File size: 4,820 Bytes
fc93158 | 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130 131 132 133 134 135 136 137 138 139 140 141 142 143 144 145 146 147 148 149 150 151 152 | import type { OpenClawConfig } from "../config/config.js";
import { compileSafeRegex } from "../security/safe-regex.js";
import { resolveNodeRequireFromMeta } from "./node-require.js";
import { replacePatternBounded } from "./redact-bounded.js";
const requireConfig = resolveNodeRequireFromMeta(import.meta.url);
export type RedactSensitiveMode = "off" | "tools";
const DEFAULT_REDACT_MODE: RedactSensitiveMode = "tools";
const DEFAULT_REDACT_MIN_LENGTH = 18;
const DEFAULT_REDACT_KEEP_START = 6;
const DEFAULT_REDACT_KEEP_END = 4;
const DEFAULT_REDACT_PATTERNS: string[] = [
// ENV-style assignments.
String.raw`\b[A-Z0-9_]*(?:KEY|TOKEN|SECRET|PASSWORD|PASSWD)\b\s*[=:]\s*(["']?)([^\s"'\\]+)\1`,
// JSON fields.
String.raw`"(?:apiKey|token|secret|password|passwd|accessToken|refreshToken)"\s*:\s*"([^"]+)"`,
// CLI flags.
String.raw`--(?:api[-_]?key|token|secret|password|passwd)\s+(["']?)([^\s"']+)\1`,
// Authorization headers.
String.raw`Authorization\s*[:=]\s*Bearer\s+([A-Za-z0-9._\-+=]+)`,
String.raw`\bBearer\s+([A-Za-z0-9._\-+=]{18,})\b`,
// PEM blocks.
String.raw`-----BEGIN [A-Z ]*PRIVATE KEY-----[\s\S]+?-----END [A-Z ]*PRIVATE KEY-----`,
// Common token prefixes.
String.raw`\b(sk-[A-Za-z0-9_-]{8,})\b`,
String.raw`\b(ghp_[A-Za-z0-9]{20,})\b`,
String.raw`\b(github_pat_[A-Za-z0-9_]{20,})\b`,
String.raw`\b(xox[baprs]-[A-Za-z0-9-]{10,})\b`,
String.raw`\b(xapp-[A-Za-z0-9-]{10,})\b`,
String.raw`\b(gsk_[A-Za-z0-9_-]{10,})\b`,
String.raw`\b(AIza[0-9A-Za-z\-_]{20,})\b`,
String.raw`\b(pplx-[A-Za-z0-9_-]{10,})\b`,
String.raw`\b(npm_[A-Za-z0-9]{10,})\b`,
// Telegram Bot API URLs embed the token as `/bot<token>/...` (no word-boundary before digits).
String.raw`\bbot(\d{6,}:[A-Za-z0-9_-]{20,})\b`,
String.raw`\b(\d{6,}:[A-Za-z0-9_-]{20,})\b`,
];
type RedactOptions = {
mode?: RedactSensitiveMode;
patterns?: string[];
};
function normalizeMode(value?: string): RedactSensitiveMode {
return value === "off" ? "off" : DEFAULT_REDACT_MODE;
}
function parsePattern(raw: string): RegExp | null {
if (!raw.trim()) {
return null;
}
const match = raw.match(/^\/(.+)\/([gimsuy]*)$/);
if (match) {
const flags = match[2].includes("g") ? match[2] : `${match[2]}g`;
return compileSafeRegex(match[1], flags);
}
return compileSafeRegex(raw, "gi");
}
function resolvePatterns(value?: string[]): RegExp[] {
const source = value?.length ? value : DEFAULT_REDACT_PATTERNS;
return source.map(parsePattern).filter((re): re is RegExp => Boolean(re));
}
function maskToken(token: string): string {
if (token.length < DEFAULT_REDACT_MIN_LENGTH) {
return "***";
}
const start = token.slice(0, DEFAULT_REDACT_KEEP_START);
const end = token.slice(-DEFAULT_REDACT_KEEP_END);
return `${start}…${end}`;
}
function redactPemBlock(block: string): string {
const lines = block.split(/\r?\n/).filter(Boolean);
if (lines.length < 2) {
return "***";
}
return `${lines[0]}\n…redacted…\n${lines[lines.length - 1]}`;
}
function redactMatch(match: string, groups: string[]): string {
if (match.includes("PRIVATE KEY-----")) {
return redactPemBlock(match);
}
const token =
groups.filter((value) => typeof value === "string" && value.length > 0).at(-1) ?? match;
const masked = maskToken(token);
if (token === match) {
return masked;
}
return match.replace(token, masked);
}
function redactText(text: string, patterns: RegExp[]): string {
let next = text;
for (const pattern of patterns) {
next = replacePatternBounded(next, pattern, (...args: string[]) =>
redactMatch(args[0], args.slice(1, args.length - 2)),
);
}
return next;
}
function resolveConfigRedaction(): RedactOptions {
let cfg: OpenClawConfig["logging"] | undefined;
try {
const loaded = requireConfig?.("../config/config.js") as
| {
loadConfig?: () => OpenClawConfig;
}
| undefined;
cfg = loaded?.loadConfig?.().logging;
} catch {
cfg = undefined;
}
return {
mode: normalizeMode(cfg?.redactSensitive),
patterns: cfg?.redactPatterns,
};
}
export function redactSensitiveText(text: string, options?: RedactOptions): string {
if (!text) {
return text;
}
const resolved = options ?? resolveConfigRedaction();
if (normalizeMode(resolved.mode) === "off") {
return text;
}
const patterns = resolvePatterns(resolved.patterns);
if (!patterns.length) {
return text;
}
return redactText(text, patterns);
}
export function redactToolDetail(detail: string): string {
const resolved = resolveConfigRedaction();
if (normalizeMode(resolved.mode) !== "tools") {
return detail;
}
return redactSensitiveText(detail, resolved);
}
export function getDefaultRedactPatterns(): string[] {
return [...DEFAULT_REDACT_PATTERNS];
}
|