rusackas commented on code in PR #331:
URL:
https://github.com/apache/superset-kubernetes-operator/pull/331#discussion_r3936488625
##########
internal/controller/redact.go:
##########
@@ -50,6 +50,19 @@ var (
// "password=hunter2", "PGPASSWORD: hunter2", or "secret_key = hunter2".
// The key may carry prefixes/suffixes (DB_PASSWORD, api-key-prod).
credentialAssignmentRe =
regexp.MustCompile(`(?i)([A-Za-z0-9_-]*(?:password|passwd|pwd|secret|token|api[_-]?key|credential|passphrase)[A-Za-z0-9_-]*\s*[=:]\s*)(\S+)`)
+
+ // quotedKeyCredentialRe matches quoted-key credential assignments as
emitted
+ // by JSON payloads and Python dict/traceback reprs, e.g.
+ // {"password": "hunter2"} or {'db_password': 'hunter2'}.
credentialAssignmentRe
+ // cannot match these — the closing quote sits between the keyword and
the
+ // separator, which its key class does not allow — so quoted-key forms
are a
+ // whole serialization class it systematically misses. The value is
matched as
+ // a quoted string of either style (RE2 has no backreferences, so both
quote
+ // styles are spelled out) and masked in full, including embedded
whitespace.
+ // "authorization" is included because authorizationHeaderRe is equally
+ // quote-blind. The value is replaced with a bare placeholder so a
re-run
+ // finds no quoted value to match (idempotent).
+ quotedKeyCredentialRe =
regexp.MustCompile(`(?i)(["'][A-Za-z0-9_-]*(?:password|passwd|pwd|secret|token|api[_-]?key|credential|passphrase|authorization)[A-Za-z0-9_-]*["']\s*[=:]\s*)("[^"]*"|'[^']*')`)
Review Comment:
Not blocking, but I poked at this and a quoted key with a bare value still
slips through, e.g. `"password": hunter2` or `'password': 12345`. Adding a
`|\S+` alternative to the value group seems to close it and stays idempotent
since `***` re-matches itself. Happy to leave it for a follow-up if you'd
rather keep this one tight.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
