redact all the things

johnstcn · johnstcn · commit b4a7d2ed115c · 2024-03-12T14:25:30.000Z
diff --git a/support/support.go b/support/support.go
@@ -355,10 +355,9 @@ func Run(ctx context.Context, d *Deps) (*Bundle, error) {
 // sanitizeEnv modifies kvs in place and erases the values of keys containing
 // the strings "secret", "token", or "pass"
 func sanitizeEnv(kvs map[string]string) {
-	for k := range kvs {
-		kl := strings.ToLower(k)
-		if strings.Contains(kl, "secret") || strings.Contains(kl, "token") || strings.Contains(kl, "pass") {
-			kvs[k] = ""
+	for k, v := range kvs {
+		if v != "" {
+			kvs[k] = "***REDACTED***"
 		}
 	}
 }
diff --git a/support/support_test.go b/support/support_test.go
@@ -5,7 +5,6 @@ import (
 	"context"
 	"io"
 	"net/http"
-	"strings"
 	"testing"
 	"time"
 
@@ -148,10 +147,7 @@ func assertSanitizedWorkspace(t *testing.T, ws codersdk.Workspace) {
 	for _, res := range ws.LatestBuild.Resources {
 		for _, agt := range res.Agents {
 			for k, v := range agt.EnvironmentVariables {
-				kl := strings.ToLower(k)
-				if strings.Contains(kl, "secret") || strings.Contains(kl, "token") || strings.Contains(kl, "pass") {
-					assert.Empty(t, v, "environment variable %q not sanitized", k)
-				}
+				assert.Equal(t, "***REDACTED***", v, "environment variable %q not sanitized", k)
 			}
 		}
 	}

Original file line number	Diff line number	Diff line change
`@@ -355,10 +355,9 @@ func Run(ctx context.Context, d Deps) (Bundle, error) {`
`355`	`355`	`// sanitizeEnv modifies kvs in place and erases the values of keys containing`
`356`	`356`	`// the strings "secret", "token", or "pass"`
`357`	`357`	`func sanitizeEnv(kvs map[string]string) {`
`358`		`- for k := range kvs {`
`359`		`- kl := strings.ToLower(k)`
`360`		`- if strings.Contains(kl, "secret") \|\| strings.Contains(kl, "token") \|\| strings.Contains(kl, "pass") {`
`361`		`- kvs[k] = ""`
	`358`	`+ for k, v := range kvs {`
	`359`	`+ if v != "" {`
	`360`	`+ kvs[k] = "*REDACTED*"`
`362`	`361`	`}`
`363`	`362`	`}`
`364`	`363`	`}`
Original file line number	Diff line number	Diff line change
`@@ -5,7 +5,6 @@ import (`
`5`	`5`	`"context"`
`6`	`6`	`"io"`
`7`	`7`	`"net/http"`
`8`		`- "strings"`
`9`	`8`	`"testing"`
`10`	`9`	`"time"`
`11`	`10`
`@@ -148,10 +147,7 @@ func assertSanitizedWorkspace(t *testing.T, ws codersdk.Workspace) {`
`148`	`147`	`for _, res := range ws.LatestBuild.Resources {`
`149`	`148`	`for _, agt := range res.Agents {`
`150`	`149`	`for k, v := range agt.EnvironmentVariables {`
`151`		`- kl := strings.ToLower(k)`
`152`		`- if strings.Contains(kl, "secret") \|\| strings.Contains(kl, "token") \|\| strings.Contains(kl, "pass") {`
`153`		`- assert.Empty(t, v, "environment variable %q not sanitized", k)`
`154`		`- }`
	`150`	`+ assert.Equal(t, "*REDACTED*", v, "environment variable %q not sanitized", k)`
`155`	`151`	`}`
`156`	`152`	`}`
`157`	`153`	`}`