From 7d30d95dee0174a8345883ad59704b60fadb2cd8 Mon Sep 17 00:00:00 2001 From: blam Date: Wed, 15 May 2024 15:03:13 +0200 Subject: [PATCH] chore: safer way to do redactions Signed-off-by: blam --- .changeset/nine-ties-type.md | 6 ++++++ packages/backend-app-api/package.json | 2 ++ .../src/logging/WinstonLogger.ts | 9 ++++++-- plugins/scaffolder-backend/package.json | 2 ++ .../src/scaffolder/tasks/logger.ts | 21 ++++++++++++------- yarn.lock | 11 ++++++++++ 6 files changed, 42 insertions(+), 9 deletions(-) create mode 100644 .changeset/nine-ties-type.md diff --git a/.changeset/nine-ties-type.md b/.changeset/nine-ties-type.md new file mode 100644 index 0000000000..abb0661724 --- /dev/null +++ b/.changeset/nine-ties-type.md @@ -0,0 +1,6 @@ +--- +'@backstage/plugin-scaffolder-backend': patch +'@backstage/backend-app-api': patch +--- + +Fixing issue with log meta fields possibly being circular refs diff --git a/packages/backend-app-api/package.json b/packages/backend-app-api/package.json index 0634c30de1..b5fe3a1271 100644 --- a/packages/backend-app-api/package.json +++ b/packages/backend-app-api/package.json @@ -72,6 +72,7 @@ "fs-extra": "^11.2.0", "helmet": "^6.0.0", "jose": "^5.0.0", + "json-stringify-safe": "^5.0.1", "knex": "^3.0.0", "lodash": "^4.17.21", "logform": "^2.3.2", @@ -93,6 +94,7 @@ "@types/compression": "^1.7.0", "@types/fs-extra": "^11.0.0", "@types/http-errors": "^2.0.0", + "@types/json-stringify-safe": "^5.0.3", "@types/minimist": "^1.2.0", "@types/morgan": "^1.9.0", "@types/node-forge": "^1.3.0", diff --git a/packages/backend-app-api/src/logging/WinstonLogger.ts b/packages/backend-app-api/src/logging/WinstonLogger.ts index cb9d81cdf1..42c181573c 100644 --- a/packages/backend-app-api/src/logging/WinstonLogger.ts +++ b/packages/backend-app-api/src/logging/WinstonLogger.ts @@ -27,6 +27,7 @@ import { transports, transport as Transport, } from 'winston'; +import stringify from 'json-stringify-safe'; import { escapeRegExp } from '../lib/escapeRegExp'; /** @@ -86,9 +87,13 @@ export class WinstonLogger implements RootLoggerService { let redactionPattern: RegExp | undefined = undefined; const replace = (obj: TransformableInfo) => { - const stringifiedFields = JSON.stringify(obj, null); + if (!redactionPattern) { + return obj; + } + + const stringifiedFields = stringify(obj); const redacted = JSON.parse( - stringifiedFields.replace(redactionPattern!, '[REDACTED]'), + stringifiedFields.replace(redactionPattern, '[REDACTED]'), ); for (const key in redacted) { diff --git a/plugins/scaffolder-backend/package.json b/plugins/scaffolder-backend/package.json index f2f4da6a84..877163a151 100644 --- a/plugins/scaffolder-backend/package.json +++ b/plugins/scaffolder-backend/package.json @@ -85,6 +85,7 @@ "globby": "^11.0.0", "isbinaryfile": "^5.0.0", "isolated-vm": "^4.5.0", + "json-stringify-safe": "^5.0.1", "jsonschema": "^1.2.6", "knex": "^3.0.0", "lodash": "^4.17.21", @@ -107,6 +108,7 @@ "@backstage/cli": "workspace:^", "@backstage/plugin-scaffolder-node-test-utils": "workspace:^", "@types/fs-extra": "^11.0.0", + "@types/json-stringify-safe": "^5.0.3", "@types/nunjucks": "^3.1.4", "@types/supertest": "^2.0.8", "@types/zen-observable": "^0.8.0", diff --git a/plugins/scaffolder-backend/src/scaffolder/tasks/logger.ts b/plugins/scaffolder-backend/src/scaffolder/tasks/logger.ts index 064eb69349..01f454a6ff 100644 --- a/plugins/scaffolder-backend/src/scaffolder/tasks/logger.ts +++ b/plugins/scaffolder-backend/src/scaffolder/tasks/logger.ts @@ -21,6 +21,7 @@ import { JsonObject } from '@backstage/types'; import { Format, TransformableInfo } from 'logform'; import Transport, { TransportStreamOptions } from 'winston-transport'; import { Logger, format, createLogger, transports } from 'winston'; +import stringify from 'json-stringify-safe'; /** * Escapes a given string to be used inside a RegExp. @@ -108,15 +109,21 @@ export class WinstonLogger implements RootLoggerService { let redactionPattern: RegExp | undefined = undefined; const replace = (obj: TransformableInfo) => { - for (const key in obj) { - if (obj.hasOwnProperty(key)) { - if (typeof obj[key] === 'object') { - obj[key] = replace(obj[key] as TransformableInfo); - } else if (typeof obj[key] === 'string') { - obj[key] = obj[key]?.replace(redactionPattern, '[REDACTED]'); - } + if (!redactionPattern) { + return obj; + } + + const stringifiedFields = stringify(obj); + const redacted = JSON.parse( + stringifiedFields.replace(redactionPattern, '[REDACTED]'), + ); + + for (const key in redacted) { + if (obj && Object.hasOwn(obj, key)) { + obj[key] = redacted[key]; } } + return obj; }; return { diff --git a/yarn.lock b/yarn.lock index f10de89d74..eccfdd3eb5 100644 --- a/yarn.lock +++ b/yarn.lock @@ -3304,6 +3304,7 @@ __metadata: "@types/express": ^4.17.6 "@types/fs-extra": ^11.0.0 "@types/http-errors": ^2.0.0 + "@types/json-stringify-safe": ^5.0.3 "@types/minimist": ^1.2.0 "@types/morgan": ^1.9.0 "@types/node-forge": ^1.3.0 @@ -3317,6 +3318,7 @@ __metadata: helmet: ^6.0.0 http-errors: ^2.0.0 jose: ^5.0.0 + json-stringify-safe: ^5.0.1 knex: ^3.0.0 lodash: ^4.17.21 logform: ^2.3.2 @@ -6661,6 +6663,7 @@ __metadata: "@backstage/types": "workspace:^" "@types/express": ^4.17.6 "@types/fs-extra": ^11.0.0 + "@types/json-stringify-safe": ^5.0.3 "@types/luxon": ^3.0.0 "@types/nunjucks": ^3.1.4 "@types/supertest": ^2.0.8 @@ -6673,6 +6676,7 @@ __metadata: globby: ^11.0.0 isbinaryfile: ^5.0.0 isolated-vm: ^4.5.0 + json-stringify-safe: ^5.0.1 jsonschema: ^1.2.6 knex: ^3.0.0 lodash: ^4.17.21 @@ -17312,6 +17316,13 @@ __metadata: languageName: node linkType: hard +"@types/json-stringify-safe@npm:^5.0.3": + version: 5.0.3 + resolution: "@types/json-stringify-safe@npm:5.0.3" + checksum: 66826a59b53ce5a5becc9c05cd0bdadb7e2032e02803a9dd13137de134a0882a6c67ae334371ccff07a20b1d2b2c23fa3a81b5e23f40b27cfcf553c7cce06e35 + languageName: node + linkType: hard + "@types/json5@npm:^0.0.29": version: 0.0.29 resolution: "@types/json5@npm:0.0.29"