Merge pull request #8066 from backstage/freben/do-not-redact-empty-strings

Do not redact empty/one-character secrets

.changeset/spicy-rice-build.md

@@ -0,0 +1,5 @@
+---
+'@backstage/backend-common': patch
+---
+
+Do not redact empty or one-character strings. These imply that it's just a test or local dev, and unnecessarily ruin the log output.

packages/backend-common/src/logging/rootLogger.test.ts

@@ -48,6 +48,19 @@ describe('rootLogger', () => {
     );
   });
 
+  it('redacts but ignores empty and one-character secrets', () => {
+    const logger = createRootLogger();
+    jest.spyOn(logger, 'write');
+    setRootLoggerRedactionList(['SECRET-1', 'SECRET_2', 'Q', '']);
+    logger.info('Logging SECRET-1 and SECRET_2 and Q');
+
+    expect(logger.write).toHaveBeenCalledWith(
+      expect.objectContaining({
+        message: 'Logging [REDACTED] and [REDACTED] and Q',
+      }),
+    );
+  });
+
   describe('createRootLogger', () => {
     it('creates a new logger', () => {
       const oldLogger = getRootLogger();

packages/backend-common/src/logging/rootLogger.ts

@@ -21,7 +21,7 @@ import { coloredFormat } from './formats';
 import { escapeRegExp } from '../util/escapeRegExp';
 
 let rootLogger: winston.Logger;
-let redactionRegExp: RegExp;
+let redactionRegExp: RegExp | undefined;
 
 /** @public */
 export function getRootLogger(): winston.Logger {
@@ -34,11 +34,18 @@ export function setRootLogger(newLogger: winston.Logger) {
 }
 
 export function setRootLoggerRedactionList(redactionList: string[]) {
-  if (redactionList.length) {
+  // Exclude secrets that are empty or just one character in length. These
+  // typically mean that you are running local dev or tests, or using the
+  // --lax flag which sets things to just 'x'. So exclude those.
+  const filtered = redactionList.filter(r => r.length > 1);
+
+  if (filtered.length) {
     redactionRegExp = new RegExp(
-      `(${redactionList.map(escapeRegExp).join('|')})`,
+      `(${filtered.map(escapeRegExp).join('|')})`,
       'g',
     );
+  } else {
+    redactionRegExp = undefined;
   }
 }