diff --git a/pkg/redact/redact.go b/pkg/redact/redact.go index 789704f6..e8765f3f 100644 --- a/pkg/redact/redact.go +++ b/pkg/redact/redact.go @@ -103,30 +103,28 @@ func buildAdditionalRedactors(path string, redacts []*troubleshootv1beta1.Redact continue } - withinRedactNum := 0 // give unique redaction names - - for _, re := range redact.Regex { - r, err := NewSingleLineRedactor(re, MASK_TEXT, path, redactorName(i, withinRedactNum, redact.Name, "regex", "")) + for j, re := range redact.Regex { + r, err := NewSingleLineRedactor(re, MASK_TEXT, path, redactorName(i, j, redact.Name, "regex")) if err != nil { return nil, errors.Wrapf(err, "redactor %q", re) } additionalRedactors = append(additionalRedactors, r) } - for _, literal := range redact.Values { - additionalRedactors = append(additionalRedactors, literalString(literal, path, redactorName(i, withinRedactNum, redact.Name, "literal", ""))) + for j, literal := range redact.Values { + additionalRedactors = append(additionalRedactors, literalString(literal, path, redactorName(i, j, redact.Name, "literal"))) } - for _, re := range redact.MultiLine { - r, err := NewMultiLineRedactor(re.Selector, re.Redactor, MASK_TEXT, path, redactorName(i, withinRedactNum, redact.Name, "multiLine", "")) + for j, re := range redact.MultiLine { + r, err := NewMultiLineRedactor(re.Selector, re.Redactor, MASK_TEXT, path, redactorName(i, j, redact.Name, "multiLine")) if err != nil { return nil, errors.Wrapf(err, "multiline redactor %+v", re) } additionalRedactors = append(additionalRedactors, r) } - for _, yaml := range redact.Yaml { - r := NewYamlRedactor(yaml, path, redactorName(i, withinRedactNum, redact.Name, "yaml", "")) + for j, yaml := range redact.Yaml { + r := NewYamlRedactor(yaml, path, redactorName(i, j, redact.Name, "yaml")) additionalRedactors = append(additionalRedactors, r) } } @@ -171,39 +169,96 @@ func getRedactors(path string) ([]Redactor, error) { // (?i) makes it case insensitive // groups named with `?P` will be masked // groups named with `?P` will be removed (replaced with empty strings) - singleLines := []string{ + singleLines := []struct { + regex string + name string + }{ // ipv4 - `(?P\b(?P25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\.(?P25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\.(?P25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\.(?P25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\b)`, + { + regex: `(?P\b(?P25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\.(?P25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\.(?P25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\.(?P25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\b)`, + name: "default ipv4 redactor", + }, // TODO: ipv6 // aws secrets - `(?i)(\\\"name\\\":\\\"[^\"]*SECRET_?ACCESS_?KEY\\\",\\\"value\\\":\\\")(?P[^\"]*)(\\\")`, - `(?i)(\\\"name\\\":\\\"[^\"]*ACCESS_?KEY_?ID\\\",\\\"value\\\":\\\")(?P[^\"]*)(\\\")`, - `(?i)(\\\"name\\\":\\\"[^\"]*OWNER_?ACCOUNT\\\",\\\"value\\\":\\\")(?P[^\"]*)(\\\")`, + { + regex: `(?i)(\\\"name\\\":\\\"[^\"]*SECRET_?ACCESS_?KEY\\\",\\\"value\\\":\\\")(?P[^\"]*)(\\\")`, + name: "default SECRET_ACCESS_KEY redactor", + }, + { + regex: `(?i)(\\\"name\\\":\\\"[^\"]*ACCESS_?KEY_?ID\\\",\\\"value\\\":\\\")(?P[^\"]*)(\\\")`, + name: "default ACCESS_KEY_ID redactor", + }, + { + regex: `(?i)(\\\"name\\\":\\\"[^\"]*OWNER_?ACCOUNT\\\",\\\"value\\\":\\\")(?P[^\"]*)(\\\")`, + name: "default OWNER_ACCOUNT redactor", + }, // passwords in general - `(?i)(\\\"name\\\":\\\"[^\"]*password[^\"]*\\\",\\\"value\\\":\\\")(?P[^\"]*)(\\\")`, + { + regex: `(?i)(\\\"name\\\":\\\"[^\"]*password[^\"]*\\\",\\\"value\\\":\\\")(?P[^\"]*)(\\\")`, + name: "default password redactor", + }, // tokens in general - `(?i)(\\\"name\\\":\\\"[^\"]*token[^\"]*\\\",\\\"value\\\":\\\")(?P[^\"]*)(\\\")`, - `(?i)(\\\"name\\\":\\\"[^\"]*database[^\"]*\\\",\\\"value\\\":\\\")(?P[^\"]*)(\\\")`, - `(?i)(\\\"name\\\":\\\"[^\"]*user[^\"]*\\\",\\\"value\\\":\\\")(?P[^\"]*)(\\\")`, + { + regex: `(?i)(\\\"name\\\":\\\"[^\"]*token[^\"]*\\\",\\\"value\\\":\\\")(?P[^\"]*)(\\\")`, + name: "default token redactor", + }, + { + regex: `(?i)(\\\"name\\\":\\\"[^\"]*database[^\"]*\\\",\\\"value\\\":\\\")(?P[^\"]*)(\\\")`, + name: "default database redactor", + }, + { + regex: `(?i)(\\\"name\\\":\\\"[^\"]*user[^\"]*\\\",\\\"value\\\":\\\")(?P[^\"]*)(\\\")`, + name: "default user redactor", + }, // connection strings with username and password // http://user:password@host:8888 - `(?i)(https?|ftp)(:\/\/)(?P[^:\"\/]+){1}(:)(?P[^@\"\/]+){1}(?P@[^:\/\s\"]+){1}(?P:[\d]+)?`, + { + regex: `(?i)(https?|ftp)(:\/\/)(?P[^:\"\/]+){1}(:)(?P[^@\"\/]+){1}(?P@[^:\/\s\"]+){1}(?P:[\d]+)?`, + name: "default connection string redactor", + }, // user:password@tcp(host:3309)/db-name - `\b(?P[^:\"\/]*){1}(:)(?P[^:\"\/]*){1}(@tcp\()(?P[^:\"\/]*){1}(?P:[\d]*)?(\)\/)(?P[\w\d\S-_]+){1}\b`, - // standard postgres and mysql connnection strings - `(?i)(Data Source *= *)(?P[^\;]+)(;)`, - `(?i)(location *= *)(?P[^\;]+)(;)`, - `(?i)(User ID *= *)(?P[^\;]+)(;)`, - `(?i)(password *= *)(?P[^\;]+)(;)`, - `(?i)(Server *= *)(?P[^\;]+)(;)`, - `(?i)(Database *= *)(?P[^\;]+)(;)`, - `(?i)(Uid *= *)(?P[^\;]+)(;)`, - `(?i)(Pwd *= *)(?P[^\;]+)(;)`, + { + regex: `\b(?P[^:\"\/]*){1}(:)(?P[^:\"\/]*){1}(@tcp\()(?P[^:\"\/]*){1}(?P:[\d]*)?(\)\/)(?P[\w\d\S-_]+){1}\b`, + name: "default db connection string redactor", + }, + // standard postgres and mysql connection strings + { + regex: `(?i)(Data Source *= *)(?P[^\;]+)(;)`, + name: "default Data Source redactor", + }, + { + regex: `(?i)(location *= *)(?P[^\;]+)(;)`, + name: "default location redactor", + }, + { + regex: `(?i)(User ID *= *)(?P[^\;]+)(;)`, + name: "default User ID redactor", + }, + { + regex: `(?i)(password *= *)(?P[^\;]+)(;)`, + name: "default db-password redactor", + }, + { + regex: `(?i)(Server *= *)(?P[^\;]+)(;)`, + name: "default server redactor", + }, + { + regex: `(?i)(Database *= *)(?P[^\;]+)(;)`, + name: "default db-database redactor", + }, + { + regex: `(?i)(Uid *= *)(?P[^\;]+)(;)`, + name: "default Uid redactor", + }, + { + regex: `(?i)(Pwd *= *)(?P[^\;]+)(;)`, + name: "default Pwd redactor", + }, } redactors := make([]Redactor, 0) - for i, re := range singleLines { - r, err := NewSingleLineRedactor(re, MASK_TEXT, path, redactorName(-1, i, "", "defaultRegex", re)) + for _, re := range singleLines { + r, err := NewSingleLineRedactor(re.regex, MASK_TEXT, path, re.name) if err != nil { return nil, err // maybe skip broken ones? } @@ -213,39 +268,47 @@ func getRedactors(path string) ([]Redactor, error) { doubleLines := []struct { line1 string line2 string + name string }{ { line1: `(?i)"name": *"[^\"]*SECRET_?ACCESS_?KEY[^\"]*"`, line2: `(?i)("value": *")(?P.*[^\"]*)(")`, + name: "default multiline SECRET_ACCESS_KEY redactor", }, { line1: `(?i)"name": *"[^\"]*ACCESS_?KEY_?ID[^\"]*"`, line2: `(?i)("value": *")(?P.*[^\"]*)(")`, + name: "default multiline ACCESS_KEY_ID redactor", }, { line1: `(?i)"name": *"[^\"]*OWNER_?ACCOUNT[^\"]*"`, line2: `(?i)("value": *")(?P.*[^\"]*)(")`, + name: "default multiline OWNER_ACCOUNT redactor", }, { line1: `(?i)"name": *".*password[^\"]*"`, line2: `(?i)("value": *")(?P.*[^\"]*)(")`, + name: "default multiline password redactor", }, { line1: `(?i)"name": *".*token[^\"]*"`, line2: `(?i)("value": *")(?P.*[^\"]*)(")`, + name: "default multiline token redactor", }, { line1: `(?i)"name": *".*database[^\"]*"`, line2: `(?i)("value": *")(?P.*[^\"]*)(")`, + name: "default multiline database redactor", }, { line1: `(?i)"name": *".*user[^\"]*"`, line2: `(?i)("value": *")(?P.*[^\"]*)(")`, + name: "default multiline user redactor", }, } - for i, l := range doubleLines { - r, err := NewMultiLineRedactor(l.line1, l.line2, MASK_TEXT, path, redactorName(-1, i, "", "defaultMultiLine", l.line1)) + for _, l := range doubleLines { + r, err := NewMultiLineRedactor(l.line1, l.line2, MASK_TEXT, path, l.name) if err != nil { return nil, err // maybe skip broken ones? } @@ -302,12 +365,9 @@ func addRedaction(redaction Redaction) { }(redaction) } -func redactorName(redactorNum, withinRedactorNum int, redactorName, redactorType, redactorLiteral string) string { +func redactorName(redactorNum, withinRedactorNum int, redactorName, redactorType string) string { if redactorName != "" { - return fmt.Sprintf("%s-%d", redactorName, withinRedactorNum) + return fmt.Sprintf("%s.%s.%d", redactorName, redactorType, withinRedactorNum) } - if redactorLiteral == "" { - return fmt.Sprintf("unnamed-%d.%d-%s", redactorNum, withinRedactorNum, redactorType) - } - return fmt.Sprintf("%s.%d-%q", redactorType, withinRedactorNum, redactorLiteral) + return fmt.Sprintf("unnamed-%d.%s.%d", redactorNum, redactorType, withinRedactorNum) }