secretmask

package

v1.0.2 Latest Latest Go to latest Published: Nov 13, 2026 License: Apache-2.0 Imports: 15 Imported by: 0

Details

Valid go.mod file
Redistributable license
Tagged version
Stable version
Learn more about best practices

Repository

github.com/GLINCKER/levelrail

Links

Open Source Insights

Documentation ¶

Overview ¶

Package secretmask masks known secret values in text before it is written to a log, audit row or stored build output.

Index ¶

Constants
func Add(v string)
func Handler(next slog.Handler) slog.Handler
func Mask(s string) string
type Line
type LineCarry
- func NewLineCarry() *LineCarry
- func NewLineCarryFor(reg *Registry) *LineCarry
type Registry
- func New() *Registry
type Writer
- func NewWriter(dst io.Writer) *Writer
- func NewWriterFor(dst io.Writer, reg *Registry) *Writer

Constants ¶

View Source

const (
	// Marker replaces a known secret.
	Marker = "[redacted]"
	// MinLength skips short values: masking "true" or "1234" would shred ordinary text.
	MinLength = 8
)

Variables ¶

This section is empty.

Functions ¶

func Add ¶

func Add(v string)

Add registers v in the process-wide registry.

func Handler ¶

func Handler(next slog.Handler) slog.Handler

Handler wraps next so every string attribute and message is masked.

func Mask ¶

func Mask(s string) string

Mask masks s with the process-wide registry.

Types ¶

type Line ¶

type Line struct {
	Stream string
	Text   string
}

Line is one log line with the stream it came from.

type LineCarry ¶

type LineCarry struct {
	// contains filtered or unexported fields
}

LineCarry masks a sequence of log lines while catching a secret that spans a line break. It holds back raw trailing lines covering the last n-1 bytes, n being the longest multi-line secret (nothing is held without one), so the caller must Flush after a short idle interval and at stream end.

func NewLineCarry ¶

func NewLineCarry() *LineCarry

NewLineCarry masks with the process-wide registry.

func NewLineCarryFor ¶

func NewLineCarryFor(reg *Registry) *LineCarry

NewLineCarryFor masks with reg.

func (*LineCarry) Flush ¶

func (c *LineCarry) Flush() []Line

Flush emits everything held, masked.

func (*LineCarry) Pending ¶

func (c *LineCarry) Pending() bool

Pending reports whether raw lines are still held back.

func (*LineCarry) Push ¶

func (c *LineCarry) Push(stream, text string) []Line

Push adds a raw line and returns the masked lines that are now safe to emit.

type Registry ¶

type Registry struct {
	// contains filtered or unexported fields
}

Registry holds secret values and rewrites text that contains them.

func New ¶

func New() *Registry

New returns an empty registry.

func (*Registry) Add ¶

func (r *Registry) Add(v string)

Add registers a secret value; short values are ignored. The cap counts primary values only, encoded forms ride along, and a primary is never evicted.

func (*Registry) Len ¶

func (r *Registry) Len() int

Len reports how many values are registered.

func (*Registry) Mask ¶

func (r *Registry) Mask(s string) string

Mask replaces every registered value in s. Overlapping and prefix matches are merged into one span so no tail of a longer secret survives a shorter hit.

type Writer ¶

type Writer struct {
	// contains filtered or unexported fields
}

Writer masks a byte stream. It holds back the last maxLen-1 bytes of each write so a secret split across two writes is still seen whole.

func NewWriter ¶

func NewWriter(dst io.Writer) *Writer

NewWriter masks with the process-wide registry.

func NewWriterFor ¶

func NewWriterFor(dst io.Writer, reg *Registry) *Writer

NewWriterFor masks with reg.

func (*Writer) Close ¶

func (w *Writer) Close() error

Close flushes; it does not close dst.

func (*Writer) Flush ¶

func (w *Writer) Flush() error

Flush emits the held-back tail. Call it when the stream ends.

func (*Writer) Write ¶

func (w *Writer) Write(p []byte) (int, error)

Write always reports len(p) so io.Copy keeps draining even when dst fails late. The carry stays raw: masking it early would hide a longer secret that a shorter one sits inside.

Source Files ¶

View all Source files

?	: This menu
/	: Search site
f or F	: Jump to
y or Y	: Canonical URL