From 960a311375875fa6334102cd2b239ec08fd52cf2 Mon Sep 17 00:00:00 2001 From: Frank Kong Date: Thu, 23 Nov 2023 21:50:07 -0500 Subject: [PATCH 1/2] chore(backend-app-api): added redacting of secrets for stack traces that appear in logs Signed-off-by: Frank Kong --- .../src/logging/WinstonLogger.test.ts | 32 +++++++++++++------ .../src/logging/WinstonLogger.ts | 3 ++ 2 files changed, 25 insertions(+), 10 deletions(-) diff --git a/packages/backend-app-api/src/logging/WinstonLogger.test.ts b/packages/backend-app-api/src/logging/WinstonLogger.test.ts index 5d8cfc9c90..e05e47ee1d 100644 --- a/packages/backend-app-api/src/logging/WinstonLogger.test.ts +++ b/packages/backend-app-api/src/logging/WinstonLogger.test.ts @@ -14,25 +14,37 @@ * limitations under the License. */ +import { TransformableInfo } from 'logform'; import { WinstonLogger } from './WinstonLogger'; -function msg(message: string) { - return { message, level: 'info' }; +function msg(info: TransformableInfo): TransformableInfo { + return { message: info.message, level: info.level, stack: info.stack }; } describe('WinstonLogger', () => { it('redacter should redact and escape regex', () => { const redacter = WinstonLogger.redacter(); - expect(redacter.format.transform(msg('hello (world)'))).toEqual( - msg('hello (world)'), - ); + const log = { + level: 'error', + message: 'hello (world)', + stack: 'hello (world) from this file', + }; + expect(redacter.format.transform(msg(log))).toEqual(msg(log)); redacter.add(['hello']); - expect(redacter.format.transform(msg('hello (world)'))).toEqual( - msg('[REDACTED] (world)'), + expect(redacter.format.transform(msg(log))).toEqual( + msg({ + ...log, + message: '[REDACTED] (world)', + stack: '[REDACTED] (world) from this file', + }), ); - redacter.add(['(world)']); - expect(redacter.format.transform(msg('hello (world)'))).toEqual( - msg('[REDACTED] [REDACTED]'), + redacter.add(['(world']); + expect(redacter.format.transform(msg(log))).toEqual( + msg({ + ...log, + message: '[REDACTED] [REDACTED])', + stack: '[REDACTED] [REDACTED]) from this file', + }), ); }); }); diff --git a/packages/backend-app-api/src/logging/WinstonLogger.ts b/packages/backend-app-api/src/logging/WinstonLogger.ts index 06a189508b..bfceb5b2f2 100644 --- a/packages/backend-app-api/src/logging/WinstonLogger.ts +++ b/packages/backend-app-api/src/logging/WinstonLogger.ts @@ -82,6 +82,9 @@ export class WinstonLogger implements RootLoggerService { if (redactionPattern && typeof info.message === 'string') { info.message = info.message.replace(redactionPattern, '[REDACTED]'); } + if (redactionPattern && typeof info.stack === 'string') { + info.stack = info.stack.replace(redactionPattern, '[REDACTED]'); + } return info; })(), add(newRedactions) { From 9f8f266ff44ded625a9ca237b8a70b409a6e7517 Mon Sep 17 00:00:00 2001 From: Frank Kong Date: Thu, 23 Nov 2023 21:56:41 -0500 Subject: [PATCH 2/2] chore: add changeset Signed-off-by: Frank Kong --- .changeset/khaki-clocks-happen.md | 5 +++++ 1 file changed, 5 insertions(+) create mode 100644 .changeset/khaki-clocks-happen.md diff --git a/.changeset/khaki-clocks-happen.md b/.changeset/khaki-clocks-happen.md new file mode 100644 index 0000000000..ac20e42dfa --- /dev/null +++ b/.changeset/khaki-clocks-happen.md @@ -0,0 +1,5 @@ +--- +'@backstage/backend-app-api': patch +--- + +Add redacting for secrets in stack traces of logs