Documentation
¶
Overview ¶
Package redact removes credential values from request and response bodies before they reach a log or a preview. It imports nothing from this module, so every transport and every --dry-run reporter can share one rule.
Index ¶
Constants ¶
This section is empty.
Variables ¶
var CredentialFieldPaths = []string{
"institutional_recovery_key.key",
"institutional_recovery_key.data",
}
CredentialFieldPaths are dotted body paths whose leaf name alone is too generic to judge. The generator's shared --set matcher (generator/parser) refuses them and Body redacts them, so the two read this one list.
A disk encryption configuration's institutional keystore is the case that needs it: `.key` and `.data` together are the base64 `.p12` and its key material — the private key that decrypts every institutionally-encrypted FileVault volume in the fleet — while the leaf names `key` and `data` are also worn by `key_type` and by the base64 icon, `.ipa` and `.mobileconfig` blobs on six other resources, which are not credentials.
Functions ¶
func Body ¶
Body replaces credential values in a request or response body with "[REDACTED]", across the encodings this CLI sends: JSON, Classic XML, a plist in either, and form-encoded.
func IsCredentialName ¶
IsCredentialName reports whether a JSON key, XML element, plist key, form parameter or query parameter named name carries a credential value.
func URL ¶
URL returns u for a log line with every credential-named query parameter's value replaced, keeping the order and spelling of the rest, and any userinfo password masked.
func Words ¶
Words lowercases key and splits it into words, on "." "-" "_" "[" "]" and on camelCase boundaries.
A boundary sits before an uppercase rune when the previous rune is lowercase or a digit (clientSecret -> client, secret), and also when the previous rune is uppercase and the NEXT is lowercase (SECRETValue -> secret, value). Without the second case a run of capitals swallows the word that follows it.
Types ¶
This section is empty.
Source Files