chore: safer way to do redactions

Signed-off-by: blam <ben@blam.sh>

.changeset/nine-ties-type.md

@@ -0,0 +1,6 @@
+---
+'@backstage/plugin-scaffolder-backend': patch
+'@backstage/backend-app-api': patch
+---
+
+Fixing issue with log meta fields possibly being circular refs

packages/backend-app-api/package.json

@@ -72,6 +72,7 @@
     "fs-extra": "^11.2.0",
     "helmet": "^6.0.0",
     "jose": "^5.0.0",
+    "json-stringify-safe": "^5.0.1",
     "knex": "^3.0.0",
     "lodash": "^4.17.21",
     "logform": "^2.3.2",
@@ -93,6 +94,7 @@
     "@types/compression": "^1.7.0",
     "@types/fs-extra": "^11.0.0",
     "@types/http-errors": "^2.0.0",
+    "@types/json-stringify-safe": "^5.0.3",
     "@types/minimist": "^1.2.0",
     "@types/morgan": "^1.9.0",
     "@types/node-forge": "^1.3.0",

packages/backend-app-api/src/logging/WinstonLogger.ts

@@ -27,6 +27,7 @@ import {
   transports,
   transport as Transport,
 } from 'winston';
+import stringify from 'json-stringify-safe';
 import { escapeRegExp } from '../lib/escapeRegExp';
 
 /**
@@ -86,9 +87,13 @@ export class WinstonLogger implements RootLoggerService {
     let redactionPattern: RegExp | undefined = undefined;
 
     const replace = (obj: TransformableInfo) => {
-      const stringifiedFields = JSON.stringify(obj, null);
+      if (!redactionPattern) {
+        return obj;
+      }
+
+      const stringifiedFields = stringify(obj);
       const redacted = JSON.parse(
-        stringifiedFields.replace(redactionPattern!, '[REDACTED]'),
+        stringifiedFields.replace(redactionPattern, '[REDACTED]'),
       );
 
       for (const key in redacted) {

plugins/scaffolder-backend/package.json

@@ -85,6 +85,7 @@
     "globby": "^11.0.0",
     "isbinaryfile": "^5.0.0",
     "isolated-vm": "^4.5.0",
+    "json-stringify-safe": "^5.0.1",
     "jsonschema": "^1.2.6",
     "knex": "^3.0.0",
     "lodash": "^4.17.21",
@@ -107,6 +108,7 @@
     "@backstage/cli": "workspace:^",
     "@backstage/plugin-scaffolder-node-test-utils": "workspace:^",
     "@types/fs-extra": "^11.0.0",
+    "@types/json-stringify-safe": "^5.0.3",
     "@types/nunjucks": "^3.1.4",
     "@types/supertest": "^2.0.8",
     "@types/zen-observable": "^0.8.0",

plugins/scaffolder-backend/src/scaffolder/tasks/logger.ts

@@ -21,6 +21,7 @@ import { JsonObject } from '@backstage/types';
 import { Format, TransformableInfo } from 'logform';
 import Transport, { TransportStreamOptions } from 'winston-transport';
 import { Logger, format, createLogger, transports } from 'winston';
+import stringify from 'json-stringify-safe';
 
 /**
  * Escapes a given string to be used inside a RegExp.
@@ -108,15 +109,21 @@ export class WinstonLogger implements RootLoggerService {
     let redactionPattern: RegExp | undefined = undefined;
 
     const replace = (obj: TransformableInfo) => {
-      for (const key in obj) {
-        if (obj.hasOwnProperty(key)) {
-          if (typeof obj[key] === 'object') {
-            obj[key] = replace(obj[key] as TransformableInfo);
-          } else if (typeof obj[key] === 'string') {
-            obj[key] = obj[key]?.replace(redactionPattern, '[REDACTED]');
-          }
+      if (!redactionPattern) {
+        return obj;
+      }
+
+      const stringifiedFields = stringify(obj);
+      const redacted = JSON.parse(
+        stringifiedFields.replace(redactionPattern, '[REDACTED]'),
+      );
+
+      for (const key in redacted) {
+        if (obj && Object.hasOwn(obj, key)) {
+          obj[key] = redacted[key];
         }
       }
+
       return obj;
     };
     return {

yarn.lock

@@ -3304,6 +3304,7 @@ __metadata:
     "@types/express": ^4.17.6
     "@types/fs-extra": ^11.0.0
     "@types/http-errors": ^2.0.0
+    "@types/json-stringify-safe": ^5.0.3
     "@types/minimist": ^1.2.0
     "@types/morgan": ^1.9.0
     "@types/node-forge": ^1.3.0
@@ -3317,6 +3318,7 @@ __metadata:
     helmet: ^6.0.0
     http-errors: ^2.0.0
     jose: ^5.0.0
+    json-stringify-safe: ^5.0.1
     knex: ^3.0.0
     lodash: ^4.17.21
     logform: ^2.3.2
@@ -6661,6 +6663,7 @@ __metadata:
     "@backstage/types": "workspace:^"
     "@types/express": ^4.17.6
     "@types/fs-extra": ^11.0.0
+    "@types/json-stringify-safe": ^5.0.3
     "@types/luxon": ^3.0.0
     "@types/nunjucks": ^3.1.4
     "@types/supertest": ^2.0.8
@@ -6673,6 +6676,7 @@ __metadata:
     globby: ^11.0.0
     isbinaryfile: ^5.0.0
     isolated-vm: ^4.5.0
+    json-stringify-safe: ^5.0.1
     jsonschema: ^1.2.6
     knex: ^3.0.0
     lodash: ^4.17.21
@@ -17312,6 +17316,13 @@ __metadata:
   languageName: node
   linkType: hard
 
+"@types/json-stringify-safe@npm:^5.0.3":
+  version: 5.0.3
+  resolution: "@types/json-stringify-safe@npm:5.0.3"
+  checksum: 66826a59b53ce5a5becc9c05cd0bdadb7e2032e02803a9dd13137de134a0882a6c67ae334371ccff07a20b1d2b2c23fa3a81b5e23f40b27cfcf553c7cce06e35
+  languageName: node
+  linkType: hard
+
 "@types/json5@npm:^0.0.29":
   version: 0.0.29
   resolution: "@types/json5@npm:0.0.29"