weave-scope/report/censor.go

package report

import (
	"net/http"
	"strings"
)

// CensorConfig describes how probe reports should
// be censored when rendered through the API.
type CensorConfig struct {
	HideCommandLineArguments bool
	HideEnvironmentVariables bool
}

// GetCensorConfigFromRequest extracts censor config from request query params.
func GetCensorConfigFromRequest(req *http.Request) CensorConfig {
	return CensorConfig{
		HideCommandLineArguments: req.URL.Query().Get("hideCommandLineArguments") == "true",
		HideEnvironmentVariables: req.URL.Query().Get("hideEnvironmentVariables") == "true",
	}
}

// IsCommandEntry returns true iff the entry comes from a command line
// that might need to be conditionally censored.
func IsCommandEntry(key string) bool {
	return key == Cmdline || key == DockerContainerCommand
}

// IsEnvironmentVarsEntry returns true if the entry might expose some
// environment variables data might need to be conditionally censored.
func IsEnvironmentVarsEntry(key string) bool {
	return strings.HasPrefix(key, DockerEnvPrefix)
}

// StripCommandArgs removes all the arguments from the command
func StripCommandArgs(command string) string {
	return strings.Split(command, " ")[0]
}

// CensorRawReport removes any sensitive data from the raw report based on the request query params.
func CensorRawReport(rawReport Report, cfg CensorConfig) Report {
	// Create a copy of the report first to make sure the operation is immutable.
	censoredReport := rawReport.Copy()
	censoredReport.ID = rawReport.ID

	censoredReport.WalkTopologies(func(t *Topology) {
		for nodeID, node := range t.Nodes {
			if node.Latest != nil {
				latest := make(StringLatestMap, 0, cap(node.Latest))
				for _, entry := range node.Latest {
					// If environment variables are to be hidden, omit passing them to the final report.
					if cfg.HideEnvironmentVariables && IsEnvironmentVarsEntry(entry.key) {
						continue
					}
					// If command line arguments are to be hidden, strip them away.
					if cfg.HideCommandLineArguments && IsCommandEntry(entry.key) {
						entry.Value = StripCommandArgs(entry.Value)
					}
					// Pass the latest entry to the final report.
					latest = append(latest, entry)
				}
				node.Latest = latest
				t.Nodes[nodeID] = node
			}
		}
	})
	return censoredReport
}