From 1940c5d68136ce2079efa8ff74d4e5fdf63ee3e6 Mon Sep 17 00:00:00 2001 From: Matt Mackay Date: Mon, 14 Nov 2022 09:48:03 -0800 Subject: [PATCH] redact 'token' strings from logging It's common for users to set 'TOKEN' as an env var. While this is a little like whack-a-mole and we can't cover everything, this seems like a common string to redact. Closes #16622. PiperOrigin-RevId: 488392632 Change-Id: I7b48199cc140d6736cd145df63e03eeda747c7fb --- .../devtools/build/lib/runtime/SafeRequestLogging.java | 5 +++-- .../build/lib/runtime/SafeRequestLoggingTest.java | 10 ++++++++++ 2 files changed, 13 insertions(+), 2 deletions(-) diff --git a/src/main/java/com/google/devtools/build/lib/runtime/SafeRequestLogging.java b/src/main/java/com/google/devtools/build/lib/runtime/SafeRequestLogging.java index 0b75d5f0a1a8fb..3d8adb07c5f16a 100644 --- a/src/main/java/com/google/devtools/build/lib/runtime/SafeRequestLogging.java +++ b/src/main/java/com/google/devtools/build/lib/runtime/SafeRequestLogging.java @@ -21,14 +21,15 @@ /** Utils for logging safely user commandlines. */ public class SafeRequestLogging { private static final Pattern suppressFromLog = - Pattern.compile("--client_env=([^=]*(?:auth|pass|cookie)[^=]*)=", Pattern.CASE_INSENSITIVE); + Pattern.compile( + "--client_env=([^=]*(?:auth|pass|cookie|token)[^=]*)=", Pattern.CASE_INSENSITIVE); private SafeRequestLogging() {} /** * Generates a string form of a request to be written to the logs, filtering the user environment * to remove anything that looks private. The current filter criteria removes any variable whose - * name includes "auth", "pass", or "cookie". + * name includes "auth", "pass", "cookie" or "token". * * @return the filtered request to write to the log. */ diff --git a/src/test/java/com/google/devtools/build/lib/runtime/SafeRequestLoggingTest.java b/src/test/java/com/google/devtools/build/lib/runtime/SafeRequestLoggingTest.java index d9334ebd6f0608..5838ef0c46cb61 100644 --- a/src/test/java/com/google/devtools/build/lib/runtime/SafeRequestLoggingTest.java +++ b/src/test/java/com/google/devtools/build/lib/runtime/SafeRequestLoggingTest.java @@ -69,6 +69,16 @@ public void testGetRequestLogStringStripsApparentPasswordValues() { "[--client_env=dont_paSS_ME=__private_value_removed__, --client_env=other=isprinted]"); } + @Test + public void testGetRequestLogStringStripsApparentTokenValues() { + assertThat( + SafeRequestLogging.getRequestLogString( + ImmutableList.of( + "--client_env=service_ToKEn=notprinted", "--client_env=other=isprinted"))) + .isEqualTo( + "[--client_env=service_ToKEn=__private_value_removed__, --client_env=other=isprinted]"); + } + @Test public void testGetRequestLogIgnoresSensitiveTermsInValues() { assertThat(SafeRequestLogging.getRequestLogString(ImmutableList.of("--client_env=ok=COOKIE")))