@vtex/api 6.52.5 → 6.52.6-beta.0

package/CHANGELOG.md

@@ -7,6 +7,19 @@ and this project adheres to [Semantic Versioning](http://semver.org/spec/v2.0.0.
 
 ## [Unreleased]
 
+### Security
+
+- Redact credential headers and serialized credentials inside JSON responses, including REST
+  Axios objects and GraphQL error messages. Covers `proxy-authorization`, `x-vtex-api-appkey`
+  and `x-vtex-api-apptoken`, case-insensitively, using the same patterns as string bodies.
+- Preserve the existing inspection-limit behavior: send unvisited values unchanged and report
+  `limit_reached`, retaining redactions already completed. Uninspectable custom serialization
+  still withholds the response. Buffers and streams remain outside
+  the JSON sanitizer; apps must not put credentials in them. Apps must adopt the updated library
+  with `VTEX_IO_RESPONSE_SANITIZER` enabled to receive this protection. Unknown credentials
+  represented as name/value header pairs are outside this protection.
+- Report fixed inspection failure categories when a response is withheld, without logging its content.
+
 ## [6.52.5]
 
 ### Security

package/lib/service/worker/runtime/http/middlewares/error.js

@@ -5,6 +5,7 @@ const constants_1 = require("../../../../../constants");
 const RequestCancelledError_1 = require("../../../../../errors/RequestCancelledError");
 const TooManyRequestsError_1 = require("../../../../../errors/TooManyRequestsError");
 const error_1 = require("../../../../../utils/error");
+const responseCredentials_1 = require("../../../../../utils/responseCredentials");
 const responseSanitizer_1 = require("../../../../../utils/responseSanitizer");
 const logger_1 = require("../../../../logger");
 const sanitizeResponse_1 = require("./sanitizeResponse");
@@ -51,12 +52,18 @@ const logAndRemoveSensitiveData = (ctx, err) => {
 // bodies the app sets, so both paths expose the same: `cleanError` alone removes credentials only
 // at the top level, and by a short list of header names, so an error that is a property of the
 // thrown value (`originalError`) kept its config, request and stack.
-const buildResponseBody = (thrown) => {
+const buildResponseBody = (thrown, ctx) => {
+    var _a;
     try {
-        return (0, error_1.cleanError)((0, responseSanitizer_1.sanitizeErrors)(thrown, { linked: constants_1.LINKED }).value);
+        const sanitized = (0, responseSanitizer_1.sanitizeErrors)(thrown, { linked: constants_1.LINKED });
+        const { authToken, adminUserAuthToken, storeUserAuthToken } = (_a = ctx.vtex) !== null && _a !== void 0 ? _a : {};
+        return (0, responseCredentials_1.sanitizeCredentials)((0, error_1.cleanError)(sanitized.value), [authToken, adminUserAuthToken, storeUserAuthToken]).value;
     }
     catch (sanitizeError) {
-        console.error('[node-vtex-api error] the thrown value could not be sanitized', sanitizeError === null || sanitizeError === void 0 ? void 0 : sanitizeError.name);
+        console.error('[node-vtex-api error] the thrown value could not be sanitized', {
+            errorName: sanitizeError === null || sanitizeError === void 0 ? void 0 : sanitizeError.name,
+            inspectionReason: (0, responseCredentials_1.inspectionFailureReason)(sanitizeError),
+        });
         return sanitizeResponse_1.WITHHELD_BODY;
     }
 };
@@ -97,7 +104,7 @@ async function error(ctx, next) {
         // `err` is what is logged, which keeps the config and the request to debug with. It is not the
         // body: the sanitized value is.
         logAndRemoveSensitiveData(ctx, err);
-        ctx.body = ctx.body || buildResponseBody(e);
+        ctx.body = ctx.body || buildResponseBody(e, ctx);
     }
 }
 exports.error = error;

package/lib/service/worker/runtime/http/middlewares/sanitizeResponse.d.ts

@@ -29,7 +29,7 @@ export declare enum SanitizerReason {
  *
  * The body is also sanitized when the downstream handlers throw after having set it, as the error
  * middleware keeps an existing body. If the sanitizer itself fails the body is withheld. If it
- * cannot inspect the whole body, the response is sent and the limit is reported. It never throws.
+ * reaches an inspection limit, unvisited values are sent unchanged and the limit is reported. It never throws.
  *
  * It is a backstop for apps that return errors by mistake. It is not a boundary against an app that
  * wants to disclose its own credentials, which has them.

package/lib/service/worker/runtime/http/middlewares/sanitizeResponse.js

@@ -2,6 +2,7 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.sanitizeResponse = exports.SanitizerReason = exports.WITHHELD_BODY = exports.RESPONSE_SANITIZER_SWITCH = void 0;
 const constants_1 = require("../../../../../constants");
+const responseCredentials_1 = require("../../../../../utils/responseCredentials");
 const responseSanitizer_1 = require("../../../../../utils/responseSanitizer");
 const stringRedactor_1 = require("../../../../../utils/stringRedactor");
 /**
@@ -72,6 +73,7 @@ const redactStringBody = (ctx, body) => {
     warn(ctx, SanitizerReason.SecretRemoved, { redactions: redacted });
 };
 const sanitizeCtxBody = (ctx) => {
+    var _a;
     try {
         if (process.env[exports.RESPONSE_SANITIZER_SWITCH] === 'off') {
             return;
@@ -87,13 +89,13 @@ const sanitizeCtxBody = (ctx) => {
         // Most bodies have no error. A scan decides that without the copying walk; the walk runs only
         // once an error has been found, or the scan could not finish.
         const scan = (0, responseSanitizer_1.scanForErrors)(body);
-        if (scan === 'clean') {
-            return;
-        }
-        const { value, replaced, truncated } = (0, responseSanitizer_1.sanitizeErrors)(body, { linked: constants_1.LINKED });
-        if (truncated) {
-            // What is beyond the limit is left as it is, outside an error. The response is still sent:
-            // withholding it would break the large legitimate responses. It is reported to be measured.
+        const sanitized = scan === 'clean'
+            ? { value: body, replaced: 0, truncated: false }
+            : (0, responseSanitizer_1.sanitizeErrors)(body, { linked: constants_1.LINKED });
+        const { replaced, truncated } = sanitized;
+        const { authToken, adminUserAuthToken, storeUserAuthToken } = (_a = ctx.vtex) !== null && _a !== void 0 ? _a : {};
+        const { value, redacted, truncated: credentialsTruncated } = (0, responseCredentials_1.sanitizeCredentials)(sanitized.value, [authToken, adminUserAuthToken, storeUserAuthToken]);
+        if (truncated || credentialsTruncated) {
             warn(ctx, SanitizerReason.LimitReached);
         }
         if (value === body) {
@@ -106,12 +108,17 @@ const sanitizeCtxBody = (ctx) => {
         if (contentType) {
             ctx.set('Content-Type', contentType);
         }
-        warn(ctx, SanitizerReason.ErrorRemoved, { errors: replaced });
+        if (replaced > 0) {
+            warn(ctx, SanitizerReason.ErrorRemoved, { errors: replaced });
+        }
+        if (redacted > 0) {
+            warn(ctx, SanitizerReason.SecretRemoved, { redactions: redacted });
+        }
     }
     catch (err) {
-        // Fails closed: whatever made it fail may also be hiding a credential.
+        // Withhold on inspection failures; reaching a traversal budget above still preserves the response.
         withholdBody(ctx);
-        warn(ctx, SanitizerReason.Failed, { errorName: errorName(err) });
+        warn(ctx, SanitizerReason.Failed, { errorName: errorName(err), inspectionReason: (0, responseCredentials_1.inspectionFailureReason)(err) });
     }
 };
 /**
@@ -127,7 +134,7 @@ const sanitizeCtxBody = (ctx) => {
  *
  * The body is also sanitized when the downstream handlers throw after having set it, as the error
  * middleware keeps an existing body. If the sanitizer itself fails the body is withheld. If it
- * cannot inspect the whole body, the response is sent and the limit is reported. It never throws.
+ * reaches an inspection limit, unvisited values are sent unchanged and the limit is reported. It never throws.
  *
  * It is a backstop for apps that return errors by mistake. It is not a boundary against an app that
  * wants to disclose its own credentials, which has them.

package/lib/utils/responseCredentials.d.ts

@@ -0,0 +1,19 @@
+type InspectionReason = 'cycle' | 'custom_serialization' | 'custom_date_serialization' | 'unsupported_object' | 'accessor';
+export declare class ResponseInspectionError extends Error {
+    readonly reason: InspectionReason;
+    constructor(reason: InspectionReason);
+}
+export declare const inspectionFailureReason: (error: unknown) => string;
+/**
+ * Copy-on-write redaction for JSON response values, including already serialized Axios errors
+ * and GraphQL messages. Does not mutate cached/frozen values. Limits preserve unvisited values;
+ * unexpected inspection failures still throw.
+ * Unknown secrets in name/value header pairs are not recognized as credential fields.
+ * Buffers and streams are handled separately by the HTTP middleware and are outside this contract.
+ */
+export declare const sanitizeCredentials: <T>(body: T, secrets?: Array<string | undefined>) => {
+    redacted: number;
+    truncated: boolean;
+    value: T;
+};
+export {};

package/lib/utils/responseCredentials.js

@@ -0,0 +1,98 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.sanitizeCredentials = exports.inspectionFailureReason = exports.ResponseInspectionError = void 0;
+const stringRedactor_1 = require("./stringRedactor");
+// Bound work before serializing a response. Preserve the existing limit behavior: leave
+// unvisited values untouched and report truncation instead of withholding the response.
+const MAX_DEPTH = 32;
+const MAX_VALUES = 5000000;
+const MAX_TEXT_LENGTH = 16 * 1024 * 1024;
+class ResponseInspectionError extends Error {
+    constructor(reason) {
+        super('Response inspection failed');
+        this.reason = reason;
+    }
+}
+exports.ResponseInspectionError = ResponseInspectionError;
+// Fixed categories only: never include response values or arbitrary exception messages in diagnostics.
+const inspectionFailureReason = (error) => error instanceof ResponseInspectionError ? error.reason : 'unexpected_failure';
+exports.inspectionFailureReason = inspectionFailureReason;
+/**
+ * Copy-on-write redaction for JSON response values, including already serialized Axios errors
+ * and GraphQL messages. Does not mutate cached/frozen values. Limits preserve unvisited values;
+ * unexpected inspection failures still throw.
+ * Unknown secrets in name/value header pairs are not recognized as credential fields.
+ * Buffers and streams are handled separately by the HTTP middleware and are outside this contract.
+ */
+const sanitizeCredentials = (body, secrets = []) => {
+    let values = 0;
+    let textLength = 0;
+    let redacted = 0;
+    let truncated = false;
+    const ancestors = new Set();
+    const visit = (value, depth) => {
+        if (++values > MAX_VALUES || depth > MAX_DEPTH) {
+            truncated = true;
+            return value;
+        }
+        if (typeof value === 'string') {
+            textLength += value.length;
+            if (textLength > MAX_TEXT_LENGTH) {
+                truncated = true;
+                return value;
+            }
+            const redaction = (0, stringRedactor_1.redactSecrets)(value, secrets);
+            redacted += redaction.redacted;
+            return redaction.value;
+        }
+        if (value === null || typeof value !== 'object') {
+            return value;
+        }
+        // Dates serialize to a credential-free ISO string. Other custom serialization cannot be
+        // inspected reliably without executing it; withhold it instead of sending unchecked output.
+        if (value instanceof Date) {
+            if (value.toJSON !== Date.prototype.toJSON) {
+                throw new ResponseInspectionError('custom_date_serialization');
+            }
+            return value;
+        }
+        if (ancestors.has(value)) {
+            throw new ResponseInspectionError('cycle');
+        }
+        if (typeof value.toJSON === 'function') {
+            throw new ResponseInspectionError('custom_serialization');
+        }
+        const proto = Object.getPrototypeOf(value);
+        if (!Array.isArray(value) && proto !== Object.prototype && proto !== null) {
+            throw new ResponseInspectionError('unsupported_object');
+        }
+        const keys = Object.keys(value);
+        if (values + keys.length > MAX_VALUES) {
+            truncated = true;
+            return value;
+        }
+        ancestors.add(value);
+        let result = value;
+        for (const key of keys) {
+            const descriptor = Object.getOwnPropertyDescriptor(value, key);
+            if (!('value' in descriptor)) {
+                throw new ResponseInspectionError('accessor');
+            }
+            const child = descriptor.value;
+            const sensitive = (0, stringRedactor_1.isSensitiveKey)(key) && child != null && child !== stringRedactor_1.REDACTED;
+            const safe = sensitive ? stringRedactor_1.REDACTED : visit(child, depth + 1);
+            if (sensitive) {
+                redacted++;
+            }
+            if (safe !== child) {
+                result = result === value ? (Array.isArray(value) ? value.slice() : { ...value }) : result;
+                Object.defineProperty(result, key, { configurable: true, enumerable: true, value: safe, writable: true });
+            }
+        }
+        ancestors.delete(value);
+        return result;
+    };
+    const sanitized = visit(body, 0);
+    return { redacted, truncated, value: sanitized };
+};
+exports.sanitizeCredentials = sanitizeCredentials;

package/lib/utils/stringRedactor.d.ts

@@ -1,4 +1,5 @@
 export declare const REDACTED = "[Redacted]";
+export declare const isSensitiveKey: (key: string) => boolean;
 export interface RedactResult {
     value: string;
     /**

package/lib/utils/stringRedactor.js

@@ -1,6 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.redactSecrets = exports.REDACTED = void 0;
+exports.redactSecrets = exports.isSensitiveKey = exports.REDACTED = void 0;
 exports.REDACTED = '[Redacted]';
 // Shorter values are not credentials, and replacing them everywhere would damage ordinary text.
 const MIN_SECRET_LENGTH = 16;
@@ -18,6 +18,9 @@ const SENSITIVE_KEYS = [
     'x-vtex-credential',
     'x-vtex-session',
 ];
+const sensitiveKeys = new Set(SENSITIVE_KEYS);
+const isSensitiveKey = (key) => sensitiveKeys.has(key.toLowerCase());
+exports.isSensitiveKey = isSensitiveKey;
 // `"key":"value"`, also when the text was serialized twice (`\"key\":\"value\"`). Captures
 // everything up to the value, which is what is replaced. The value is a run of characters that are
 // not a quote, where a backslash only escapes the character after it. The two alternatives of the

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@vtex/api",
-  "version": "6.52.5",
+  "version": "6.52.6-beta.0",
   "description": "VTEX I/O API client",
   "main": "lib/index.js",
   "typings": "lib/index.d.ts",