reporting-labs 0.6.2 → 0.6.3

package/README.md

@@ -134,7 +134,7 @@ await testData(rowsFromExcelOrJson, 'Coupons');                           // arr
 await testData(fs.readFileSync('data/users.csv', 'utf8'), 'users.csv');   // CSV text → table
 ```
 
-**Secrets are masked automatically.** Passwords, tokens, API keys, `Authorization` and `Cookie` headers, JWTs and `Bearer ...` values show as `****`. Add your own keys with `maskKeys: ['otp', 'pan']` in the config.
+**Secrets are masked automatically**, wherever they show up: `console.log` output, `log()` lines, `testData()` blocks, API headers and bodies, step titles and assertion messages. Covered forms: `password=x`, `Password: x`, `{ password: 'x' }`, `"password":"x"`, `X-Api-Key: x`, `access_token=x`, "password is x", "with password S3cret@1", `Bearer ...` / `Basic ...`, JWTs, and well-known token formats (GitHub, AWS, Slack, Stripe, Google, GitLab, npm, SendGrid). A failing `expect(token)` shows `Received: "****"`. Add your own keys with `maskKeys: ['otp', 'pan']` in the config; they apply to text too.
 
 ## API calls: recorded on their own
 

package/dist/mask.d.ts

@@ -1,6 +1,6 @@
 export declare function makeMasker(extraKeys?: string[]): {
     mask: (v: unknown, key?: string) => unknown;
-    maskStr: (s: string) => string;
+    maskStr: (input: string) => string;
     isSensitive: (k: string) => boolean;
 };
 export declare function parseCsv(text: string): {

package/dist/mask.js

@@ -3,20 +3,60 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.makeMasker = makeMasker;
 exports.parseCsv = parseCsv;
 const DEFAULT_KEYS = ['password', 'passwd', 'pwd', 'secret', 'token', 'apikey', 'api_key', 'api-key', 'authorization', 'auth', 'cookie', 'set-cookie', 'session', 'credential', 'private', 'ssn', 'cvv', 'card'];
+/** Values that are secrets on their own, whatever the surrounding text. */
 const VALUE_PATTERNS = [
-    /\b(Bearer|Basic|Token)\s+[A-Za-z0-9._~+\/=-]{8,}/gi,
+    /\b(Bearer|Basic|Digest|Token)\s+[A-Za-z0-9._~+\/=-]{8,}/gi,
     /\beyJ[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{5,}/g, // JWT
-    /\b(sk|pk|ghp|xox[abp]|AKIA)[_-]?[A-Za-z0-9]{12,}\b/g,
-    /(password|passwd|pwd|token|secret|api[_-]?key)(\s*[=:]\s*)([^\s&;,"']+)/gi,
+    /\b(?:sk|pk|rk)[-_](?:live|test)?[-_]?[A-Za-z0-9]{12,}\b/g, // Stripe-style keys
+    /\b(?:ghp|gho|ghu|ghs|ghr)_[A-Za-z0-9]{20,}\b/g, // GitHub tokens
+    /\bgithub_pat_[A-Za-z0-9_]{20,}\b/g,
+    /\bxox[abpr]-[A-Za-z0-9-]{10,}\b/g, // Slack
+    /\bAKIA[0-9A-Z]{16}\b/g, // AWS access key id
+    /\bAIza[0-9A-Za-z_-]{30,}\b/g, // Google API key
+    /\bya29\.[0-9A-Za-z_-]{20,}\b/g, // Google OAuth token
+    /\bglpat-[A-Za-z0-9_-]{20,}\b/g, // GitLab
+    /\bnpm_[A-Za-z0-9]{30,}\b/g, // npm
+    /\bSG\.[A-Za-z0-9_-]{16,}\.[A-Za-z0-9_-]{16,}\b/g, // SendGrid
 ];
+/** Words after "password is ..." that are plainly not a secret. */
+const NOT_A_SECRET = new Set(['valid', 'invalid', 'visible', 'hidden', 'required', 'optional', 'missing', 'empty', 'null', 'undefined', 'none',
+    'correct', 'incorrect', 'wrong', 'right', 'expired', 'set', 'unset', 'not', 'present', 'absent', 'ok', 'true', 'false', 'masked', 'blank',
+    'too', 'the', 'a', 'an', 'same', 'different', 'changed', 'unchanged', 'shown', 'displayed', 'accepted', 'rejected', 'weak', 'strong']);
+const esc = (s) => s.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
 function makeMasker(extraKeys = []) {
     const keys = [...DEFAULT_KEYS, ...extraKeys.map(k => k.toLowerCase())];
     const isSensitive = (k) => { const l = k.toLowerCase(); return keys.some(s => l === s || l.includes(s)); };
-    const maskStr = (s) => VALUE_PATTERNS.reduce((acc, re) => acc.replace(re, (m, ...g) => {
-        if (g.length >= 3 && typeof g[1] === 'string' && /[=:]/.test(g[1]))
-            return g[0] + g[1] + '****';
-        return m.split(/\s+/)[0] + ' ****';
-    }), s);
+    // Key names as they appear in free text: password, X-Api-Key, access_token, userPassword, "password", db.password...
+    // `auth`, `otp`, `pin`... are matched as whole words only, so "author" or "pinned" stay untouched.
+    const compound = ['password', 'passwd', 'pwd', 'passcode', 'secret', 'token', 'api[_-]?key', 'cookie', 'credentials?', 'private[_-]?key', 'access[_-]?key', 'session[_-]?id', ...extraKeys.map(esc)];
+    const exact = ['authorization', 'auth', 'otp', 'pin', 'cvv', 'ssn'];
+    const KEY = `(?:[\\w.-]*?(?:${compound.join('|')})[\\w-]*|${exact.join('|')})`;
+    // key = value | key: value | "key": "value" | key => value | key -> value   (value runs to a delimiter; a closing quote stays)
+    const KV = new RegExp(`(["']?)\\b(${KEY})\\b(["']?)(\\s*(?:=>|->|[=:])\\s*)(["']?)([^"'\\s&;,}\\]\\)]+)`, 'gi');
+    // password is S3cret | token was abc | password 'S3cret' | with password S3cret@123 (only when the value looks like a secret)
+    const SPOKEN_KEYS = ['password', 'passwd', 'pwd', 'passcode', 'secret', 'token', 'api[ _-]?key', 'access[ _-]?key', 'otp', 'pin', 'cvv', ...extraKeys.map(esc)];
+    const SPOKEN = new RegExp(`\\b(${SPOKEN_KEYS.join('|')})(s?\\b\\s+(?:is|was|of|as)?\\s*['"]?)([^\\s'",;]+)`, 'gi');
+    const looksSecret = (v) => !/\s/.test(v) && (/\d/.test(v) && v.length >= 4 || /[^A-Za-z0-9]/.test(v) && v.length >= 6 || /[a-z][A-Z]|[A-Z][a-z].*[A-Z]/.test(v) && v.length >= 8);
+    // Assertion output: when the text talks about a password/token/secret, the compared values are that secret.
+    //   expect(token, 'token should match').toBe('x')  ->  Expected: "x" / Received: "tok_9f8e..."
+    const MENTIONS_SECRET = new RegExp(`\\b(?:${SPOKEN_KEYS.join('|')})s?\\b`, 'i');
+    const COMPARED = /\b(Expected|Received|Actual|expected|received|actual|got)(\s*[:=]\s*)(["'\u201c]?)([^"'\u201d\s]+)/g;
+    const maskStr = (input) => {
+        let s = input;
+        for (const re of VALUE_PATTERNS)
+            s = s.replace(re, m => /^(Bearer|Basic|Digest|Token)\s/i.test(m) ? m.split(/\s+/)[0] + ' ****' : '****');
+        s = s.replace(KV, (_m, q1, key, q2, sep, q3, _value) => `${q1}${key}${q2}${sep}${q3}****`);
+        s = s.replace(SPOKEN, (m, key, between, value) => {
+            const word = value.toLowerCase().replace(/[^a-z0-9]/g, '');
+            if (NOT_A_SECRET.has(word) || word === '****' || value === '****')
+                return m;
+            const explicit = /\b(is|was|of|as)\b|['"]$/.test(between);
+            return explicit || looksSecret(value) ? `${key}${between}****` : m;
+        });
+        if (MENTIONS_SECRET.test(s))
+            s = s.replace(COMPARED, (m, label, sep, q, value) => looksSecret(value) ? `${label}${sep}${q}****` : m);
+        return s;
+    };
     const mask = (v, key = '') => {
         if (key && isSensitive(key))
             return '****';

package/dist/reporter.js

@@ -437,14 +437,15 @@ class ReportingLabsReporter {
         return path.relative(base, file).split(path.sep).join('/');
     }
     serializeError(e) {
-        const out = { message: stripAnsi(e.message ?? e.value ?? '') };
+        // Assertions print received/expected values, so a failing `expect(token)` would leak the token without this.
+        const out = { message: this.masker.maskStr(stripAnsi(e.message ?? e.value ?? '')) };
         const why = (0, explain_1.explainError)(out.message);
         if (why)
             out.explain = why;
         if (e.stack)
-            out.stack = stripAnsi(e.stack);
+            out.stack = this.masker.maskStr(stripAnsi(e.stack));
         if (e.snippet)
-            out.snippet = stripAnsi(e.snippet);
+            out.snippet = this.masker.maskStr(stripAnsi(e.snippet));
         if (e.location)
             out.location = { file: this.rel(e.location.file), line: e.location.line, column: e.location.column };
         return out;
@@ -538,10 +539,10 @@ class ReportingLabsReporter {
     }
     serializeStep(s) {
         return {
-            title: s.title,
+            title: this.masker.maskStr(s.title),
             category: s.category,
             duration: s.duration,
-            error: s.error?.message ? stripAnsi(s.error.message) : undefined,
+            error: s.error?.message ? this.masker.maskStr(stripAnsi(s.error.message)) : undefined,
             steps: s.steps.filter(c => !isInternalAttach(c)).map(c => this.serializeStep(c)),
         };
     }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "reporting-labs",
-  "version": "0.6.2",
+  "version": "0.6.3",
   "description": "reportingLabs – beautiful, customizable single-file HTML test reports. One line of config. Playwright adapter included, more runners on the way.",
   "keywords": [
     "test-report",