error_1 = require("../../../utils/error");
+const log_1 = require("../../../utils/log");
 const CACHE_CONTROL_HEADER = 'cache-control';
 const META_HEADER = 'x-vtex-meta';
 const ETAG_HEADER = 'etag';
@@ -32,7 +33,7 @@ const logAndRemoveSensitiveData = (ctx, err) => {
     // Use sendLog directly to avoid cleaning error twice.
     ctx.vtex.logger.log(log, level);
     if (!constants_1.LINKED) {
-        error_1.SENSITIVE_EXCEPTION_FIELDS.forEach(field => {
+        log_1.FIRST_LEVEL_SENSITIVE_FIELDS.forEach(field => {
             delete err[field];
         });
     }

package/lib/service/logger/index.js

@@ -1,6 +1,7 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 const error_1 = require("../../utils/error");
+const log_1 = require("../../utils/log");
 const linked = !!process.env.VTEX_APP_LINK;
 const app = process.env.VTEX_APP_ID;
 const EMPTY_MESSAGE = 'Logger.log was called with null or undefined message';
@@ -22,6 +23,7 @@ class Logger {
         this.error = (error) => this.log(error, LogLevel.Error);
         this.log = (message, level) => {
             const data = message ? error_1.cleanError(message) : EMPTY_MESSAGE;
+            log_1.cleanLog(data);
             /* tslint:disable:object-literal-sort-keys */
             const inflatedLog = {
                 __VTEX_IO_LOG: true,

package/lib/utils/error.d.ts

@@ -1,5 +1,4 @@
 export declare const PICKED_AXIOS_PROPS: string[];
-export declare const SENSITIVE_EXCEPTION_FIELDS: string[];
 /**
  * Cleans errors by removing circular properties, truncating large strings and picking axios properties
  *

package/lib/utils/error.js

@@ -3,7 +3,6 @@ Object.defineProperty(exports, "__esModule", { value: true });
 // Inspired by https://github.com/sindresorhus/serialize-error
 const ramda_1 = require("ramda");
 exports.PICKED_AXIOS_PROPS = ['baseURL', 'cacheable', 'data', 'finished', 'headers', 'method', 'timeout', 'status', 'path', 'url', 'metric', 'inflightKey', 'forceMaxAge', 'params', 'responseType'];
-exports.SENSITIVE_EXCEPTION_FIELDS = ['config', 'request', 'stack'];
 const MAX_ERROR_STRING_LENGTH = process.env.MAX_ERROR_STRING_LENGTH ? parseInt(process.env.MAX_ERROR_STRING_LENGTH, 10) : 8 * 1024;
 const findCaseInsensitive = (target, set) => ramda_1.find(t => t.toLocaleLowerCase() === target, set);
 const destroyCircular = (from, seen) => {

package/lib/utils/log.d.ts

@@ -0,0 +1,3 @@
+export declare const FIRST_LEVEL_SENSITIVE_FIELDS: string[];
+export declare const SECOND_LEVEL_SENSITIVE_FIELDS: string[][];
+export declare const cleanLog: (log: any) => void;

package/lib/utils/log.js

@@ -0,0 +1,14 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.FIRST_LEVEL_SENSITIVE_FIELDS = ['config', 'request', 'stack', 'error'];
+exports.SECOND_LEVEL_SENSITIVE_FIELDS = [['parsedInfo', 'requestConfig'], ['headers', 'cookie']];
+exports.cleanLog = (log) => {
+    exports.FIRST_LEVEL_SENSITIVE_FIELDS.forEach(field => {
+        delete log[field];
+    });
+    exports.SECOND_LEVEL_SENSITIVE_FIELDS.forEach(field => {
+        if (field[0] in log) {
+            delete log[field[0]][field[1]];
+        }
+    });
+};

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@vtex/api",
-  "version": "3.77.2",
+  "version": "3.77.5",
   "description": "VTEX I/O API client",
   "main": "lib/index.js",
   "typings": "lib/index.d.ts",