Documentation
¶
Overview ¶
Package redact implements the field-name, content-scan, and argv scrubbing primitives that enforce S04 §Security Considerations: secret-bearing values must be replaced with the literal sentinel "[REDACTED]" before any log entry, failure-detail field, or captured argv element can reach a consumer.
Three primitives, one per input shape:
- RedactField redacts structured key-value pairs by name. Consumed by the slog handler (S04 §Library forbidden fields, §Field-name redaction) and the failure-detail renderer.
- ScanContent scans free-form text for the same pattern set and replaces the value portion of every match. Consumed by the failure-detail renderer (S04 §Content scanning, AC #74) and the CLI executor's captured-stream scrubber.
- RedactArgv scrubs an argv slice in place of the recognized secret-bearing flags and any URL userinfo. Consumed by the CLI executor before populating CLIDetail (S04 §Secret-bearing argv values, AC #51).
The five-pattern set is case-insensitive: password, token, secret, api[_-]?key, authorization. The replacement sentinel is the literal string "[REDACTED]".
Index ¶
Constants ¶
const Sentinel = "[REDACTED]"
Sentinel is the literal string substituted for redacted values. Centralized so renderers and tests share one constant.
Variables ¶
This section is empty.
Functions ¶
func RedactArgv ¶
RedactArgv returns a new argv slice with the values following any of --password, --auth, or --token — plus any driver-specific flag names passed in driverSecretFlags — replaced by Sentinel, in both the separate-argument form (--token value) and the inline form (--token=value). URL userinfo embedded in any argv element (https://user:pass@host) is also redacted (AC #51).
driverSecretFlags carries the "driver-specific equivalents declared by the implementation" that S04 §Secret-bearing argv values requires the executor to scrub (cliexec's WithSecretFlags). It is optional: the built-in three (--password, --auth, --token) are always redacted, and when no extras are supplied only those built-ins are redacted.
The input slice is not modified.
func RedactField ¶
RedactField reports whether the given field name matches the secret-bearing pattern set. If it does, RedactField returns (Sentinel, true); otherwise it returns (value, false).
The match is case-insensitive substring against the five patterns: so db_password, MY_AUTH_TOKEN, apiKey, and api-key all redact. This is the field-name layer; structural name match is independent of whether the value happens to look like a secret.
func RedactURLUserinfo ¶
RedactURLUserinfo returns s with the userinfo segment of every scheme://userinfo@host occurrence replaced by Sentinel, leaving the scheme, host, path, and query intact. Userinfo carries no keyword, so ScanContent (which keys on the five patterns) cannot catch it; a free- form text or captured stream that echoes a credentialed URL needs this dedicated pass. RedactArgv applies the same redaction to argv elements, and the CLI executor applies it to captured streams, so URL credentials are scrubbed from both regardless of how many appear (S04 §Output capture / §Secret-bearing argv values).
func ScanContent ¶
ScanContent returns s with every secret-bearing match replaced by Sentinel. A match is one of the five patterns (case-insensitive) followed by one of the separators ":", "=", or whitespace, with the value portion up to the next newline replaced (AC #74).
Substrings that contain a pattern but lack a separator (for example "passwordless: true" or a bare "tokenize") do not match.
Types ¶
This section is empty.
Source Files