@lumigo/node-core - npm Package Compare versions

Comparing version 1.13.0 to 1.13.1

lib/common/httpUtils.d.ts

 import { HttpRawRequest, HttpRawResponse, RequestRawData } from '../types/spans';
-export declare const keyToOmitRegexes: () => RegExp[];
+import { ScrubContext } from './secrets';
+/**
+ * @deprecated Pass a `ScrubContext` instance to `scrub` or `payloadStringify`
+ */
+export declare const keyToOmitRegexes: (regexesEnvVarName?: string) => RegExp[];
 export declare const prune: (str: string | object, maxLength: number) => string;
-export declare const payloadStringify: (payload: any, maxPayloadSize?: number, skipScrubPath?: any, truncated?: boolean) => string;
-export declare function scrub(payload: any, headers: any, sizeLimit: number, truncated?: boolean): string;
-export declare function scrubRequestDataPayload(requestData: HttpRawRequest | HttpRawResponse): string;
+export declare const payloadStringify: (payload: any, maxPayloadSize?: number, skipScrubPath?: any, truncated?: boolean, scrubContext?: ScrubContext) => string;
+export declare function scrub(payload: any, headers: any, sizeLimit: number, truncated?: boolean, scrubContext?: ScrubContext.HTTP_REQUEST_BODY | ScrubContext.HTTP_RESPONSE_BODY): string;
+export declare function scrubRequestDataPayload(requestData: HttpRawRequest | HttpRawResponse, scrubContext?: ScrubContext.HTTP_REQUEST_BODY | ScrubContext.HTTP_RESPONSE_BODY): string;
 export declare const spanHasErrors: (requestRawData: RequestRawData) => boolean;
 export declare const decodeHttpBody: (httpBody: any, hasError: boolean) => any | string;

lib/common/httpUtils.js

@@ -7,4 +7,5 @@ "use strict";
 const logger_1 = require("../logger");
-const untrancateJson_1 = require("../tools/untrancateJson");
+const untruncateJson_1 = require("../tools/untruncateJson");
 const utf8Utils_1 = require("./utf8Utils");
+const secrets_1 = require("./secrets");
 const nativeTypes = ['string', 'bigint', 'number', 'undefined', 'boolean'];
@@ -29,3 +30,6 @@ const SCRUBBED_TEXT = '****';
 };
-const keyToOmitRegexes = () => {
+/**
+ * @deprecated Pass a `ScrubContext` instance to `scrub` or `payloadStringify`
+ */
+const keyToOmitRegexes = (regexesEnvVarName = utils_1.LUMIGO_SECRET_MASKING_REGEX) => {
     return keyToRegexes();
@@ -71,6 +75,37 @@ };
 }, 'Failed to find items to skip scrubbing', (0, logger_1.getLogger)().LOG_LEVELS.WARNING, []);
-const payloadStringify = (payload, maxPayloadSize = (0, utils_1.getEventEntitySize)(), skipScrubPath = null, truncated = false) => {
+const payloadStringify = (payload, maxPayloadSize = (0, utils_1.getEventEntitySize)(), skipScrubPath = null, truncated = false, scrubContext = secrets_1.ScrubContext.DEFAULT) => {
     let totalSize = 0;
     const refsFound = [];
-    const secretsRegexes = (0, exports.keyToOmitRegexes)();
+    let secretScrubber;
+    switch (scrubContext) {
+        case secrets_1.ScrubContext.HTTP_REQUEST_BODY: {
+            secretScrubber = secrets_1.httpRequestBodiesSecretScrubber;
+            break;
+        }
+        case secrets_1.ScrubContext.HTTP_REQUEST_HEADERS: {
+            secretScrubber = secrets_1.httpRequestHeadersSecretScrubber;
+            break;
+        }
+        case secrets_1.ScrubContext.HTTP_REQUEST_QUERY: {
+            secretScrubber = secrets_1.httpQueryParamsSecretScrubber;
+            break;
+        }
+        case secrets_1.ScrubContext.HTTP_RESPONSE_BODY: {
+            secretScrubber = secrets_1.httpResponseBodiesSecretScrubber;
+            break;
+        }
+        case secrets_1.ScrubContext.HTTP_RESPONSE_HEADERS: {
+            secretScrubber = secrets_1.httpResponseHeadersSecretScrubber;
+            break;
+        }
+        case secrets_1.ScrubContext.PROCESS_ENVIRONMENT: {
+            secretScrubber = secrets_1.processEnvironmentSecretScrubber;
+            break;
+        }
+        default: {
+            secretScrubber = secrets_1.defaultSecretScrubber;
+            break;
+        }
+    }
+    const secretsRegexes = secretScrubber.expressions;
     const whitelistRegexes = whitelistKeysRegexes();
@@ -126,23 +161,29 @@ const secretItemsToSkipScrubbing = new Set(getItemsInPath(payload, skipScrubPath));
 };
-function scrub(payload, headers, sizeLimit, truncated = false) {
+function scrub(payload, headers, sizeLimit, truncated = false, scrubContext) {
     try {
         if (isJsonContent(payload, headers)) {
             if (truncated)
-                payload = (0, untrancateJson_1.default)(payload);
-            return (0, exports.payloadStringify)(JSON.parse(payload), sizeLimit, null, truncated);
+                payload = (0, untruncateJson_1.default)(payload);
+            return (0, exports.payloadStringify)(JSON.parse(payload), sizeLimit, null, truncated, scrubContext);
         }
         else {
-            return (0, exports.payloadStringify)(payload, sizeLimit, truncated);
+            return (0, exports.payloadStringify)(payload, sizeLimit, null, truncated, scrubContext);
         }
     }
     catch (e) {
-        return (0, exports.payloadStringify)(payload, sizeLimit, truncated);
+        return (0, exports.payloadStringify)(payload, sizeLimit, null, truncated, scrubContext);
     }
 }
 exports.scrub = scrub;
-function scrubRequestDataPayload(requestData) {
+function scrubRequestDataPayload(requestData, scrubContext) {
     const { truncated, headers, body: payload } = requestData;
     const isError = (0, exports.spanHasErrors)(requestData);
     const sizeLimit = (0, utils_1.getEventEntitySize)(isError);
-    return scrub((0, exports.decodeHttpBody)(payload, isError), headers, sizeLimit, truncated);
+    if (!scrubContext) {
+        // Best we can do in this case is to guess based on whether we have a statusCode (and hence it is a response).
+        scrubContext = requestData.statusCode
+            ? secrets_1.ScrubContext.HTTP_RESPONSE_BODY
+            : secrets_1.ScrubContext.HTTP_REQUEST_BODY;
+    }
+    return scrub((0, exports.decodeHttpBody)(payload, isError), headers, sizeLimit, truncated, scrubContext);
 }
@@ -149,0 +190,0 @@ exports.scrubRequestDataPayload = scrubRequestDataPayload;

lib/common/index.d.ts

 export * from './httpUtils';
 export * from './generalUtils';
 export * from './functionUtils';
+export { ScrubContext } from './secrets';
 export * from '../utils';

lib/common/index.js

@@ -17,6 +17,9 @@ "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.ScrubContext = void 0;
 __exportStar(require("./httpUtils"), exports);
 __exportStar(require("./generalUtils"), exports);
 __exportStar(require("./functionUtils"), exports);
+var secrets_1 = require("./secrets");
+Object.defineProperty(exports, "ScrubContext", { enumerable: true, get: function () { return secrets_1.ScrubContext; } });
 __exportStar(require("../utils"), exports);
 //# sourceMappingURL=index.js.map

lib/utils.d.ts

 export declare const LUMIGO_SECRET_MASKING_REGEX_BACKWARD_COMP = "LUMIGO_BLACKLIST_REGEX";
 export declare const LUMIGO_SECRET_MASKING_REGEX = "LUMIGO_SECRET_MASKING_REGEX";
+export declare const LUMIGO_SECRET_MASKING_REGEX_HTTP_REQUEST_BODIES = "LUMIGO_SECRET_MASKING_REGEX_HTTP_REQUEST_BODIES";
+export declare const LUMIGO_SECRET_MASKING_REGEX_HTTP_REQUEST_HEADERS = "LUMIGO_SECRET_MASKING_REGEX_HTTP_REQUEST_HEADERS";
+export declare const LUMIGO_SECRET_MASKING_REGEX_HTTP_RESPONSE_BODIES = "LUMIGO_SECRET_MASKING_REGEX_HTTP_RESPONSE_BODIES";
+export declare const LUMIGO_SECRET_MASKING_REGEX_HTTP_RESPONSE_HEADERS = "LUMIGO_SECRET_MASKING_REGEX_HTTP_RESPONSE_HEADERS";
+export declare const LUMIGO_SECRET_MASKING_REGEX_HTTP_QUERY_PARAMS = "LUMIGO_SECRET_MASKING_REGEX_HTTP_QUERY_PARAMS";
+export declare const LUMIGO_SECRET_MASKING_REGEX_ENVIRONMENT = "LUMIGO_SECRET_MASKING_REGEX_ENVIRONMENT";
+export declare const LUMIGO_SECRET_MASKING_ALL_MAGIC = "all";
 export declare const LUMIGO_WHITELIST_KEYS_REGEXES = "LUMIGO_WHITELIST_KEYS_REGEXES";
@@ -4,0 +11,0 @@ export declare const OMITTING_KEYS_REGEXES: string[];

lib/utils.js

 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.safeExecute = exports.parseJsonFromEnvVar = exports.getEventEntitySize = exports.LUMIGO_MAX_ENTRY_SIZE = exports.isWarm = exports.setWarm = exports.setDebug = exports.isDebug = exports.setStoreLogsOn = exports.isStoreLogs = exports.isString = exports.OMITTING_KEYS_REGEXES = exports.LUMIGO_WHITELIST_KEYS_REGEXES = exports.LUMIGO_SECRET_MASKING_REGEX = exports.LUMIGO_SECRET_MASKING_REGEX_BACKWARD_COMP = void 0;
+exports.safeExecute = exports.parseJsonFromEnvVar = exports.getEventEntitySize = exports.LUMIGO_MAX_ENTRY_SIZE = exports.isWarm = exports.setWarm = exports.setDebug = exports.isDebug = exports.setStoreLogsOn = exports.isStoreLogs = exports.isString = exports.OMITTING_KEYS_REGEXES = exports.LUMIGO_WHITELIST_KEYS_REGEXES = exports.LUMIGO_SECRET_MASKING_ALL_MAGIC = exports.LUMIGO_SECRET_MASKING_REGEX_ENVIRONMENT = exports.LUMIGO_SECRET_MASKING_REGEX_HTTP_QUERY_PARAMS = exports.LUMIGO_SECRET_MASKING_REGEX_HTTP_RESPONSE_HEADERS = exports.LUMIGO_SECRET_MASKING_REGEX_HTTP_RESPONSE_BODIES = exports.LUMIGO_SECRET_MASKING_REGEX_HTTP_REQUEST_HEADERS = exports.LUMIGO_SECRET_MASKING_REGEX_HTTP_REQUEST_BODIES = exports.LUMIGO_SECRET_MASKING_REGEX = exports.LUMIGO_SECRET_MASKING_REGEX_BACKWARD_COMP = void 0;
 const logger_1 = require("./logger");
@@ -10,2 +10,9 @@ const DEBUG_FLAG = 'LUMIGO_DEBUG';
 exports.LUMIGO_SECRET_MASKING_REGEX = 'LUMIGO_SECRET_MASKING_REGEX';
+exports.LUMIGO_SECRET_MASKING_REGEX_HTTP_REQUEST_BODIES = 'LUMIGO_SECRET_MASKING_REGEX_HTTP_REQUEST_BODIES';
+exports.LUMIGO_SECRET_MASKING_REGEX_HTTP_REQUEST_HEADERS = 'LUMIGO_SECRET_MASKING_REGEX_HTTP_REQUEST_HEADERS';
+exports.LUMIGO_SECRET_MASKING_REGEX_HTTP_RESPONSE_BODIES = 'LUMIGO_SECRET_MASKING_REGEX_HTTP_RESPONSE_BODIES';
+exports.LUMIGO_SECRET_MASKING_REGEX_HTTP_RESPONSE_HEADERS = 'LUMIGO_SECRET_MASKING_REGEX_HTTP_RESPONSE_HEADERS';
+exports.LUMIGO_SECRET_MASKING_REGEX_HTTP_QUERY_PARAMS = 'LUMIGO_SECRET_MASKING_REGEX_HTTP_QUERY_PARAMS';
+exports.LUMIGO_SECRET_MASKING_REGEX_ENVIRONMENT = 'LUMIGO_SECRET_MASKING_REGEX_ENVIRONMENT';
+exports.LUMIGO_SECRET_MASKING_ALL_MAGIC = 'all';
 exports.LUMIGO_WHITELIST_KEYS_REGEXES = 'LUMIGO_WHITELIST_KEYS_REGEXES';
@@ -12,0 +19,0 @@ exports.OMITTING_KEYS_REGEXES = [

package.json

 {
   "name": "@lumigo/node-core",
-  "version": "1.13.0",
+  "version": "1.13.1",
   "description": "Lumigo core node sdk",
@@ -26,21 +26,21 @@ "main": "lib/index.js",
   "devDependencies": {
-    "@types/node": "^17.0.26",
-    "@types/aws-lambda": "^8.10.77",
+    "@babel/preset-env": "^7.4.4",
+    "@babel/preset-typescript": "^7.16.7",
     "@semantic-release/changelog": "^3.0.6",
     "@semantic-release/git": "^7.0.18",
     "@semantic-release/github": "^7.2.3",
+    "@types/aws-lambda": "^8.10.77",
     "@types/jest": "^26.0.23",
-    "eslint": "^7.29.0",
+    "@types/node": "^17.0.26",
+    "@types/utf8": "^3.0.0",
     "@typescript-eslint/eslint-plugin": "^4.28.1",
     "@typescript-eslint/parser": "^4.28.1",
+    "eslint": "^7.29.0",
     "eslint-config-prettier": "^8.3.0",
     "eslint-plugin-prettier": "^3.4.0",
-    "@babel/preset-env": "^7.4.4",
-    "@babel/preset-typescript": "^7.16.7",
-    "@types/utf8": "^3.0.0",
+    "jest": "^29.5.0",
     "prettier": "^2.3.1",
     "semantic-release": "^19.0.2",
-    "typescript": "^4.3.2",
-    "jest": "^27.0.4",
-    "ts-node": "^9.1.1"
+    "ts-node": "^9.1.1",
+    "typescript": "^4.3.2"
   },
@@ -47,0 +47,0 @@ "release": {

README.md

@@ -18,3 +18,3 @@ # node-core :stars:
 * `LUMIGO_DEBUG=TRUE` - Enables debug logging
-* `LUMIGO_SECRET_MASKING_REGEX='["regex1", "regex2"]'` - Prevents Lumigo from sending keys that match the supplied regular expressions. All regular expressions are case-insensitive. By default, Lumigo applies the following regular expressions: `[".*pass.*", ".*key.*", ".*secret.*", ".*credential.*", ".*passphrase.*", ".*token.*"]`.
+* `LUMIGO_SECRET_MASKING_REGEX='["regex1", "regex2"]'` - Prevents Lumigo from sending values for keys that match the supplied regular expressions. All regular expressions are case-insensitive. We support also more granular masking using `LUMIGO_SECRET_MASKING_REGEX_HTTP_REQUEST_BODIES`, `LUMIGO_SECRET_MASKING_REGEX_HTTP_REQUEST_HEADERS`, `LUMIGO_SECRET_MASKING_REGEX_HTTP_RESPONSE_BODIES`, `LUMIGO_SECRET_MASKING_REGEX_HTTP_RESPONSE_HEADERS`, `LUMIGO_SECRET_MASKING_REGEX_HTTP_QUERY_PARAMS` and `LUMIGO_SECRET_MASKING_REGEX_ENVIRONMENT`. By default, Lumigo applies the following regular expressions: `[".*pass.*", ".*key.*", ".*secret.*", ".*credential.*", ".*passphrase.*", ".*token.*"]`. The "magic" value `all` will prevent any value to be sent to Lumigo.
 * `LUMIGO_DOMAINS_SCRUBBER='[".*secret.*"]'` - Prevents Lumigo from collecting both request and response details from a list of domains. This accepts a comma-separated list of regular expressions that is JSON-formatted. By default, the tracer uses `["secretsmanager\..*\.amazonaws\.com", "ssm\..*\.amazonaws\.com", "kms\..*\.amazonaws\.com"]`. **Note** - These defaults are overridden when you define a different list of regular expressions.
@@ -21,0 +21,0 @@

New alerts

Environment variable access

Supply chain risk

Package accesses environment variables, which may be a sign of credential stuffing or data theft.

Found 3 instances in 1 package

Improved metrics

Total package byte prevSize

183777

increased by10.86%

Number of package files

101

increased by3.06%

Lines of code

1801

increased by8.49%

Worsened metrics

Number of low supply chain risk alerts

16

increased by33.33%

No dependency changes