Class: Aireview::SecretScrubber

Inherits:
Object
  • Object
show all
Defined in:
lib/aireview/secret_scrubber.rb

Constant Summary collapse

REDACTED = 
'[REDACTED]'
BUILTIN_RULES = 
[
  [/-----BEGIN [A-Z ]*PRIVATE KEY-----.*?-----END [A-Z ]*PRIVATE KEY-----/m, REDACTED],
  [/\bAKIA[0-9A-Z]{16}\b/, REDACTED],
  [/\bsk-(?:proj-|ant-)?[A-Za-z0-9_-]{20,}\b/, REDACTED],
  [/\b(?:gh[ps]|glpat)_[A-Za-z0-9_-]{20,}\b/, REDACTED],
  [/(Authorization:\s*Bearer\s+)[A-Za-z0-9._-]+/i, '\1[REDACTED]'],
  [/(Bearer\s+)[A-Za-z0-9._-]{20,}/i, '\1[REDACTED]'],
  [/(\baws_secret_access_key\b\s*[:=]\s*["']?)[A-Za-z0-9\/+=]{20,}(["']?)/i, '\1[REDACTED]\2'],
  [/(\b(?:api[_-]?key|token|secret|password|passwd|client_secret)\w*\s*[:=]\s*["']?)[^"'\s]+(["']?)/i,
   '\1[REDACTED]\2'],
  [/(x-api-key:\s*)[A-Za-z0-9._-]+/i, '\1[REDACTED]']
].freeze

Instance Method Summary collapse

Constructor Details

#initialize(secret_patterns:, secret_files:, logger: Logger.new($stderr)) ⇒ SecretScrubber

Returns a new instance of SecretScrubber.



21
22
23
24
25
 
# File 'lib/aireview/secret_scrubber.rb', line 21

def initialize(secret_patterns:, secret_files:, logger: Logger.new($stderr))
  @logger = logger
  @secret_files = Array(secret_files).compact
  @custom_rules = compile_patterns(secret_patterns)
end

Instance Method Details

#scrub_change(change) ⇒ Object 



31
32
33
34
35
36
37
38
39
40
41
42
43
 
# File 'lib/aireview/secret_scrubber.rb', line 31

def scrub_change(change)
  path = change['new_path'] || change['old_path']
  scrubbed = change.dup

  scrubbed['diff'] =
    if secret_file?(path)
      "[REDACTED: secret file #{path}]"
    else
      scrub_text(change['diff'].to_s)
    end

  scrubbed
end

#scrub_changes(changes) ⇒ Object 



27
28
29
 
# File 'lib/aireview/secret_scrubber.rb', line 27

def scrub_changes(changes)
  Array(changes).map { |change| scrub_change(change) }
end

#scrub_text(text) ⇒ Object 



45
46
47
48
49
 
# File 'lib/aireview/secret_scrubber.rb', line 45

def scrub_text(text)
  (BUILTIN_RULES + @custom_rules).reduce(text.to_s) do |memo, (pattern, replacement)|
    memo.gsub(pattern, replacement)
  end
end