Merge pull request #21521 from Zaperex/update-redacter

chore(backend-app-api): added redacting of secrets for stack traces that appear in logs

.changeset/khaki-clocks-happen.md

@@ -0,0 +1,5 @@
+---
+'@backstage/backend-app-api': patch
+---
+
+Add redacting for secrets in stack traces of logs

packages/backend-app-api/src/logging/WinstonLogger.test.ts

@@ -14,25 +14,37 @@
  * limitations under the License.
  */
 
+import { TransformableInfo } from 'logform';
 import { WinstonLogger } from './WinstonLogger';
 
-function msg(message: string) {
-  return { message, level: 'info' };
+function msg(info: TransformableInfo): TransformableInfo {
+  return { message: info.message, level: info.level, stack: info.stack };
 }
 
 describe('WinstonLogger', () => {
   it('redacter should redact and escape regex', () => {
     const redacter = WinstonLogger.redacter();
-    expect(redacter.format.transform(msg('hello (world)'))).toEqual(
-      msg('hello (world)'),
-    );
+    const log = {
+      level: 'error',
+      message: 'hello (world)',
+      stack: 'hello (world) from this file',
+    };
+    expect(redacter.format.transform(msg(log))).toEqual(msg(log));
     redacter.add(['hello']);
-    expect(redacter.format.transform(msg('hello (world)'))).toEqual(
-      msg('[REDACTED] (world)'),
+    expect(redacter.format.transform(msg(log))).toEqual(
+      msg({
+        ...log,
+        message: '[REDACTED] (world)',
+        stack: '[REDACTED] (world) from this file',
+      }),
     );
-    redacter.add(['(world)']);
-    expect(redacter.format.transform(msg('hello (world)'))).toEqual(
-      msg('[REDACTED] [REDACTED]'),
+    redacter.add(['(world']);
+    expect(redacter.format.transform(msg(log))).toEqual(
+      msg({
+        ...log,
+        message: '[REDACTED] [REDACTED])',
+        stack: '[REDACTED] [REDACTED]) from this file',
+      }),
     );
   });
 });

packages/backend-app-api/src/logging/WinstonLogger.ts

@@ -82,6 +82,9 @@ export class WinstonLogger implements RootLoggerService {
         if (redactionPattern && typeof info.message === 'string') {
           info.message = info.message.replace(redactionPattern, '[REDACTED]');
         }
+        if (redactionPattern && typeof info.stack === 'string') {
+          info.stack = info.stack.replace(redactionPattern, '[REDACTED]');
+        }
         return info;
       })(),
       add(newRedactions) {