@zapier/secret-scrubber 1.0.5 → 1.0.6

package/CHANGELOG.md

@@ -1,6 +1,20 @@
+## 1.0.6
+
+_released `2022-04-06`_
+
+- tweak `findSensitiveValues` to no longer return _any_ url with a querystring. It's always tried to extract secrets from a url, but now doesn't fall back to censoring the whole url.
+
+Calling `findSensitiveValues` with a structure containing urls:
+
+| input                        | before                           | after      |
+| ---------------------------- | -------------------------------- | ---------- |
+| `zapier.com`                 | `[]`                             | `[]`       |
+| `zapier.com?api_key=123456`  | `[123456]`                       | `[123456]` |
+| `zapier.com?safe_key=123456` | `["zapier.com?safe_key=123456"]` | `[]`       |
+
 ## 1.0.5
 
-_release `2021-10-25`_
+_released `2021-10-25`_
 
 - Reduce `scrub` memory usage
 

package/lib/convenience.d.ts

@@ -6,4 +6,9 @@ export declare const SENSITIVE_SUBSTRINGS: string[];
  */
 export declare const isUrlWithSecrets: (val: any) => boolean;
 export declare const isSensitiveKey: (key: string) => boolean;
-export declare const extractSecretsFromUrl: (maybeUrlStr: string) => string[];
+/**
+ * Given a string:
+ * * if it's a valid url, return a `string[]` of any extracted secrets. Only secret keys will be pulled from the querystring
+ * * if it's not a valid url, return `null`
+ */
+export declare const extractSecretsFromUrl: (maybeUrlStr: string) => string[] | null;

package/lib/convenience.js

@@ -35,6 +35,11 @@ const isUrlWithSecrets = (val) => {
 exports.isUrlWithSecrets = isUrlWithSecrets;
 const isSensitiveKey = (key) => exports.SENSITIVE_SUBSTRINGS.some((substr) => key.toLowerCase().includes(substr));
 exports.isSensitiveKey = isSensitiveKey;
+/**
+ * Given a string:
+ * * if it's a valid url, return a `string[]` of any extracted secrets. Only secret keys will be pulled from the querystring
+ * * if it's not a valid url, return `null`
+ */
 const extractSecretsFromUrl = (maybeUrlStr) => {
     try {
         const subValues = [];
@@ -56,7 +61,7 @@ const extractSecretsFromUrl = (maybeUrlStr) => {
         const err = e;
         if (err.code === 'ERR_INVALID_URL') {
             // not a url, ignore
-            return [];
+            return null;
         }
         // otherwise, actual error - throw!
         throw e;

package/lib/index.js

@@ -46,15 +46,13 @@ const findSensitiveValues = (obj) => {
         .reduce((result, value) => {
         // iterate the first pass and try to pull more specific info about of urls
         const urlSecrets = (0, convenience_1.extractSecretsFromUrl)(value);
-        // was a url with secrets, save those but not the url itself
-        if (urlSecrets.length > 0) {
-            return [...result, ...urlSecrets];
+        if (urlSecrets == null) {
+            // value wasn't a url, pass it through
+            return [...result, value];
         }
-        // otherwise, return the value
-        return [...result, value];
+        // return any secrets found (could be 0), but not the full url
+        return [...result, ...urlSecrets];
     }, []);
-    // iterate the first pass and try to pull out
-    // return values.re
 };
 exports.findSensitiveValues = findSensitiveValues;
 var utils_2 = require("./utils");

package/lib/utils.js

@@ -25,7 +25,7 @@ const censor = (val) => {
     // }
     const salted = val + ((_a = process.env.ZAPIER_SCRUBBER_SALT) !== null && _a !== void 0 ? _a : 'averysecretsalt');
     const hashed = (0, exports.hash)(salted);
-    return `:censored:${val.length}:${hashed.substr(0, 10)}:`;
+    return `:censored:${val.length}:${hashed.substring(0, 10)}:`;
 };
 exports.censor = censor;
 /**
@@ -120,9 +120,6 @@ const recurseExtract = (obj, matcher) => {
         }
         // value is simple-ish
         if (matcher(key, value)) {
-            if (value == null) {
-                return value; // gets filtered below
-            }
             return value === null || value === void 0 ? void 0 : value.toString();
         }
     })

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@zapier/secret-scrubber",
-  "version": "1.0.5",
+  "version": "1.0.6",
   "description": "Confidently remove secrets and sensitive values from unstructured objects.",
   "main": "lib/index.js",
   "typings": "lib/index.d.ts",