46 lines
1.2 KiB
Go
46 lines
1.2 KiB
Go
package catalog
|
|
|
|
import (
|
|
"regexp"
|
|
"strings"
|
|
)
|
|
|
|
var secretPatterns = []struct {
|
|
expression *regexp.Regexp
|
|
replacement string
|
|
}{
|
|
{
|
|
expression: regexp.MustCompile(`(?i)\b(authorization)(\s*[:=]\s*)(?:bearer\s+)?[^\s,;]+`),
|
|
replacement: `${1}${2}[REDACTED]`,
|
|
},
|
|
{
|
|
expression: regexp.MustCompile(`(?i)\b(api[_-]?key|access[_-]?token|refresh[_-]?token|auth[_-]?token|password|secret)(\s*[:=]\s*)("[^"]*"|'[^']*'|[^\s,;]+)`),
|
|
replacement: `${1}${2}[REDACTED]`,
|
|
},
|
|
{
|
|
expression: regexp.MustCompile(`(?i)\bbearer\s+[a-z0-9._~+/=-]+`),
|
|
replacement: `Bearer [REDACTED]`,
|
|
},
|
|
{
|
|
expression: regexp.MustCompile(`(?i)\b[a-z0-9._%+-]+@[a-z0-9.-]+\.[a-z]{2,}\b`),
|
|
replacement: `[REDACTED_IDENTITY]`,
|
|
},
|
|
}
|
|
|
|
// Redact removes credential-like and account-identity text from diagnostics.
|
|
func Redact(input string) string {
|
|
output := input
|
|
for _, pattern := range secretPatterns {
|
|
output = pattern.expression.ReplaceAllString(output, pattern.replacement)
|
|
}
|
|
return output
|
|
}
|
|
|
|
func diagnostic(input string) string {
|
|
const maxDiagnosticBytes = 2048
|
|
clean := strings.TrimSpace(Redact(input))
|
|
if len(clean) <= maxDiagnosticBytes {
|
|
return clean
|
|
}
|
|
return clean[:maxDiagnosticBytes] + "…"
|
|
}
|