@vtex/api 6.45.7 → 6.45.10

package/CHANGELOG.md

@@ -7,6 +7,26 @@ and this project adheres to [Semantic Versioning](http://semver.org/spec/v2.0.0.
 
 ## [Unreleased]
 
+## [6.45.10] - 2022-03-15
+
+### Fixed
+
+- Update sensitive fields.
+  - Add 'authorization', rawheaders', 'x-vtex-credential' and 'x-vtex-session'.
+- Lowercase fields before comparison in cleanJson.
+
+## [6.45.9] - 2022-03-08
+
+### Fixed
+
+- Fix cleanJson utility.
+
+## [6.45.8] - 2022-02-25
+
+### Fixed
+
+- Remove only cookie fields when cleaning logs.
+
 ## [6.45.7] - 2022-02-23
 
 ### Fixed

package/lib/service/worker/runtime/graphql/utils/error.js

@@ -2,7 +2,6 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 const ramda_1 = require("ramda");
 const error_1 = require("../../../../../utils/error");
-const log_1 = require("../../../../../utils/log");
 const ERROR_FIELD_WHITELIST = ['message', 'path', 'stack', 'extensions', 'statusCode', 'name', 'headers', 'originalError', 'code'];
 const QUERY_FIELDS = ['query', 'operationName', 'variables'];
 const trimVariables = (variables) => {
@@ -49,8 +48,8 @@ const formatError = (error, details) => {
             formattedError.extensions.exception = {
                 message: formattedError.originalError.message,
                 name: formattedError.originalError.name,
-                ...ramda_1.omit(log_1.FIRST_LEVEL_SENSITIVE_FIELDS, formattedError.originalError),
-                sensitive: ramda_1.pick(log_1.FIRST_LEVEL_SENSITIVE_FIELDS, formattedError.originalError),
+                ...ramda_1.omit(error_1.SENSITIVE_EXCEPTION_FIELDS, formattedError.originalError),
+                sensitive: ramda_1.pick(error_1.SENSITIVE_EXCEPTION_FIELDS, formattedError.originalError),
             };
         }
         else {
@@ -60,8 +59,8 @@ const formatError = (error, details) => {
             const extendedException = {
                 message: formattedError.originalError.message,
                 name: formattedError.originalError.name,
-                ...ramda_1.omit(log_1.FIRST_LEVEL_SENSITIVE_FIELDS, mergedException),
-                sensitive: ramda_1.pick(log_1.FIRST_LEVEL_SENSITIVE_FIELDS, mergedException),
+                ...ramda_1.omit(error_1.SENSITIVE_EXCEPTION_FIELDS, mergedException),
+                sensitive: ramda_1.pick(error_1.SENSITIVE_EXCEPTION_FIELDS, mergedException),
             };
             formattedError.extensions.exception = error_1.cleanError(extendedException);
         }

package/lib/service/worker/runtime/http/middlewares/error.js

@@ -4,7 +4,6 @@ const constants_1 = require("../../../../../constants");
 const RequestCancelledError_1 = require("../../../../../errors/RequestCancelledError");
 const TooManyRequestsError_1 = require("../../../../../errors/TooManyRequestsError");
 const error_1 = require("../../../../../utils/error");
-const log_1 = require("../../../../../utils/log");
 const logger_1 = require("../../../../logger");
 const CACHE_CONTROL_HEADER = 'cache-control';
 const META_HEADER = 'x-vtex-meta';
@@ -40,7 +39,7 @@ const logAndRemoveSensitiveData = (ctx, err) => {
     // Use sendLog directly to avoid cleaning error twice.
     ctx.vtex.logger.log(log, level);
     if (!constants_1.LINKED) {
-        log_1.FIRST_LEVEL_SENSITIVE_FIELDS.forEach(field => {
+        error_1.SENSITIVE_EXCEPTION_FIELDS.forEach(field => {
             delete err[field];
         });
     }

package/lib/utils/error.d.ts

@@ -1,4 +1,5 @@
 export declare const PICKED_AXIOS_PROPS: string[];
+export declare const SENSITIVE_EXCEPTION_FIELDS: string[];
 /**
  * Cleans errors by removing circular properties, truncating large strings and picking axios properties
  *

package/lib/utils/error.js

@@ -3,6 +3,7 @@ Object.defineProperty(exports, "__esModule", { value: true });
 // Inspired by https://github.com/sindresorhus/serialize-error
 const ramda_1 = require("ramda");
 exports.PICKED_AXIOS_PROPS = ['baseURL', 'cacheable', 'data', 'finished', 'headers', 'method', 'timeout', 'status', 'path', 'url', 'metric', 'inflightKey', 'forceMaxAge', 'params', 'responseType'];
+exports.SENSITIVE_EXCEPTION_FIELDS = ['config', 'request', 'stack'];
 const MAX_ERROR_STRING_LENGTH = process.env.MAX_ERROR_STRING_LENGTH ? parseInt(process.env.MAX_ERROR_STRING_LENGTH, 10) : 8 * 1024;
 const findCaseInsensitive = (target, set) => ramda_1.find(t => t.toLocaleLowerCase() === target, set);
 const destroyCircular = (from, seen) => {

package/lib/utils/json.d.ts

@@ -0,0 +1,5 @@
+export declare function cleanJson(json: {
+    [k: string]: any;
+}, targetFields: string[]): {
+    [k: string]: any;
+};

package/lib/utils/json.js

@@ -0,0 +1,18 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+function cleanJson(json, targetFields) {
+    for (const key of Object.keys(json)) {
+        let deleted = false;
+        for (const field of targetFields) {
+            if (key.toLowerCase() === field) {
+                delete json[key];
+                deleted = true;
+            }
+        }
+        if (!deleted && json[key] && typeof json[key] === 'object') {
+            json[key] = cleanJson(json[key], targetFields);
+        }
+    }
+    return json;
+}
+exports.cleanJson = cleanJson;

package/lib/utils/log.d.ts

@@ -1,3 +1,3 @@
-export declare const FIRST_LEVEL_SENSITIVE_FIELDS: string[];
-export declare const SECOND_LEVEL_SENSITIVE_FIELDS: string[][];
-export declare const cleanLog: (log: any) => void;
+export declare const cleanLog: (log: any) => {
+    [k: string]: any;
+};

package/lib/utils/log.js

@@ -1,14 +1,7 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.FIRST_LEVEL_SENSITIVE_FIELDS = ['config', 'request', 'stack', 'error'];
-exports.SECOND_LEVEL_SENSITIVE_FIELDS = [['parsedInfo', 'requestConfig'], ['headers', 'cookie']];
+const json_1 = require("./json");
+const SENSITIVE_FIELDS = ['authorization', 'cookie', 'vtexidclientautcookie', 'rawheaders', 'x-vtex-credential', 'x-vtex-session', 'error'];
 exports.cleanLog = (log) => {
-    exports.FIRST_LEVEL_SENSITIVE_FIELDS.forEach(field => {
-        delete log[field];
-    });
-    exports.SECOND_LEVEL_SENSITIVE_FIELDS.forEach(field => {
-        if (field[0] in log) {
-            delete log[field[0]][field[1]];
-        }
-    });
+    return json_1.cleanJson(log, SENSITIVE_FIELDS);
 };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@vtex/api",
-  "version": "6.45.7",
+  "version": "6.45.10",
   "description": "VTEX I/O API client",
   "main": "lib/index.js",
   "typings": "lib/index.d.ts",