Documentation
¶
Overview ¶
Package mask redacts credential values from log output by searching for each secret in every form it can appear as (raw, escaped, base64) and replacing it.
Index ¶
Constants ¶
const Mask = "****"
Mask is the placeholder written in place of a credential value.
Variables ¶
This section is empty.
Functions ¶
func InlineSensitiveValues ¶
InlineSensitiveValues returns only inline `sensitive:"true"` values, without reading any sensitive_file paths — used to mask every configured connection cheaply while leaving credential files to the used-connection pass.
func SensitiveValues ¶
SensitiveValues returns inline `sensitive:"true"` values and the CONTENTS of `sensitive_file:"true"` paths in conn; unreadable lists set-but-unreadable paths.
Types ¶
type LineWriter ¶
type LineWriter struct {
// contains filtered or unexported fields
}
LineWriter masks output, always holding back a trailing window the width of the longest secret form so a secret split across writes is masked whole, not leaked.
func (*LineWriter) Flush ¶
func (lw *LineWriter) Flush() error
Flush masks and writes the retained trailing bytes.
type Masker ¶
type Masker struct {
// contains filtered or unexported fields
}
Masker masks a fixed set of secret forms in arbitrary text.
func New ¶
New builds a Masker from raw secret values, expanding each into the forms it can appear as (raw, query/path/userinfo-escaped, base64).
Source Files