@zapier/secret-scrubber 1.0.3 → 1.0.6

package/CHANGELOG.md

@@ -1,3 +1,29 @@
+## 1.0.6
+
+_released `2022-04-06`_
+
+- tweak `findSensitiveValues` to no longer return _any_ url with a querystring. It's always tried to extract secrets from a url, but now doesn't fall back to censoring the whole url.
+
+Calling `findSensitiveValues` with a structure containing urls:
+
+| input                        | before                           | after      |
+| ---------------------------- | -------------------------------- | ---------- |
+| `zapier.com`                 | `[]`                             | `[]`       |
+| `zapier.com?api_key=123456`  | `[123456]`                       | `[123456]` |
+| `zapier.com?safe_key=123456` | `["zapier.com?safe_key=123456"]` | `[]`       |
+
+## 1.0.5
+
+_released `2021-10-25`_
+
+- Reduce `scrub` memory usage
+
+## 1.0.4
+
+_released `2021-10-04`_
+
+- add `api-key` to sensitive substrings [!4](https://gitlab.com/zapier/team-developer-platform/secret-scrubber-js/-/merge_requests/4)
+
 ## 1.0.3
 
 _released `2021-09-20`_

package/lib/convenience.d.ts

@@ -1,3 +1,4 @@
+export declare const SENSITIVE_SUBSTRINGS: string[];
 /**
  * Determine if a string:
  * * is a url
@@ -5,4 +6,9 @@
  */
 export declare const isUrlWithSecrets: (val: any) => boolean;
 export declare const isSensitiveKey: (key: string) => boolean;
-export declare const extractSecretsFromUrl: (maybeUrlStr: string) => string[];
+/**
+ * Given a string:
+ * * if it's a valid url, return a `string[]` of any extracted secrets. Only secret keys will be pulled from the querystring
+ * * if it's not a valid url, return `null`
+ */
+export declare const extractSecretsFromUrl: (maybeUrlStr: string) => string[] | null;

package/lib/convenience.js

@@ -1,11 +1,13 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.extractSecretsFromUrl = exports.isSensitiveKey = exports.isUrlWithSecrets = void 0;
+exports.extractSecretsFromUrl = exports.isSensitiveKey = exports.isUrlWithSecrets = exports.SENSITIVE_SUBSTRINGS = void 0;
 const url_1 = require("url");
 // a couple of functions that power the public conveience functions, namely findSensitiveValues
-const SENSITIVE_SUBSTRINGS = [
+// only exported for testing
+exports.SENSITIVE_SUBSTRINGS = [
     'api_key',
     'apikey',
+    'api-key',
     'auth',
     'jwt',
     'passwd',
@@ -31,8 +33,13 @@ const isUrlWithSecrets = (val) => {
     return (url.username.length > 0 || url.password.length > 0 || url.search.length > 0);
 };
 exports.isUrlWithSecrets = isUrlWithSecrets;
-const isSensitiveKey = (key) => SENSITIVE_SUBSTRINGS.some((substr) => key.toLowerCase().includes(substr));
+const isSensitiveKey = (key) => exports.SENSITIVE_SUBSTRINGS.some((substr) => key.toLowerCase().includes(substr));
 exports.isSensitiveKey = isSensitiveKey;
+/**
+ * Given a string:
+ * * if it's a valid url, return a `string[]` of any extracted secrets. Only secret keys will be pulled from the querystring
+ * * if it's not a valid url, return `null`
+ */
 const extractSecretsFromUrl = (maybeUrlStr) => {
     try {
         const subValues = [];
@@ -54,7 +61,7 @@ const extractSecretsFromUrl = (maybeUrlStr) => {
         const err = e;
         if (err.code === 'ERR_INVALID_URL') {
             // not a url, ignore
-            return [];
+            return null;
         }
         // otherwise, actual error - throw!
         throw e;

package/lib/index.js

@@ -15,12 +15,7 @@ const scrub = (input, secretValues) => {
             let copiedVal = val;
             // have to look for substrings in the value instead of looking for the value in the map
             Object.entries(sensitiveBank).forEach(([transformed, censored]) => {
-                // doing this in a loop because there's not (yet) a replaceAll
-                // .replace takes a regex, but I'm worried about being able to properly excape incoming secrets
-                // so until 2023-04-30, we'll loop. Once we can use node 16 everywhere, this loop can be a single .replaceAll
-                while (copiedVal.includes(transformed)) {
-                    copiedVal = copiedVal.replace(transformed, censored);
-                }
+                copiedVal = (0, utils_1.replaceAll)(copiedVal, transformed, censored);
             });
             return copiedVal;
         }
@@ -51,15 +46,13 @@ const findSensitiveValues = (obj) => {
         .reduce((result, value) => {
         // iterate the first pass and try to pull more specific info about of urls
         const urlSecrets = (0, convenience_1.extractSecretsFromUrl)(value);
-        // was a url with secrets, save those but not the url itself
-        if (urlSecrets.length > 0) {
-            return [...result, ...urlSecrets];
+        if (urlSecrets == null) {
+            // value wasn't a url, pass it through
+            return [...result, value];
         }
-        // otherwise, return the value
-        return [...result, value];
+        // return any secrets found (could be 0), but not the full url
+        return [...result, ...urlSecrets];
     }, []);
-    // iterate the first pass and try to pull out
-    // return values.re
 };
 exports.findSensitiveValues = findSensitiveValues;
 var utils_2 = require("./utils");

package/lib/utils.d.ts

@@ -28,3 +28,14 @@ export declare const recurseReplace: (obj: any, replacer: (val: any) => any) =>
  * * otherwise, we pass the key and value to the matcher. If it returns `true`, we collect the value
  */
 export declare const recurseExtract: (obj: object | any[], matcher: (key: string, value: any) => boolean) => string[];
+/**
+ * Custom implementation of String.prototype.replaceAll (not tied to the String namespace though).
+ *
+ * Key differences between String.prototype.replaceAll and this implementation:
+ *   - searchString only supports Strings (not regex)
+ *   - replaceValue only supports Strings (not functions)
+ *   - replaceValue must not be the empty string
+ *
+ * Source for inspiration: https://github.com/zloirock/core-js/blob/master/packages/core-js/modules/es.string.replace-all.js
+ */
+export declare const replaceAll: (baseString: string, searchString: string, replaceValue: string) => string;

package/lib/utils.js

@@ -1,6 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.recurseExtract = exports.recurseReplace = exports.makeSensitiveBank = exports.censor = exports.base64 = exports.hash = exports.isLongEnoughToBeSecret = void 0;
+exports.replaceAll = exports.recurseExtract = exports.recurseReplace = exports.makeSensitiveBank = exports.censor = exports.base64 = exports.hash = exports.isLongEnoughToBeSecret = void 0;
 const crypto_1 = require("crypto");
 const isPlainObject = require("lodash.isplainobject");
 const MIN_SECRET_SIZE = 6;
@@ -25,7 +25,7 @@ const censor = (val) => {
     // }
     const salted = val + ((_a = process.env.ZAPIER_SCRUBBER_SALT) !== null && _a !== void 0 ? _a : 'averysecretsalt');
     const hashed = (0, exports.hash)(salted);
-    return `:censored:${val.length}:${hashed.substr(0, 10)}:`;
+    return `:censored:${val.length}:${hashed.substring(0, 10)}:`;
 };
 exports.censor = censor;
 /**
@@ -120,9 +120,6 @@ const recurseExtract = (obj, matcher) => {
         }
         // value is simple-ish
         if (matcher(key, value)) {
-            if (value == null) {
-                return value; // gets filtered below
-            }
             return value === null || value === void 0 ? void 0 : value.toString();
         }
     })
@@ -131,3 +128,31 @@ const recurseExtract = (obj, matcher) => {
     return result;
 };
 exports.recurseExtract = recurseExtract;
+/**
+ * Custom implementation of String.prototype.replaceAll (not tied to the String namespace though).
+ *
+ * Key differences between String.prototype.replaceAll and this implementation:
+ *   - searchString only supports Strings (not regex)
+ *   - replaceValue only supports Strings (not functions)
+ *   - replaceValue must not be the empty string
+ *
+ * Source for inspiration: https://github.com/zloirock/core-js/blob/master/packages/core-js/modules/es.string.replace-all.js
+ */
+const replaceAll = (baseString, searchString, replaceValue) => {
+    if (searchString === '') {
+        return baseString;
+    }
+    let result = '';
+    let endOfLastMatch = 0;
+    let position = baseString.indexOf(searchString);
+    while (position !== -1) {
+        result += baseString.slice(endOfLastMatch, position) + replaceValue;
+        endOfLastMatch = position + searchString.length;
+        position = baseString.indexOf(searchString, endOfLastMatch);
+    }
+    if (endOfLastMatch < baseString.length) {
+        result += baseString.slice(endOfLastMatch);
+    }
+    return result;
+};
+exports.replaceAll = replaceAll;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@zapier/secret-scrubber",
-  "version": "1.0.3",
+  "version": "1.0.6",
   "description": "Confidently remove secrets and sensitive values from unstructured objects.",
   "main": "lib/index.js",
   "typings": "lib/index.d.ts",