Documentation
¶
Index ¶
- Constants
- Variables
- func NewScrubbingIoWriter(writer io.Writer, scrubDict ScrubbingDict) io.Writer
- func NewScrubbingWriter(writer zerolog.LevelWriter, scrubDict ScrubbingDict) zerolog.LevelWriter
- func RedactStaticTerm(s, term, replacement string) string
- func Scrub(data []byte, scrubDict ScrubbingDict) []byte
- func ScrubValue(data []byte, scrubDict ScrubbingDict) []byte
- type ScrubbingDict
- type ScrubbingLogWriter
Constants ¶
const MAX_WRITE_RETRIES = 10
const REDACTION_TERMS string = "internal_redaction_terms"
REDACTION_TERMS ([]string) arbitrary literal terms to redact from analytics/log output, in addition to the token/OAuth-derived terms GetScrubDictFromConfig already adds. Lives here rather than pkg/configuration since this package is its only reader, matching the precedent of local_workflows.ConfigurationNewAuthenticationToken.
const SANITIZE_REPLACEMENT_STRING string = "***"
Variables ¶
var SENSITIVE_FIELD_NAMES = []string{
"headers",
"user",
"passw",
"token",
"key",
"secret",
}
SENSITIVE_FIELD_NAMES is a list of field names that should be sanitized.
Functions ¶
func NewScrubbingIoWriter ¶
func NewScrubbingIoWriter(writer io.Writer, scrubDict ScrubbingDict) io.Writer
func NewScrubbingWriter ¶
func NewScrubbingWriter(writer zerolog.LevelWriter, scrubDict ScrubbingDict) zerolog.LevelWriter
func RedactStaticTerm ¶ added in v0.18.2
RedactStaticTerm replaces every occurrence of term in s with replacement, quoting the replacement when term sits in a bare (unquoted) JSON value position, and leaving an occurrence untouched when it's only a token-fused slice of a larger bare number/true/false/null.
term has no regex capture to bound it, so only the characters immediately around each match are checked. A term preceded by `:`, `,` or `[` and followed by `,`, `}` or `]` — or with no boundary character on *either* side, i.e. term is the whole document — is a bare value (number/bool/null); an unquoted replacement there is invalid JSON (see CLI-1732), so the replacement gets quoted instead. A term missing the boundary character on only one side is an ambiguous fragment and is left bare rather than guessed at. A term already inside a quoted string is also left bare, and never treated as token-fused.
A numeric term can also land mid-number in a bare position (e.g. redacting "1000" out of an unrelated "durationMs":10001234), and a term like "rue" can land mid-keyword (inside "true") — in both cases it's a slice of a larger bare token, and no amount of quoting keeps that valid, so the occurrence is left alone rather than corrupting the token.
Exported for reuse by pkg/analytics's SanitizeStaticValues, which has the same corruption risk.
func Scrub ¶ added in v0.15.1
func Scrub(data []byte, scrubDict ScrubbingDict) []byte
Scrub applies scrubDict's redaction rules to data. JSON-value quoting and digit-fusion protection apply only when data is itself valid JSON; the caller's intent doesn't override what data actually is (see internalWrite). Use ScrubValue for a value already known to be a bare, non-JSON leaf.
func ScrubValue ¶ added in v0.18.2
func ScrubValue(data []byte, scrubDict ScrubbingDict) []byte
ScrubValue applies scrubDict's redaction rules to a value that is not itself JSON-structured, e.g. a leaf string that a later json.Marshal will quote. Skips Scrub's JSON-value quoting and digit-fusion protections, which would otherwise stray-quote or under-redact plain text.
Types ¶
type ScrubbingDict ¶
type ScrubbingDict map[string]scrubStruct
func GetScrubDictFromConfig ¶
func GetScrubDictFromConfig(config configuration.Configuration) ScrubbingDict
Source Files