@vtex/api 7.6.0 → 7.6.1

package/CHANGELOG.md

@@ -5,6 +5,26 @@ All notable changes to this project will be documented in this file.
 The format is based on [Keep a Changelog](http://keepachangelog.com/en/1.0.0/)
 and this project adheres to [Semantic Versioning](http://semver.org/spec/v2.0.0.html).
 
+## [7.6.1]
+
+### Security
+
+- Error objects assigned to the response body no longer expose the request
+  configuration, credentials, connection agents or, outside link mode, the
+  stack. If the response cannot be sanitized it is withheld. A body the walk cannot
+  inspect completely is sent as it is, and the limit is reported.
+- String response bodies built from an error (`` `failed: ${JSON.stringify(error)}` ``) no longer
+  expose its credentials: the request's tokens, the value of credential headers (`authorization`,
+  `proxy-authorization`, `VtexIdclientAutCookie`, `x-vtex-api-*`), the VTEX ID cookie and `Bearer`
+  tokens are replaced with `[Redacted]`. The same names are replaced when the request is
+  embedded as header lines (`Cookie`, `Set-Cookie`, `X-Vtex-Session`), not only as JSON keys.
+- The body the runtime builds from a thrown value goes through the same sanitizer. An error that is
+  a property of the thrown one (`originalError`), or sits in a thrown object, no longer exposes its
+  request configuration, request or stack, and the upstream response headers are no longer
+  included. Linked apps keep the stack but no longer get the configuration in the body.
+- Errors printed by the runtime no longer include the request configuration.
+- GraphQL error responses no longer include the stack outside link mode.
+
 ## [7.6.0]
 
 ### Added

package/lib/clients/infra/VBase.d.ts

@@ -11,6 +11,12 @@ export declare class VBase extends InfraClient {
     constructor(context: IOContext, options?: InstanceOptions);
     getBucket: (bucket: string, tracingConfig?: RequestTracingConfig) => Promise<BucketMetadata>;
     resetBucket: (bucket: string, tracingConfig?: RequestTracingConfig) => Promise<IOResponse<void>>;
+    /**
+     * @deprecated The VBase list-files route is no longer maintained by VTEX, and only a few internal
+     * applications have access to due to needed backwards compatibility, reason why this interface
+     * remains in the code. Using this method will result in 404 by any caller, regardless of account
+     * and workspace.
+     */
     listFiles: (bucket: string, opts?: string | VBaseOptions, tracingConfig?: RequestTracingConfig) => Promise<BucketFileList>;
     getFile: (bucket: string, path: string, tracingConfig?: RequestTracingConfig) => Promise<{
         data: Buffer;

package/lib/clients/infra/VBase.js

@@ -38,6 +38,12 @@ class VBase extends InfraClient_1.InfraClient {
                     ...tracingConfig === null || tracingConfig === void 0 ? void 0 : tracingConfig.tracing,
                 } });
         };
+        /**
+         * @deprecated The VBase list-files route is no longer maintained by VTEX, and only a few internal
+         * applications have access to due to needed backwards compatibility, reason why this interface
+         * remains in the code. Using this method will result in 404 by any caller, regardless of account
+         * and workspace.
+         */
         this.listFiles = (bucket, opts, tracingConfig) => {
             let params = {};
             if (isVBaseOptions(opts)) {

package/lib/service/worker/index.js

@@ -28,6 +28,7 @@ const graphql_1 = require("./runtime/graphql");
 const http_2 = require("./runtime/http");
 const error_1 = require("./runtime/http/middlewares/error");
 const rateLimit_1 = require("./runtime/http/middlewares/rateLimit");
+const sanitizeResponse_1 = require("./runtime/http/middlewares/sanitizeResponse");
 const router_2 = require("./runtime/http/router");
 const routes_1 = require("./runtime/http/routes");
 const statusTrack_1 = require("./runtime/statusTrack");
@@ -178,7 +179,8 @@ const startWorker = (serviceJSON) => {
         .use((0, middlewares_1.addMetricsLoggerMiddleware)())
         .use((0, rateLimit_1.concurrentRateLimiter)((_a = serviceJSON === null || serviceJSON === void 0 ? void 0 : serviceJSON.rateLimitPerReplica) === null || _a === void 0 ? void 0 : _a.concurrent))
         .use((0, koa_compress_1.default)())
-        .use(middlewares_1.recorderMiddleware);
+        .use(middlewares_1.recorderMiddleware)
+        .use(sanitizeResponse_1.sanitizeResponse);
     const service = (0, loaders_1.getService)();
     const { config: { clients } } = service;
     if (clients) {

package/lib/service/worker/listeners.js

@@ -3,6 +3,7 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.addProcessListeners = exports.logger = void 0;
 const os_1 = require("os");
 const RequestCancelledError_1 = require("../../errors/RequestCancelledError");
+const responseSanitizer_1 = require("../../utils/responseSanitizer");
 const logger_1 = require("../logger");
 exports.logger = new logger_1.Logger({ account: 'unhandled', workspace: 'unhandled', requestId: 'unhandled', operationId: 'unhandled', production: process.env.VTEX_PRODUCTION === 'true' });
 let watched;
@@ -15,18 +16,19 @@ const addProcessListeners = () => {
         return;
     }
     watched = process.on('uncaughtException', (err) => {
-        console.error('uncaughtException', err);
+        console.error('uncaughtException', (0, responseSanitizer_1.toLoggableError)(err));
         if (err && exports.logger) {
             err.type = 'uncaughtException';
             exports.logger.error(err);
         }
         process.exit(420);
     });
-    process.on('unhandledRejection', (reason, promise) => {
+    process.on('unhandledRejection', (reason) => {
         if (reason instanceof RequestCancelledError_1.RequestCancelledError) {
             return;
         }
-        console.error('unhandledRejection', reason, promise);
+        // The promise is not printed: inspecting it shows the rejection reason again, unsanitized.
+        console.error('unhandledRejection', (0, responseSanitizer_1.toLoggableError)(reason));
         if (reason && exports.logger) {
             reason.type = 'unhandledRejection';
             exports.logger.error(reason);

package/lib/service/worker/runtime/graphql/middlewares/error.js

@@ -36,8 +36,14 @@ const createLogErrorToSplunk = (vtex) => (err) => {
         logger.log(log, level);
     }
     finally {
-        if (!constants_1.LINKED && ((_f = (_e = err === null || err === void 0 ? void 0 : err.extensions) === null || _e === void 0 ? void 0 : _e.exception) === null || _f === void 0 ? void 0 : _f.sensitive)) {
-            delete err.extensions.exception.sensitive;
+        if (!constants_1.LINKED) {
+            // Already logged above. The response must not carry them.
+            if ((_f = (_e = err === null || err === void 0 ? void 0 : err.extensions) === null || _e === void 0 ? void 0 : _e.exception) === null || _f === void 0 ? void 0 : _f.sensitive) {
+                delete err.extensions.exception.sensitive;
+            }
+            if (err) {
+                delete err.stack;
+            }
         }
     }
 };

package/lib/service/worker/runtime/http/middlewares/error.js

@@ -5,7 +5,9 @@ const constants_1 = require("../../../../../constants");
 const RequestCancelledError_1 = require("../../../../../errors/RequestCancelledError");
 const TooManyRequestsError_1 = require("../../../../../errors/TooManyRequestsError");
 const error_1 = require("../../../../../utils/error");
+const responseSanitizer_1 = require("../../../../../utils/responseSanitizer");
 const logger_1 = require("../../../../logger");
+const sanitizeResponse_1 = require("./sanitizeResponse");
 const CACHE_CONTROL_HEADER = 'cache-control';
 const META_HEADER = 'x-vtex-meta';
 const ETAG_HEADER = 'etag';
@@ -45,6 +47,19 @@ const logAndRemoveSensitiveData = (ctx, err) => {
         });
     }
 };
+// What is sent to the client for a thrown value. It is built with the sanitizer that covers the
+// bodies the app sets, so both paths expose the same: `cleanError` alone removes credentials only
+// at the top level, and by a short list of header names, so an error that is a property of the
+// thrown value (`originalError`) kept its config, request and stack.
+const buildResponseBody = (thrown) => {
+    try {
+        return (0, error_1.cleanError)((0, responseSanitizer_1.sanitizeErrors)(thrown, { linked: constants_1.LINKED }).value);
+    }
+    catch (sanitizeError) {
+        console.error('[node-vtex-api error] the thrown value could not be sanitized', sanitizeError === null || sanitizeError === void 0 ? void 0 : sanitizeError.name);
+        return sanitizeResponse_1.WITHHELD_BODY;
+    }
+};
 async function error(ctx, next) {
     var _a;
     try {
@@ -59,7 +74,8 @@ async function error(ctx, next) {
             ctx.status = TooManyRequestsError_1.tooManyRequestsStatus;
             return;
         }
-        console.error('[node-vtex-api error]', e);
+        // The raw error carries the request config, whose headers include credentials.
+        console.error('[node-vtex-api error]', (0, responseSanitizer_1.toLoggableError)(e));
         const err = (0, error_1.cleanError)(e);
         // Add response
         ctx.status = (e === null || e === void 0 ? void 0 : e.status) && e.status >= 400 && e.status <= 599
@@ -78,8 +94,10 @@ async function error(ctx, next) {
         else {
             ctx.set(CACHE_CONTROL_HEADER, `no-cache, no-store`);
         }
+        // `err` is what is logged, which keeps the config and the request to debug with. It is not the
+        // body: the sanitized value is.
         logAndRemoveSensitiveData(ctx, err);
-        ctx.body = ctx.body || err;
+        ctx.body = ctx.body || buildResponseBody(e);
     }
 }
 exports.error = error;

package/lib/service/worker/runtime/http/middlewares/sanitizeResponse.d.ts

@@ -0,0 +1,37 @@
+import { ServiceContext } from '../../typings';
+/**
+ * Setting this environment variable to `off` disables the sanitizer.
+ */
+export declare const RESPONSE_SANITIZER_SWITCH = "VTEX_IO_RESPONSE_SANITIZER";
+/**
+ * Sent when the body could not be sanitized: it is not known whether it is safe, so it is withheld.
+ */
+export declare const WITHHELD_BODY: {
+    code: string;
+    message: string;
+};
+export declare enum SanitizerReason {
+    ErrorRemoved = "error_object_removed",
+    SecretRemoved = "secret_removed",
+    LimitReached = "limit_reached",
+    Failed = "sanitizer_failed"
+}
+/**
+ * Removes error objects (`Error`, `AxiosError`) from the response body, so apps that write a caught
+ * error to `ctx.body` do not expose the request configuration (credentials), the stack and the
+ * connection internals to the caller.
+ *
+ * String bodies are also covered, for errors that were turned into text: the credentials in them
+ * (the ones of the request, the credential headers, `Bearer` tokens) are replaced.
+ *
+ * It must be registered after `compress()`, which serializes the body: it needs to see the object,
+ * and to change it before it is serialized.
+ *
+ * The body is also sanitized when the downstream handlers throw after having set it, as the error
+ * middleware keeps an existing body. If the sanitizer itself fails the body is withheld. If it
+ * cannot inspect the whole body, the response is sent and the limit is reported. It never throws.
+ *
+ * It is a backstop for apps that return errors by mistake. It is not a boundary against an app that
+ * wants to disclose its own credentials, which has them.
+ */
+export declare function sanitizeResponse(ctx: ServiceContext, next: () => Promise<void>): Promise<void>;

package/lib/service/worker/runtime/http/middlewares/sanitizeResponse.js

@@ -0,0 +1,143 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.sanitizeResponse = exports.SanitizerReason = exports.WITHHELD_BODY = exports.RESPONSE_SANITIZER_SWITCH = void 0;
+const constants_1 = require("../../../../../constants");
+const responseSanitizer_1 = require("../../../../../utils/responseSanitizer");
+const stringRedactor_1 = require("../../../../../utils/stringRedactor");
+/**
+ * Setting this environment variable to `off` disables the sanitizer.
+ */
+exports.RESPONSE_SANITIZER_SWITCH = 'VTEX_IO_RESPONSE_SANITIZER';
+/**
+ * Sent when the body could not be sanitized: it is not known whether it is safe, so it is withheld.
+ */
+exports.WITHHELD_BODY = {
+    code: 'E_RESPONSE_WITHHELD',
+    message: 'The response could not be safely returned.',
+};
+var SanitizerReason;
+(function (SanitizerReason) {
+    SanitizerReason["ErrorRemoved"] = "error_object_removed";
+    SanitizerReason["SecretRemoved"] = "secret_removed";
+    SanitizerReason["LimitReached"] = "limit_reached";
+    SanitizerReason["Failed"] = "sanitizer_failed";
+})(SanitizerReason = exports.SanitizerReason || (exports.SanitizerReason = {}));
+// Only the class of the error is reported: its message may carry what is being kept out.
+const errorName = (err) => err === null || err === void 0 ? void 0 : err.name;
+const warn = (ctx, reason, fields = {}) => {
+    var _a, _b, _c;
+    const payload = {
+        message: `response-sanitizer: ${reason}`,
+        reason,
+        routeId: (_b = (_a = ctx.vtex) === null || _a === void 0 ? void 0 : _a.route) === null || _b === void 0 ? void 0 : _b.id,
+        ...fields,
+    };
+    try {
+        if ((_c = ctx.vtex) === null || _c === void 0 ? void 0 : _c.logger) {
+            ctx.vtex.logger.warn(payload);
+        }
+        else {
+            console.warn(JSON.stringify(payload));
+        }
+    }
+    catch (err) {
+        // Logging must never break the response: the event goes to the process output instead.
+        console.warn(JSON.stringify({ ...payload, loggerErrorName: errorName(err) }));
+    }
+};
+const withholdBody = (ctx) => {
+    try {
+        if (ctx.status < 400) {
+            ctx.status = 500;
+        }
+        ctx.body = exports.WITHHELD_BODY;
+    }
+    catch (err) {
+        // There is nothing else that can be done safely: as a last resort the response is emptied.
+        ctx.body = null;
+        warn(ctx, SanitizerReason.Failed, { withholdErrorName: errorName(err) });
+    }
+};
+// A string body can hold an error that was turned into text (`JSON.stringify(error)`), which has
+// no error object left to find. What can be told apart is the credential itself.
+const redactStringBody = (ctx, body) => {
+    var _a;
+    const { authToken, adminUserAuthToken, storeUserAuthToken } = (_a = ctx.vtex) !== null && _a !== void 0 ? _a : {};
+    const { value, redacted } = (0, stringRedactor_1.redactSecrets)(body, [authToken, adminUserAuthToken, storeUserAuthToken]);
+    if (redacted === 0) {
+        return;
+    }
+    // Koa keeps the type already set when the body is a string, and updates the length.
+    ctx.body = value;
+    warn(ctx, SanitizerReason.SecretRemoved, { redactions: redacted });
+};
+const sanitizeCtxBody = (ctx) => {
+    try {
+        if (process.env[exports.RESPONSE_SANITIZER_SWITCH] === 'off') {
+            return;
+        }
+        const body = ctx.body;
+        if (typeof body === 'string') {
+            redactStringBody(ctx, body);
+            return;
+        }
+        if (body === null || typeof body !== 'object' || Buffer.isBuffer(body) || typeof body.pipe === 'function') {
+            return;
+        }
+        // Most bodies have no error. A scan decides that without the copying walk; the walk runs only
+        // once an error has been found, or the scan could not finish.
+        const scan = (0, responseSanitizer_1.scanForErrors)(body);
+        if (scan === 'clean') {
+            return;
+        }
+        const { value, replaced, truncated } = (0, responseSanitizer_1.sanitizeErrors)(body, { linked: constants_1.LINKED });
+        if (truncated) {
+            // What is beyond the limit is left as it is, outside an error. The response is still sent:
+            // withholding it would break the large legitimate responses. It is reported to be measured.
+            warn(ctx, SanitizerReason.LimitReached);
+        }
+        if (value === body) {
+            return;
+        }
+        // Koa sets `Content-Type: application/json` whenever an object is assigned to the body, which
+        // would override a type chosen by the app.
+        const contentType = ctx.response.get('Content-Type');
+        ctx.body = value;
+        if (contentType) {
+            ctx.set('Content-Type', contentType);
+        }
+        warn(ctx, SanitizerReason.ErrorRemoved, { errors: replaced });
+    }
+    catch (err) {
+        // Fails closed: whatever made it fail may also be hiding a credential.
+        withholdBody(ctx);
+        warn(ctx, SanitizerReason.Failed, { errorName: errorName(err) });
+    }
+};
+/**
+ * Removes error objects (`Error`, `AxiosError`) from the response body, so apps that write a caught
+ * error to `ctx.body` do not expose the request configuration (credentials), the stack and the
+ * connection internals to the caller.
+ *
+ * String bodies are also covered, for errors that were turned into text: the credentials in them
+ * (the ones of the request, the credential headers, `Bearer` tokens) are replaced.
+ *
+ * It must be registered after `compress()`, which serializes the body: it needs to see the object,
+ * and to change it before it is serialized.
+ *
+ * The body is also sanitized when the downstream handlers throw after having set it, as the error
+ * middleware keeps an existing body. If the sanitizer itself fails the body is withheld. If it
+ * cannot inspect the whole body, the response is sent and the limit is reported. It never throws.
+ *
+ * It is a backstop for apps that return errors by mistake. It is not a boundary against an app that
+ * wants to disclose its own credentials, which has them.
+ */
+async function sanitizeResponse(ctx, next) {
+    try {
+        await next();
+    }
+    finally {
+        sanitizeCtxBody(ctx);
+    }
+}
+exports.sanitizeResponse = sanitizeResponse;

package/lib/utils/responseSanitizer.d.ts

@@ -0,0 +1,52 @@
+export interface SanitizeErrorsOptions {
+    /**
+     * When true (linked apps in development, and logs) the stack is kept to help debugging.
+     */
+    linked: boolean;
+    maxDepth?: number;
+    maxNodes?: number;
+    /**
+     * Total length of the arrays and objects visited, so that the cost of a long flat array is
+     * bounded the same as the number of containers.
+     */
+    maxValues?: number;
+}
+export interface SanitizeErrorsResult<T> {
+    /**
+     * The same reference received when nothing had to change.
+     */
+    value: T;
+    /**
+     * Number of error instances replaced by their safe representation.
+     */
+    replaced: number;
+    /**
+     * True when a limit (depth, containers, values) stopped the walk early. Outside an error the part
+     * not visited is left as it is. Inside an error it is replaced by a marker.
+     */
+    truncated: boolean;
+}
+/**
+ * Finds `Error` instances (including `AxiosError`) in a response body, at any depth of plain
+ * objects and arrays, and replaces each one by a safe representation: the message, name, code and
+ * status are kept, while the request config, the Node request, the agents, the upstream headers
+ * and, unless linked, the stack are removed.
+ *
+ * Strings, buffers, streams and class instances other than errors are returned untouched.
+ */
+export declare const sanitizeErrors: <T>(value: T, options: SanitizeErrorsOptions) => SanitizeErrorsResult<T>;
+export type ErrorScan = 'clean' | 'has-error' | 'truncated';
+/**
+ * Says whether `value` contains an `Error`, without copying it. The copying walk is only needed
+ * when this returns `has-error`. `truncated` means a budget (depth, containers, or the values they
+ * hold) was spent before the value was fully inspected, so whatever was not visited must not be sent.
+ */
+export declare const scanForErrors: (value: object, options?: Pick<SanitizeErrorsOptions, 'maxDepth' | 'maxNodes' | 'maxValues'>) => ErrorScan;
+/**
+ * The same as `sanitizeErrors` for what is written to the process output, where the stack is
+ * useful and kept. A thrown `Error` stays an error, so it is printed as one (stack, then its
+ * properties), without the request config, the request and the agents.
+ *
+ * It never throws.
+ */
+export declare const toLoggableError: (value: unknown) => unknown;

package/lib/utils/responseSanitizer.js

@@ -0,0 +1,354 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.toLoggableError = exports.scanForErrors = exports.sanitizeErrors = void 0;
+const error_1 = require("./error");
+/**
+ * Properties of an error that hold HTTP-client internals: the request config (headers carry
+ * credentials), the Node request object, and the connection agents. They are never serialized.
+ * `response` is rebuilt separately, so that its headers and request are left out too.
+ */
+const INTERNAL_ERROR_KEYS = new Set(['config', 'request', 'httpAgent', 'httpsAgent', 'response']);
+const DEFAULT_MAX_DEPTH = 32;
+const DEFAULT_MAX_NODES = 200000;
+// What the containers hold, counted by their length. About 35 ms to go through on a laptop, which
+// is far past a legitimate response.
+const DEFAULT_MAX_VALUES = 5000000;
+const TRUNCATED = '[Truncated]';
+const CIRCULAR = '[Circular]';
+// `instanceof` is not enough for errors that come from another realm (a `vm` context), which
+// `Object.prototype.toString` still identifies.
+const isError = (node) => node instanceof Error || Object.prototype.toString.call(node) === '[object Error]';
+// Buffers and typed arrays, which have one entry per byte when walked as objects.
+const isBinary = (node) => Buffer.isBuffer(node) || ArrayBuffer.isView(node) || node instanceof ArrayBuffer;
+const isPlainObject = (node) => {
+    const proto = Object.getPrototypeOf(node);
+    return proto === Object.prototype || proto === null;
+};
+/**
+ * What is shown instead of a value that is kept out of an error: binary data, streams and
+ * instances of classes, which can hold large or circular graphs (sockets, agents, handles).
+ */
+const describeOpaque = (node) => {
+    var _a;
+    if (node instanceof Date) {
+        return Number.isNaN(node.getTime()) ? '[Invalid Date]' : node.toISOString();
+    }
+    const name = ((_a = node === null || node === void 0 ? void 0 : node.constructor) === null || _a === void 0 ? void 0 : _a.name) || 'Object';
+    if (isBinary(node)) {
+        return `[${name} ${node.byteLength} bytes]`;
+    }
+    return `[${name}]`;
+};
+class ErrorSanitizer {
+    constructor({ linked, maxDepth, maxNodes, maxValues }) {
+        this.replaced = 0;
+        this.truncated = false;
+        this.nodes = 0;
+        this.values = 0;
+        this.insideError = 0;
+        // The containers being walked, from the root. At most `maxDepth` + 1 of them, so searching it is
+        // cheaper than maintaining a set.
+        this.ancestors = [];
+        this.linked = linked;
+        this.maxDepth = maxDepth !== null && maxDepth !== void 0 ? maxDepth : DEFAULT_MAX_DEPTH;
+        this.maxNodes = maxNodes !== null && maxNodes !== void 0 ? maxNodes : DEFAULT_MAX_NODES;
+        this.maxValues = maxValues !== null && maxValues !== void 0 ? maxValues : DEFAULT_MAX_VALUES;
+    }
+    /**
+     * Copy-on-write walk: containers are copied only when something below them changed, and the
+     * received objects are never mutated (they may be frozen, cached or still in use by the app).
+     */
+    walk(node, depth) {
+        if (node === null || typeof node !== 'object') {
+            return node;
+        }
+        if (this.ancestors.includes(node)) {
+            // A cycle. Inside an error it must not lead back to the received error, which has the config
+            // and the request. In a body, serializing it fails regardless of this walk.
+            return this.insideError > 0 ? CIRCULAR : node;
+        }
+        if (depth > this.maxDepth || this.nodes >= this.maxNodes) {
+            // Not inspected. Inside an error it must not be returned (it may hold the config). Outside
+            // one it is left as it is: withholding the whole body would break the large responses.
+            this.truncated = true;
+            return this.insideError > 0 ? TRUNCATED : node;
+        }
+        this.nodes++;
+        // Arrays and plain objects are by far the most common, and cannot be errors, binary data or
+        // streams: they are checked first.
+        if (Array.isArray(node)) {
+            return this.walkArray(node, depth);
+        }
+        if (isPlainObject(node)) {
+            return this.walkObject(node, depth);
+        }
+        return this.walkOther(node, depth);
+    }
+    // Charged per container, when it is entered, so the loops that visit the values have no counter.
+    spend(values) {
+        this.values += values;
+        if (this.values > this.maxValues) {
+            this.truncated = true;
+            return false;
+        }
+        return true;
+    }
+    walkArray(node, depth) {
+        if (!this.spend(node.length)) {
+            return this.insideError > 0 ? TRUNCATED : node;
+        }
+        this.ancestors.push(node);
+        let result = node;
+        for (let i = 0; i < node.length; i++) {
+            const value = node[i];
+            const safe = this.walkValue(value, depth);
+            if (safe !== value) {
+                result = result === node ? node.slice() : result;
+                result[i] = safe;
+            }
+        }
+        this.ancestors.pop();
+        return result;
+    }
+    walkObject(node, depth) {
+        const keys = Object.keys(node);
+        if (!this.spend(keys.length)) {
+            return this.insideError > 0 ? TRUNCATED : node;
+        }
+        this.ancestors.push(node);
+        let result = node;
+        for (const key of keys) {
+            const value = node[key];
+            const safe = this.walkValue(value, depth);
+            if (safe !== value) {
+                result = result === node ? { ...node } : result;
+                result[key] = safe;
+            }
+        }
+        this.ancestors.pop();
+        return result;
+    }
+    // Most values are primitives: skipping them here avoids a call per value.
+    walkValue(value, depth) {
+        return value === null || typeof value !== 'object' ? value : this.walk(value, depth + 1);
+    }
+    // Errors, and what is neither a plain object nor an array: buffers, streams, class instances.
+    walkOther(node, depth) {
+        if (isError(node)) {
+            this.replaced++;
+            return this.toSafeError(node, depth);
+        }
+        return this.insideError > 0 ? describeOpaque(node) : node;
+    }
+    /**
+     * Builds the object that is exposed instead of the error. It is made from a shallow copy that
+     * leaves out the HTTP-client internals, so those are never traversed nor serialized, and goes
+     * through `cleanError` to keep the output consistent with the one of the global error handler
+     * (circular references, private and function properties, long strings).
+     *
+     * What reaches `cleanError` is bounded: values beyond the limits, binary data and class
+     * instances were replaced by markers while walking, because `cleanError` has no limits of its own.
+     */
+    toSafeError(error, depth) {
+        this.ancestors.push(error);
+        this.insideError++;
+        const source = error;
+        const copy = this.copyErrorProperties(source, depth);
+        const { response } = source;
+        if (response !== null && typeof response === 'object') {
+            copy.response = this.copyResponse(response, depth);
+        }
+        const safe = (0, error_1.cleanError)(copy);
+        // `cleanError` picks a fixed set of response properties, which leaves `statusText` out.
+        if (safe.response && typeof (response === null || response === void 0 ? void 0 : response.statusText) === 'string') {
+            safe.response.statusText = response.statusText;
+        }
+        this.insideError--;
+        this.ancestors.pop();
+        return safe;
+    }
+    copyErrorProperties(source, depth) {
+        const copy = {};
+        for (const key of Object.keys(source)) {
+            if (!INTERNAL_ERROR_KEYS.has(key)) {
+                copy[key] = this.walk(source[key], depth + 1);
+            }
+        }
+        for (const property of ['name', 'message', 'code']) {
+            if (typeof source[property] === 'string') {
+                copy[property] = source[property];
+            }
+        }
+        if (this.linked && typeof source.stack === 'string') {
+            copy.stack = source.stack;
+        }
+        return copy;
+    }
+    // Only what the upstream answered. Its headers (cookies, tokens) and the request that originated
+    // it are not exposed.
+    copyResponse(response, depth) {
+        return {
+            data: this.walk(response.data, depth + 1),
+            status: response.status,
+        };
+    }
+}
+/**
+ * Finds `Error` instances (including `AxiosError`) in a response body, at any depth of plain
+ * objects and arrays, and replaces each one by a safe representation: the message, name, code and
+ * status are kept, while the request config, the Node request, the agents, the upstream headers
+ * and, unless linked, the stack are removed.
+ *
+ * Strings, buffers, streams and class instances other than errors are returned untouched.
+ */
+const sanitizeErrors = (value, options) => {
+    const sanitizer = new ErrorSanitizer(options);
+    const sanitized = sanitizer.walk(value, 0);
+    return {
+        replaced: sanitizer.replaced,
+        truncated: sanitizer.truncated,
+        value: sanitized,
+    };
+};
+exports.sanitizeErrors = sanitizeErrors;
+const isPrimitiveValue = (value) => value === null || typeof value !== 'object';
+const enter = (budget, values) => {
+    if (budget.nodes >= budget.maxNodes) {
+        return false;
+    }
+    budget.nodes++;
+    budget.values += values;
+    return budget.values <= budget.maxValues;
+};
+// How far the linear pass may nest, in arrays and in objects alike. Deeper bodies fall through to
+// the scan below, which also enforces the depth limit.
+const SHALLOW_DEPTH = 4;
+// Lists of plain records, and an object wrapping them, are the common large payload. One pass
+// proves they hold no Error, which is cheaper than the copying walk and stops at the same budget.
+const shallowValue = (value, budget, depth) => {
+    // Arrays and plain objects first: they are the common case and cannot be errors.
+    if (Array.isArray(value)) {
+        return shallowArray(value, budget, depth);
+    }
+    if (isPlainObject(value)) {
+        return shallowRecord(value, budget, depth);
+    }
+    if (isError(value)) {
+        return 'has-error';
+    }
+    return enter(budget, 0) ? 'clean' : 'truncated';
+};
+// What is below a container that is not a primitive. Recursion stops at the cutoff, whatever the
+// container is, so its depth is bounded.
+const shallowChild = (child, budget, depth) => depth >= SHALLOW_DEPTH ? undefined : shallowValue(child, budget, depth + 1);
+const shallowArray = (items, budget, depth) => {
+    if (!enter(budget, items.length)) {
+        return 'truncated';
+    }
+    for (const item of items) {
+        if (isPrimitiveValue(item)) {
+            continue;
+        }
+        const found = shallowChild(item, budget, depth);
+        if (found !== 'clean') {
+            return found;
+        }
+    }
+    return 'clean';
+};
+const shallowRecord = (record, budget, depth) => {
+    const keys = Object.keys(record);
+    if (!enter(budget, keys.length)) {
+        return 'truncated';
+    }
+    for (const key of keys) {
+        const value = record[key];
+        if (isPrimitiveValue(value)) {
+            continue;
+        }
+        const found = shallowChild(value, budget, depth);
+        if (found !== 'clean') {
+            return found;
+        }
+    }
+    return 'clean';
+};
+const scanChildren = (node, depth, state) => {
+    const isArray = Array.isArray(node);
+    const record = node;
+    const keys = isArray ? undefined : Object.keys(record);
+    const length = keys ? keys.length : node.length;
+    state.values += length;
+    if (state.values > state.maxValues) {
+        state.truncated = true;
+        return;
+    }
+    state.ancestors.push(node);
+    for (let i = 0; i < length && !state.found && !state.truncated; i++) {
+        const child = keys ? record[keys[i]] : node[i];
+        if (child !== null && typeof child === 'object') {
+            scanNode(child, depth + 1, state);
+        }
+    }
+    state.ancestors.pop();
+};
+const scanNode = (node, depth, state) => {
+    if (state.found || state.truncated || state.ancestors.includes(node)) {
+        return;
+    }
+    if (depth > state.maxDepth || state.nodes >= state.maxNodes) {
+        state.truncated = true;
+        return;
+    }
+    state.nodes++;
+    if (Array.isArray(node) || isPlainObject(node)) {
+        scanChildren(node, depth, state);
+    }
+    else if (isError(node)) {
+        state.found = true;
+    }
+};
+const deepScan = (value, maxDepth, maxNodes, maxValues) => {
+    const state = { ancestors: [], found: false, maxDepth, maxNodes, maxValues, nodes: 0, truncated: false, values: 0 };
+    scanNode(value, 0, state);
+    if (state.truncated) {
+        return 'truncated';
+    }
+    return state.found ? 'has-error' : 'clean';
+};
+/**
+ * Says whether `value` contains an `Error`, without copying it. The copying walk is only needed
+ * when this returns `has-error`. `truncated` means a budget (depth, containers, or the values they
+ * hold) was spent before the value was fully inspected, so whatever was not visited must not be sent.
+ */
+const scanForErrors = (value, options = {}) => {
+    var _a, _b, _c;
+    const maxNodes = (_a = options.maxNodes) !== null && _a !== void 0 ? _a : DEFAULT_MAX_NODES;
+    const maxValues = (_b = options.maxValues) !== null && _b !== void 0 ? _b : DEFAULT_MAX_VALUES;
+    const shallow = shallowValue(value, { maxNodes, maxValues, nodes: 0, values: 0 }, 0);
+    if (shallow !== undefined) {
+        return shallow;
+    }
+    return deepScan(value, (_c = options.maxDepth) !== null && _c !== void 0 ? _c : DEFAULT_MAX_DEPTH, maxNodes, maxValues);
+};
+exports.scanForErrors = scanForErrors;
+/**
+ * The same as `sanitizeErrors` for what is written to the process output, where the stack is
+ * useful and kept. A thrown `Error` stays an error, so it is printed as one (stack, then its
+ * properties), without the request config, the request and the agents.
+ *
+ * It never throws.
+ */
+const toLoggableError = (value) => {
+    try {
+        const { value: safe } = (0, exports.sanitizeErrors)(value, { linked: true });
+        if (safe !== value && value !== null && typeof value === 'object' && isError(value)) {
+            return Object.assign(Object.create(Object.getPrototypeOf(value)), safe);
+        }
+        return safe;
+    }
+    catch (err) {
+        return `[error omitted: it could not be sanitized (${err === null || err === void 0 ? void 0 : err.name})]`;
+    }
+};
+exports.toLoggableError = toLoggableError;

package/lib/utils/stringRedactor.d.ts

@@ -0,0 +1,19 @@
+export declare const REDACTED = "[Redacted]";
+export interface RedactResult {
+    value: string;
+    /**
+     * How many occurrences were replaced. Zero means `value` is the received string.
+     */
+    redacted: number;
+}
+/**
+ * Replaces credentials in a text: the given secrets wherever they appear, the value of the
+ * credential headers in JSON text and in header lines, `Cookie` and `Set-Cookie` lines, the VTEX
+ * ID cookie, and `Bearer` tokens.
+ * The rest of the text is kept.
+ *
+ * It is for text that was built from an error, where the error object is no longer there to
+ * detect. It does not inspect anything else: a credential that is neither one of the secrets nor
+ * under one of those names is not found.
+ */
+export declare const redactSecrets: (text: string, secrets?: Array<string | undefined>) => RedactResult;

package/lib/utils/stringRedactor.js

@@ -0,0 +1,94 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.redactSecrets = exports.REDACTED = void 0;
+exports.REDACTED = '[Redacted]';
+// Shorter values are not credentials, and replacing them everywhere would damage ordinary text.
+const MIN_SECRET_LENGTH = 16;
+/**
+ * Names under which credentials travel in HTTP headers. When an error is turned into text with
+ * `JSON.stringify`, its request config, and the headers in it, end up in the text under these keys.
+ */
+const SENSITIVE_KEYS = [
+    'authorization',
+    'cookie',
+    'proxy-authorization',
+    'vtexidclientautcookie',
+    'x-vtex-api-appkey',
+    'x-vtex-api-apptoken',
+    'x-vtex-credential',
+    'x-vtex-session',
+];
+// `"key":"value"`, also when the text was serialized twice (`\"key\":\"value\"`). Captures
+// everything up to the value, which is what is replaced. The value is a run of characters that are
+// not a quote, where a backslash only escapes the character after it. The two alternatives of the
+// run exclude each other, so the match is linear.
+const KEYED_VALUE = new RegExp(String.raw `(\\{0,2}"(?:${SENSITIVE_KEYS.join('|')})\\{0,2}"\s*:\s*\\{0,2}")(?:[^"\\]|\\[^"])+`, 'gi');
+// A header written as a line of the request (`Proxy-Authorization: value`), which is how a
+// serialized request object (`_header`) holds it. Short values are not credentials. `Cookie` is
+// not in this list: the word opens ordinary sentences, so its lines are matched separately.
+const HEADER_LINE_NAMES = [
+    'authorization',
+    'proxy-authorization',
+    'vtexidclientautcookie',
+    'x-vtex-api-appkey',
+    'x-vtex-api-apptoken',
+    'x-vtex-credential',
+    'x-vtex-session',
+];
+// The name starts a line. In a serialized request the line break is the two characters `\n`, so a
+// word boundary never fires there: the `n` and the name are both word characters.
+const AT_LINE_START = String.raw `(?<=^|\\n|\\r|\n|\r)`;
+const HEADER_LINE = new RegExp(String.raw `${AT_LINE_START}((?:${HEADER_LINE_NAMES.join('|')})[ \t]*:[ \t]*)[^\s"\\][^\r\n"\\]{7,}`, 'gi');
+// A `Cookie` or `Set-Cookie` line. The value has to be cookie pairs (`name=value`), so a sentence
+// that happens to start with "Cookie:" is left as it is.
+const COOKIE_LINE = new RegExp(String.raw `${AT_LINE_START}((?:set-)?cookie[ \t]*:[ \t]*)[^\s=;"\\]+=[^\r\n"\\]{6,}`, 'gi');
+// The VTEX ID cookie, in a `Cookie` header or a `Set-Cookie` line.
+const VTEX_ID_COOKIE = /\b(VtexIdclientAutCookie(?:_[a-z0-9-]+)?=)[^;\s"\\]+/gi;
+// An `Authorization` value that is not under a key, as in a message or a copied header line.
+const BEARER_TOKEN = /\b(Bearer\s+)[a-z0-9._~+/=-]{16,}/gi;
+const redactKnown = (text, secrets) => {
+    let value = text;
+    let redacted = 0;
+    for (const secret of secrets) {
+        if (!secret || secret.length < MIN_SECRET_LENGTH || !value.includes(secret)) {
+            continue;
+        }
+        const parts = value.split(secret);
+        redacted += parts.length - 1;
+        value = parts.join(exports.REDACTED);
+    }
+    return { redacted, value };
+};
+const redactPattern = (text, pattern) => {
+    let redacted = 0;
+    const value = text.replace(pattern, (match, prefix) => {
+        if (match === `${prefix}${exports.REDACTED}`) {
+            return match;
+        }
+        redacted++;
+        return `${prefix}${exports.REDACTED}`;
+    });
+    return { redacted, value: redacted > 0 ? value : text };
+};
+/**
+ * Replaces credentials in a text: the given secrets wherever they appear, the value of the
+ * credential headers in JSON text and in header lines, `Cookie` and `Set-Cookie` lines, the VTEX
+ * ID cookie, and `Bearer` tokens.
+ * The rest of the text is kept.
+ *
+ * It is for text that was built from an error, where the error object is no longer there to
+ * detect. It does not inspect anything else: a credential that is neither one of the secrets nor
+ * under one of those names is not found.
+ */
+const redactSecrets = (text, secrets = []) => {
+    const known = redactKnown(text, secrets);
+    let value = known.value;
+    let redacted = known.redacted;
+    for (const pattern of [KEYED_VALUE, HEADER_LINE, COOKIE_LINE, VTEX_ID_COOKIE, BEARER_TOKEN]) {
+        const result = redactPattern(value, pattern);
+        value = result.value;
+        redacted += result.redacted;
+    }
+    return { redacted, value: redacted > 0 ? value : text };
+};
+exports.redactSecrets = redactSecrets;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@vtex/api",
-  "version": "7.6.0",
+  "version": "7.6.1",
   "description": "VTEX I/O API client",
   "main": "lib/index.js",
   "typings": "lib/index.d.ts",