| | | 1 | | using System.Text.Json; |
| | | 2 | | using System.Text.RegularExpressions; |
| | | 3 | | |
| | | 4 | | namespace OzonOrdersWeb.Observability; |
| | | 5 | | |
| | | 6 | | public sealed partial class SensitiveDataRedactor |
| | | 7 | | { |
| | | 8 | | private const string Redacted = "[REDACTED]"; |
| | 1 | 9 | | private static readonly string[] SensitiveNames = |
| | 1 | 10 | | [ |
| | 1 | 11 | | "password", "passwd", "pass", "pwd", "token", "access_token", "refresh_token", |
| | 1 | 12 | | "authorization", "cookie", "secret", "clientsecret", "client_secret", |
| | 1 | 13 | | "apikey", "api_key", "privatekey", "private_key", "connectionstring" |
| | 1 | 14 | | ]; |
| | | 15 | | |
| | | 16 | | public string Redact(string? value, int maxCharacters) |
| | | 17 | | { |
| | 438 | 18 | | if (string.IsNullOrWhiteSpace(value)) |
| | | 19 | | { |
| | 201 | 20 | | return string.Empty; |
| | | 21 | | } |
| | | 22 | | |
| | 237 | 23 | | var redacted = TryRedactJson(value) ?? RedactText(value); |
| | 237 | 24 | | return redacted.Length <= maxCharacters |
| | 237 | 25 | | ? redacted |
| | 237 | 26 | | : string.Concat(redacted.AsSpan(0, maxCharacters), "…[TRUNCATED]"); |
| | | 27 | | } |
| | | 28 | | |
| | | 29 | | public string RedactUri(Uri? uri, int maxCharacters) |
| | | 30 | | { |
| | 142 | 31 | | if (uri is null) |
| | | 32 | | { |
| | 0 | 33 | | return string.Empty; |
| | | 34 | | } |
| | | 35 | | |
| | 142 | 36 | | return Redact(uri.ToString(), maxCharacters); |
| | | 37 | | } |
| | | 38 | | |
| | | 39 | | private static string? TryRedactJson(string value) |
| | | 40 | | { |
| | | 41 | | try |
| | | 42 | | { |
| | 237 | 43 | | using var document = JsonDocument.Parse(value); |
| | 1 | 44 | | using var stream = new MemoryStream(); |
| | 1 | 45 | | using var writer = new Utf8JsonWriter(stream); |
| | 1 | 46 | | WriteElement(writer, document.RootElement, null); |
| | 1 | 47 | | writer.Flush(); |
| | 1 | 48 | | return System.Text.Encoding.UTF8.GetString(stream.ToArray()); |
| | | 49 | | } |
| | 236 | 50 | | catch (JsonException) |
| | | 51 | | { |
| | 236 | 52 | | return null; |
| | | 53 | | } |
| | 237 | 54 | | } |
| | | 55 | | |
| | | 56 | | private static void WriteElement(Utf8JsonWriter writer, JsonElement element, string? propertyName) |
| | | 57 | | { |
| | 5 | 58 | | if (propertyName is not null && IsSensitive(propertyName)) |
| | | 59 | | { |
| | 2 | 60 | | writer.WriteStringValue(Redacted); |
| | 2 | 61 | | return; |
| | | 62 | | } |
| | | 63 | | |
| | 3 | 64 | | switch (element.ValueKind) |
| | | 65 | | { |
| | | 66 | | case JsonValueKind.Object: |
| | 2 | 67 | | writer.WriteStartObject(); |
| | 12 | 68 | | foreach (var property in element.EnumerateObject()) |
| | | 69 | | { |
| | 4 | 70 | | writer.WritePropertyName(property.Name); |
| | 4 | 71 | | WriteElement(writer, property.Value, property.Name); |
| | | 72 | | } |
| | 2 | 73 | | writer.WriteEndObject(); |
| | 2 | 74 | | break; |
| | | 75 | | case JsonValueKind.Array: |
| | 0 | 76 | | writer.WriteStartArray(); |
| | 0 | 77 | | foreach (var item in element.EnumerateArray()) |
| | | 78 | | { |
| | 0 | 79 | | WriteElement(writer, item, null); |
| | | 80 | | } |
| | 0 | 81 | | writer.WriteEndArray(); |
| | 0 | 82 | | break; |
| | | 83 | | default: |
| | 1 | 84 | | element.WriteTo(writer); |
| | | 85 | | break; |
| | | 86 | | } |
| | 1 | 87 | | } |
| | | 88 | | |
| | | 89 | | private static string RedactText(string value) |
| | | 90 | | { |
| | 236 | 91 | | var result = AuthorizationRegex().Replace(value, "$1[REDACTED]"); |
| | 236 | 92 | | result = EmbeddedJsonSecretRegex().Replace(result, "$1\"[REDACTED]\""); |
| | 236 | 93 | | result = XmlSecretRegex().Replace(result, "$1[REDACTED]$2"); |
| | 245 | 94 | | result = SecretPairRegex().Replace(result, match => $"{match.Groups[1].Value}{Redacted}"); |
| | 236 | 95 | | result = ConnectionPasswordRegex().Replace(result, "$1[REDACTED]"); |
| | 236 | 96 | | result = TokenLiteralRegex().Replace(result, Redacted); |
| | 236 | 97 | | result = PrivateKeyRegex().Replace(result, "[REDACTED PRIVATE KEY]"); |
| | 236 | 98 | | return result; |
| | | 99 | | } |
| | | 100 | | |
| | | 101 | | private static bool IsSensitive(string name) => |
| | 44 | 102 | | SensitiveNames.Any(sensitive => name.Contains(sensitive, StringComparison.OrdinalIgnoreCase)); |
| | | 103 | | |
| | | 104 | | [GeneratedRegex("(?i)((?:password|passwd|pass|pwd|token|secret|api[_-]?key|client[_-]?secret|authorization|cookie|pr |
| | | 105 | | private static partial Regex SecretPairRegex(); |
| | | 106 | | |
| | | 107 | | [GeneratedRegex("(?i)(Authorization\\s*:\\s*)(?:Bearer|Basic)\\s+[^\\s,;]+")] |
| | | 108 | | private static partial Regex AuthorizationRegex(); |
| | | 109 | | |
| | | 110 | | [GeneratedRegex("(?i)(Password\\s*=\\s*)[^;]+")] |
| | | 111 | | private static partial Regex ConnectionPasswordRegex(); |
| | | 112 | | |
| | | 113 | | [GeneratedRegex("(?i)(\"(?:password|passwd|pass|pwd|token|secret|api[_-]?key|client[_-]?secret|authorization|cookie| |
| | | 114 | | private static partial Regex EmbeddedJsonSecretRegex(); |
| | | 115 | | |
| | | 116 | | [GeneratedRegex("(<(?:password|passwd|pass|pwd|token|secret|api[_-]?key)[^>]*>).*?(</[^>]+>)", RegexOptions.IgnoreCa |
| | | 117 | | private static partial Regex XmlSecretRegex(); |
| | | 118 | | |
| | | 119 | | [GeneratedRegex("\\b(?:github_pat_|gh[pousr]_)[A-Za-z0-9_]{20,}\\b")] |
| | | 120 | | private static partial Regex TokenLiteralRegex(); |
| | | 121 | | |
| | | 122 | | [GeneratedRegex("-----BEGIN [A-Z ]*PRIVATE KEY-----.*?-----END [A-Z ]*PRIVATE KEY-----", RegexOptions.Singleline)] |
| | | 123 | | private static partial Regex PrivateKeyRegex(); |
| | | 124 | | } |