mirror of
https://github.com/openclaw/clawhub.git
synced 2026-08-14 08:52:21 +00:00
Jesse Merhi
2deb1b75e9
* fix: redact scan worker artifact errors * fix: harden worker secret logging * fix: keep worker claim failures failing * fix: scan diagnostics as files * fix: pin diagnostics scanner image * fix: narrow worker redaction boundary * fix: avoid custom worker secret patterns * fix: centralize worker transport redaction * fix: redact persisted worker failure secrets * fix: fail security worker on claim outages * fix: redact structured diagnostic secret fields * fix: harden worker failure redaction boundaries * fix: cover bracketed worker secret values * test: enforce worker workflow secret references * fix: redact quoted worker secret values * fix: redact diagnostic artifact path labels * test: cover claim failure redaction * fix: simplify worker redaction boundary * test: prove worker logger emits structured events
23 lines
1.1 KiB
TypeScript
23 lines
1.1 KiB
TypeScript
const WORKER_SECRET_VALUE_PATTERN_SOURCE = String.raw`(?:\[\s*(?:"[^"\r\n]*"|'[^'\r\n]*'|[^\]\s"',}]+)(?:\s*,\s*(?:"[^"\r\n]*"|'[^'\r\n]*'|[^\]\s"',}]+))*\s*\]|"[^"\r\n]*"|'[^'\r\n]*'|[^\s"',}]+)`;
|
|
const WORKER_SECRET_KEY_VALUE_PATTERN = new RegExp(
|
|
String.raw`\b([A-Z0-9_]*(?:TOKEN|SECRET|PASSWORD|API[_-]?KEY|[_-]KEY|AUTHORIZATION|CREDENTIAL)[A-Z0-9_]*|token|secret|password|api[_-]?key|authorization|credential)(["']?\s*[:=]\s*)${WORKER_SECRET_VALUE_PATTERN_SOURCE}`,
|
|
"gi",
|
|
);
|
|
|
|
export function redactWorkerSignedUrlsAndAuthHeaders(value: string) {
|
|
return value
|
|
.replace(/https?:\/\/[^\s"')<>]+/g, "[redacted-url]")
|
|
.replace(
|
|
/\bAuthorization\s*:\s*(?:Bearer|Basic|Token)\s+[A-Za-z0-9._~+/=-]+/gi,
|
|
"[redacted-secret]",
|
|
)
|
|
.replace(/\b(?:Bearer|Basic)\s+[A-Za-z0-9._~+/=-]+/gi, "[redacted-secret]");
|
|
}
|
|
|
|
export function redactWorkerPublicText(value: string) {
|
|
return redactWorkerSignedUrlsAndAuthHeaders(value).replace(
|
|
WORKER_SECRET_KEY_VALUE_PATTERN,
|
|
(_match, key: string, separator: string) => `${key}${separator}[redacted-secret]`,
|
|
);
|
|
}
|