src/redact.ts

Functions

Imports

It imports no other module of this repo. Imported by src/github/actions.ts, src/routine-fire.ts.

Source

1// Secret redaction for text this Worker relays from somewhere it does not control.
2//
3// A CI log carries whatever the workflow echoed: a token a step printed by accident, an
4// Authorization header from a verbose curl, a key file cat'd while debugging. GitHub
5// masks the secrets it knows about as ***, and nothing else. capsid_inspect_repo action ci returns log text
6// to any write-grant caller, including a namespace's driver, so every log text it
7// returns passes through redact() first (src/github/actions.ts).
8//
9// Each pattern replaces the secret, never the line, with [REDACTED:<kind>], so the
10// caller still sees where it was and what kind it was. Order matters: the specific
11// shapes run first, so a GitHub token in `GITHUB_TOKEN=ghp_...` is named github-token
12// rather than the generic assignment.
13//
14// This errs toward over-redacting. A false positive costs a caller one value in a log;
15// a false negative hands a credential to an agent.
16
17type RedactionKind =
18  | "private-key"
19  | "jwt"
20  | "github-token"
21  | "slack-token"
22  | "aws-access-key-id"
23  | "auth"
24  | "assignment"
25  | "high-entropy";
26
27const marker = (kind: RedactionKind) => `[REDACTED:${kind}]`;
28
29// A value the generic patterns may take: no whitespace, quote, separator or ampersand,
30// and never an earlier marker, so a redacted value is not redacted twice under a
31// vaguer name.
32const VALUE = String.raw`(?!\[REDACTED)[^\s"',;&]{6,}`;
33
34// Key names whose assigned value is a secret. Deliberately without bare "key" and
35// "auth": "key" is every cache key in a CI log, and "auth" is "author".
36const SECRET_NAME = String.raw`[A-Za-z0-9_.-]*(?:secret|token|passw(?:or)?d|api[_-]?key|access[_-]?key|private[_-]?key|signing[_-]?key|credential)[A-Za-z0-9_.-]*`;
37
38interface Rule {
39  kind: RedactionKind;
40  pattern: RegExp;
41  // Default: the whole match becomes the marker.
42  replace?: (match: string, ...groups: string[]) => string;
43}
44
45const RULES: Rule[] = [
46  // A PEM or PGP private key block, whole. An unterminated block (a log cut mid-key)
47  // is redacted to the end of the text rather than left half-shown.
48  {
49    kind: "private-key",
50    pattern: /-----BEGIN ([A-Z0-9 ]*?)PRIVATE KEY( BLOCK)?-----[\s\S]*?(?:-----END \1PRIVATE KEY\2-----|$)/g,
51  },
52  // Header and payload are base64url JSON, so both start with eyJ ('{"').
53  { kind: "jwt", pattern: /\beyJ[A-Za-z0-9_-]{5,}\.eyJ[A-Za-z0-9_-]{5,}\.[A-Za-z0-9_-]{5,}/g },
54  // Classic (ghp_ personal, gho_ OAuth, ghu_ user-to-server, ghs_ server-to-server,
55  // ghr_ refresh) and fine-grained personal access tokens.
56  { kind: "github-token", pattern: /\b(?:gh[pousr]_[A-Za-z0-9]{20,}|github_pat_[A-Za-z0-9_]{20,})/g },
57  { kind: "slack-token", pattern: /\bxox[abposr]-[A-Za-z0-9-]{10,}/g },
58  { kind: "slack-token", pattern: /https:\/\/hooks\.slack\.com\/services\/[A-Za-z0-9/_-]+/g },
59  { kind: "aws-access-key-id", pattern: /\b(?:AKIA|ASIA|ABIA|ACCA|AGPA|AIDA|AIPA|ANPA|ANVA|AROA)[A-Z0-9]{16}\b/g },
60  // An Authorization header's value, with its scheme kept. The scheme word is never
61  // taken as the value, so a header whose value an earlier rule already redacted is
62  // left as it is.
63  {
64    kind: "auth",
65    pattern: new RegExp(
66      String.raw`\b(authorization["']?\s*[:=]\s*["']?)((?:bearer|basic|token|digest)\s+)?(?!(?:bearer|basic|token|digest)\s)(${VALUE})`,
67      "gi"
68    ),
69    replace: (_m, lead, scheme) => `${lead}${scheme ?? ""}${marker("auth")}`,
70  },
71  // A Bearer or Basic credential outside a header. The value must hold a digit or a
72  // base64 symbol, so the prose "Bearer tokens" and "Basic authentication" survive.
73  {
74    kind: "auth",
75    pattern: /\b(Bearer|Basic)(\s+)(?=[A-Za-z0-9._~+/-]*[0-9+/=])[A-Za-z0-9._~+/-]{8,}=*/gi,
76    replace: (_m, scheme, space) => `${scheme}${space}${marker("auth")}`,
77  },
78  // NAME=value, NAME: value, "name": "value", ?name=value, for a secret-shaped name.
79  {
80    kind: "assignment",
81    pattern: new RegExp(String.raw`(?<![A-Za-z0-9_.-])(["']?)(${SECRET_NAME})\1(\s*[:=]\s*)(["']?)(${VALUE})`, "gi"),
82    replace: (_m, q1, name, sep, q2) => `${q1}${name}${q1}${sep}${q2}${marker("assignment")}`,
83  },
84  // A long random-looking run shortly after a word like secret, token, key or password,
85  // in forms the assignment rule does not cover ("the token is 3f9a...").
86  {
87    kind: "high-entropy",
88    pattern: /\b((?:secret|token|key|password|passwd|credential)s?\b[^\n]{0,24}?)([A-Za-z0-9+/_-]{32,}={0,2})/gi,
89    replace: (match, lead, run) => (looksRandom(run) ? `${lead}${marker("high-entropy")}` : match),
90  },
91];
92
93// A run of 32 or more is random-looking if it is all hex, or mixes letters and digits.
94// A long word or a long run of one character is not.
95function looksRandom(run: string): boolean {
96  if (/^[0-9a-f]+$/i.test(run) && /\d/.test(run)) return true;
97  return /\d/.test(run) && /[A-Za-z]/.test(run);
98}
99
100export interface Redacted {
101  text: string;
102  // How many values of each kind were replaced; empty when none were.
103  redactions: Partial<Record<RedactionKind, number>>;
104}
105
106/** Replaces every secret-shaped value in `text` with [REDACTED:<kind>]. */
107export function redact(text: string): Redacted {
108  const redactions: Partial<Record<RedactionKind, number>> = {};
109  let out = text;
110  for (const rule of RULES) {
111    out = out.replace(rule.pattern, (match: string, ...rest: unknown[]) => {
112      // rest ends with offset, input (and groups when named); only the captures are strings we pass on.
113      const groups = rest.slice(0, -2) as string[];
114      const replaced = rule.replace ? rule.replace(match, ...groups) : marker(rule.kind);
115      if (replaced !== match) redactions[rule.kind] = (redactions[rule.kind] ?? 0) + 1;
116      return replaced;
117    });
118  }
119  return { text: out, redactions };
120}
121
122/** redact() when only the text is wanted, for a short error body. */
123export const redactText = (text: string): string => redact(text).text;