@yuneta/gobj-js 7.26.19 → 7.26.20

package/README.md

@@ -669,13 +669,21 @@ container at once) instead of guessing.
 
 ```javascript
 is_secret_name("password")                // → true ("token", "jwt", "apikey"...)
+is_secret_name("sim_pin")                 // → true (pass, pin, otp: whole segments)
+is_secret_name("mapping")                 // → false (pin inside a word)
 is_secret_name("token_endpoint")          // → false (names something ABOUT one)
 mask_secrets_inline("login user=a passw=x")  // → "login user=a passw=********"
+mask_secrets_inline("curl -H 'Authorization: Bearer abc' u")
+                                          // → "curl -H 'Authorization: Bearer ********' u"
 json_mask_secrets({user: "a", password: "x"})  // → {user: "a", password: "********"}
+json_mask_secrets({note: "eyJhbGciOiJIUzI1NiJ9.eyJzdWIiOiJ4In0.c2ln"})
+                                          // → {note: "********"}: a JWT under any key
 trace_json_masked(kw, "sent")            // trace_json() of the masked copy
 ```
 
-As the C kernel's: linear and bounded (a text over 4 MB is not shown at all).
+As the C kernel's: the same names, the same shapes by value (a JWT, the token
+after `Bearer `), a NUL in a string read as a blank; linear and bounded (a text
+over 4 MB is not shown at all). `key` and `cert` are not secrets' names.
 
 ### Logging
 
@@ -795,6 +803,11 @@ gobj_command(yuno, "set-global-no-trace", {level: "timer_periodic", set: 0}, yun
 // no_trace_levels.__global_no_trace__ = [] -- stays off after a reload
 ```
 
+`set` is read as the C kernel reads it: a boolean, an integer, or text --
+`set`/`reset`, a JSON integer (`"1"`, `"-1"`, `"0"`), `true`/`false`,
+`yes`/`no`, `on`/`off` in any case. Anything else answers `-1` *"bitmask set
+or re-set?"*: a real (`2.5`), `" 1"`, `"0x1"`, `"1e3"`, `"+5"`, `"007"`.
+
 The traffic of the websocket is `C_IEVENT_CLI`'s own level `ievents`; its lines
 go to the yuno attr `trace_ievent_callback`, or to the console.
 

package/dist/gobj-js.cjs.js

@@ -3436,6 +3436,11 @@ var SECRET_NAME_JOINED = [
 	"sessionkey",
 	"authdata"
 ];
+var SECRET_NAME_SEGMENTS = /* @__PURE__ */ new Set([
+	"pass",
+	"pin",
+	"otp"
+]);
 var NOT_SECRET_SEGMENTS = /* @__PURE__ */ new Set([
 	"endpoint",
 	"url",
@@ -3468,10 +3473,16 @@ function is_secret_name(name) {
 	if (typeof name !== "string" || name.length < 3) return false;
 	let lower = name.toLowerCase();
 	let hit = false;
-	for (const part of SECRET_NAME_PARTS) if (lower.indexOf(part) >= 0) {
+	for (const segment of lower.split(/[^a-z0-9]+/)) if (SECRET_NAME_SEGMENTS.has(segment)) {
 		hit = true;
 		break;
 	}
+	if (!hit) {
+		for (const part of SECRET_NAME_PARTS) if (lower.indexOf(part) >= 0) {
+			hit = true;
+			break;
+		}
+	}
 	if (!hit) {
 		let joined = lower.replace(/[_\-. \t]/g, "");
 		for (const part of SECRET_NAME_JOINED) if (joined.indexOf(part) >= 0) {
@@ -3509,17 +3520,63 @@ function inline_secret_value_end(str, p, outer) {
 	}
 }
 /************************************************************
+*  A credential by its SHAPE, whatever names it -- the C kernel's
+*  jwt_len() / bearer_token_len(), the shapes the agent's audit
+*  record redacts:
+*    - a JWT: "eyJ" (the base64url of '{"') at the start of a
+*      word, and three parts of base64url joined by '.'; the dots
+*      at the end of the run are not its own (a JWT ends a
+*      sentence: "... eyJ.eyJ.sig.");
+*    - the token after "Bearer " (any case, a word of its own).
+************************************************************/
+function is_ascii_alnum_code(code) {
+	return code >= 48 && code <= 57 || code >= 65 && code <= 90 || code >= 97 && code <= 122;
+}
+function is_base64url_code(code) {
+	return is_ascii_alnum_code(code) || code === 45 || code === 95;
+}
+function jwt_len(str, p) {
+	if (str.length - p < 3 || str[p] !== "e" || str[p + 1] !== "y" || str[p + 2] !== "J") return 0;
+	if (p > 0 && (is_base64url_code(str.charCodeAt(p - 1)) || str[p - 1] === ".")) return 0;
+	let e = p;
+	let dots = 0;
+	while (e < str.length && (is_base64url_code(str.charCodeAt(e)) || str[e] === ".")) {
+		if (str[e] === ".") dots++;
+		e++;
+	}
+	while (str[e - 1] === ".") {
+		e--;
+		dots--;
+	}
+	return dots === 2 ? e - p : 0;
+}
+var BEARER_STOPS = " 	\r\n'\",;}]\0";
+function bearer_token(str, p) {
+	const word_len = 6;
+	if (str.length - p <= word_len || str.slice(p, p + word_len).toLowerCase() !== "bearer") return [0, 0];
+	if (p > 0 && is_ascii_alnum_code(str.charCodeAt(p - 1))) return [0, 0];
+	let t = p + word_len;
+	if (str[t] !== " " && str[t] !== "	") return [0, 0];
+	while (t < str.length && (str[t] === " " || str[t] === "	")) t++;
+	let e = t;
+	while (e < str.length && BEARER_STOPS.indexOf(str[e]) < 0) e++;
+	return [t - p, e - t];
+}
+/************************************************************
 *  A text (a command line) with the value of every "name=value"
 *  whose name is a secret's written as "********", quoted or not
 *  (and the "value" of a write-attr whose attribute names a
-*  secret). The rest as it is. Return null when there was nothing
-*  to mask. As the C kernel's mask_secrets_inline().
+*  secret); and a JWT or the token after "Bearer ", wherever they
+*  are, whatever names them. The rest as it is. Return null when
+*  there was nothing to mask. As the C kernel's
+*  mask_secrets_inline().
 ************************************************************/
 var MASK_MAX_NAME = 128;
 var MASK_MAX_BYTES = 4194304;
 var MASK_TOO_LARGE = "<not shown: too large to mask>";
 function mask_secrets_inline(str) {
-	if (typeof str !== "string" || str.indexOf("=") < 0) return null;
+	if (typeof str !== "string") return null;
+	if (str.indexOf("=") < 0 && str.indexOf("eyJ") < 0 && !/bearer/i.test(str)) return null;
 	if (str.length > MASK_MAX_BYTES) return MASK_TOO_LARGE;
 	let value_is_secret = false;
 	let re_attr = /(^|[ \t])attribute=["']?([^ \t"']*)/g;
@@ -3543,6 +3600,18 @@ function mask_secrets_inline(str) {
 			if (!outer && (p === 0 || str[p - 1] === " " || str[p - 1] === "	" || str[p - 1] === "=")) outer = c;
 			else if (c === outer && is_blank_or_end(p + 1)) outer = "";
 		}
+		let shape = c === "e" ? jwt_len(str, p) : 0;
+		let token_offset = 0;
+		if (c === "b" || c === "B") [token_offset, shape] = bearer_token(str, p);
+		if (shape) {
+			parts.push(str.substring(copied, p + token_offset));
+			parts.push("********");
+			p += token_offset + shape;
+			copied = p;
+			changed = true;
+			word = p;
+			continue;
+		}
 		if (c !== "=") {
 			p++;
 			continue;
@@ -3579,7 +3648,8 @@ function mask_secrets_inline(str) {
 *  value of a key with a secret's name is "********", whatever
 *  its type (not an absent one, a null or an empty string); so is
 *  the "value" of a dict whose "attribute" names a secret; and a
-*  string is masked as mask_secrets_inline(). Return a masked
+*  string, under any key, is masked as mask_secrets_inline() (a
+*  JWT, a "Bearer" token, a secret name=value). Return a masked
 *  copy, or `jn` itself when there was nothing to mask. As the C
 *  kernel's json_mask_secrets().
 *
@@ -3608,7 +3678,7 @@ function _json_mask_secrets(jn, memo, depth, budget) {
 			return MASK_TOO_LARGE;
 		}
 		budget.left -= jn.length;
-		let masked = mask_secrets_inline(jn);
+		let masked = mask_secrets_inline(jn.indexOf("\0") >= 0 ? jn.replace(/\u0000/g, " ") : jn);
 		return masked !== null ? masked : jn;
 	}
 	let is_array = Array.isArray(jn);
@@ -7110,15 +7180,34 @@ function save_trace_scope(gobj, attr, scope, levels) {
 	return gobj_save_persistent_attrs(gobj, attr);
 }
 /***************************************************************
-*  "set" as the C command reads it: TRUE / set / 1, FALSE / reset / 0
+*  "set" as the C command reads it (trace_set_value() of c_yuno.c):
+*  a boolean; an integer in the range of an int (true unless 0); or
+*  text -- set / reset, a JSON integer -?(0|[1-9][0-9]*), or true /
+*  false, yes / no, on / off, any case. null for anything else: a
+*  real (2.5), " 1", "0x1", "1e3", "+5", "007" and "2.5" are refused,
+*  as in C. Up to gobj-js 7.26.19 the text went through Number(),
+*  which took all of them, and "yes" / "on" were refused.
 ***************************************************************/
+var INT_MIN = -2147483648;
+var INT_MAX = 2147483647;
 function parse_set(value) {
 	if (value === true || value === false) return value;
-	let v = String(value === void 0 || value === null ? "" : value).toLowerCase();
-	if (v === "true" || v === "set") return true;
-	if (v === "false" || v === "reset") return false;
-	if (v === "" || isNaN(Number(v))) return null;
-	return Number(v) ? true : false;
+	if (typeof value === "number") {
+		if (!Number.isInteger(value) || value < INT_MIN || value > INT_MAX) return null;
+		return value !== 0;
+	}
+	if (typeof value !== "string" || value === "") return null;
+	let v = value.toLowerCase();
+	if (v === "set") return true;
+	if (v === "reset") return false;
+	if (/^-?(0|[1-9][0-9]*)$/.test(value)) {
+		let n = Number(value);
+		if (n < INT_MIN || n > INT_MAX) return null;
+		return n !== 0;
+	}
+	if (v === "true" || v === "yes" || v === "on") return true;
+	if (v === "false" || v === "no" || v === "off") return false;
+	return null;
 }
 function yuno_prefix() {
 	return `${gobj_yuno_role()}^${gobj_yuno_name()}`;