feat(APIM-344): handle sensitive details in log messages

package.json

@@ -63,7 +63,7 @@
     "@types/express": "^4.17.17",
     "@types/jest": "^29.5.3",
     "@types/lodash": "^4.14.195",
-    "@types/node": "^20.4.2",
+    "@types/node": "^20.4.4",
     "@types/supertest": "^2.0.12",
     "@typescript-eslint/eslint-plugin": "^6.1.0",
     "@typescript-eslint/parser": "^6.1.0",

src/constants/redact-strings-paths.constant.ts

@@ -7,4 +7,6 @@ export const REDACT_STRING_PATHS = [
   'stack',
   'originalError.message',
   'originalError.stack',
+  'err.message',
+  'err.stack',
 ];

src/constants/redact-strings.constant.ts

@@ -1,7 +1,7 @@
 export const REDACT_STRINGS = [
   { searchValue: /(Login failed for user ').*(')/g, replaceValue: '$1[Redacted]$2' },
-  { searchValue: process.env.DATABASE_USERNAME, replaceValue: '[RedactedDomain]' },
-  { searchValue: process.env.DATABASE_PASSWORD, replaceValue: '[RedactedDomain]' },
+  { searchValue: process.env.DATABASE_USERNAME, replaceValue: '[Redacted]' },
+  { searchValue: process.env.DATABASE_PASSWORD, replaceValue: '[Redacted]' },
   { searchValue: process.env.DATABASE_MDM_HOST, replaceValue: '[RedactedDomain]' },
   { searchValue: process.env.DATABASE_CEDAR_HOST, replaceValue: '[RedactedDomain]' },
   { searchValue: process.env.DATABASE_NUMBER_GENERATOR_HOST, replaceValue: '[RedactedDomain]' },

src/helpers/redact-strings-in-log-args.helper.test.ts

@@ -0,0 +1,125 @@
+import { REDACT_STRING_PATHS } from '@ukef/constants';
+import { RandomValueGenerator } from '@ukef-test/support/generator/random-value-generator';
+
+import { redactStringsInLogArgs } from './redact-strings-in-log-args.helper';
+
+describe('Redact errors helper', () => {
+  const valueGenerator = new RandomValueGenerator();
+
+  describe('redactStringsInLogArgs', () => {
+    const domain = valueGenerator.httpsUrl();
+    const otherSensitiveField = valueGenerator.word();
+    const message = `ConnectionError: Failed to connect to ${domain}, ${otherSensitiveField}`;
+    const redactedMessage = `ConnectionError: Failed to connect to [RedactedDomain], [Redacted]`;
+    const redactStrings = [
+      { searchValue: domain, replaceValue: '[RedactedDomain]' },
+      { searchValue: otherSensitiveField, replaceValue: '[Redacted]' },
+    ];
+    const args = [
+      {
+        message: message,
+        stack: message,
+        originalError: {
+          message: message,
+          stack: message,
+          safe: 'Nothing sensitive',
+        },
+        driverError: {
+          message: message,
+          stack: message,
+          originalError: {
+            message: message,
+            stack: message,
+            safe: 'Nothing sensitive',
+          },
+        },
+      },
+    ];
+    const expectedResult = [
+      {
+        message: redactedMessage,
+        stack: redactedMessage,
+        originalError: {
+          message: redactedMessage,
+          stack: redactedMessage,
+          safe: 'Nothing sensitive',
+        },
+        driverError: {
+          message: redactedMessage,
+          stack: redactedMessage,
+          originalError: {
+            message: redactedMessage,
+            stack: redactedMessage,
+            safe: 'Nothing sensitive',
+          },
+        },
+      },
+    ];
+
+    it('replaces sensitive data in input object', () => {
+      const redacted = redactStringsInLogArgs(true, REDACT_STRING_PATHS, redactStrings, args);
+
+      expect(redacted).toStrictEqual(expectedResult);
+    });
+
+    it('returns original input if redactLogs is set to false', () => {
+      const redacted = redactStringsInLogArgs(false, REDACT_STRING_PATHS, redactStrings, args);
+
+      expect(redacted).toStrictEqual(args);
+    });
+
+    it('replaces sensitive data in input object using regex', () => {
+      const redactStrings = [{ searchValue: /(Login failed for user ').*(')/g, replaceValue: '$1[Redacted]$2' }];
+      const otherSensitiveValue = valueGenerator.word();
+      const messageforRegex = `Connection error: Login failed for user '${otherSensitiveValue}'`;
+      const redactedMessage = `Connection error: Login failed for user '[Redacted]'`;
+      const args = [
+        {
+          message: messageforRegex,
+          stack: messageforRegex,
+          originalError: {
+            message: messageforRegex,
+          },
+        },
+      ];
+      const expectedResult = [
+        {
+          message: redactedMessage,
+          stack: redactedMessage,
+          originalError: {
+            message: redactedMessage,
+          },
+        },
+      ];
+
+      const redacted = redactStringsInLogArgs(true, REDACT_STRING_PATHS, redactStrings, args);
+
+      expect(redacted).toStrictEqual(expectedResult);
+    });
+
+    it('replaces sensitive data in different input object', () => {
+      const args = [
+        {
+          field1: message,
+          field2: {
+            field3: message,
+            safe: 'Nothing sensitive',
+          },
+        },
+      ];
+      const expectedResult = [
+        {
+          field1: redactedMessage,
+          field2: {
+            field3: redactedMessage,
+            safe: 'Nothing sensitive',
+          },
+        },
+      ];
+      const redactPaths = ['field1', 'field2.field3'];
+      const redacted = redactStringsInLogArgs(true, redactPaths, redactStrings, args);
+
+      expect(redacted).toStrictEqual(expectedResult);
+    });
+  });
+});

src/helpers/redact-errors.helper.ts → src/helpers/redact-strings-in-log-args.helper.ts

@@ -1,29 +1,31 @@
 import { get, set } from 'lodash';
 
 // This helper function is used to redact sensitive data in Error object strings.
-export const redactError = (
+export const redactStringsInLogArgs = (
   redactLogs: boolean,
   redactPaths: string[],
   redactStrings: { searchValue: string | RegExp; replaceValue: string }[],
-  err: any,
+  args: any,
 ): any => {
   if (!redactLogs) {
-    return err;
+    return args;
   }
-  redactPaths.forEach((path) => {
-    const value: string = get(err, path);
-    if (value) {
-      const safeValue = redactString(redactStrings, value);
-      set(err, path, safeValue);
-    }
+  args.forEach((arg, index) => {
+    redactPaths.forEach((path) => {
+      const value: string = get(arg, path);
+      if (value) {
+        const safeValue = redactString(redactStrings, value);
+        set(args[index], path, safeValue);
+      }
+    });
   });
-  return err;
+  return args;
 };
 
 const redactString = (redactStrings: { searchValue: string | RegExp; replaceValue: string }[], string: string): string => {
-  let safeSTring: string = string;
+  let safeString: string = string;
   redactStrings.forEach((redact) => {
-    safeSTring = safeSTring.replaceAll(redact.searchValue, redact.replaceValue);
+    safeString = safeString.replaceAll(redact.searchValue, redact.replaceValue);
   });
-  return safeSTring;
+  return safeString;
 };

src/logging/console-logger-with-redact.test.ts

@@ -0,0 +1,42 @@
+import { ConsoleLogger } from '@nestjs/common';
+import { RandomValueGenerator } from '@ukef-test/support/generator/random-value-generator';
+
+import { ConsoleLoggerWithRedact } from './console-logger-with-redact';
+
+const mockedSuperError = jest.spyOn(ConsoleLogger.prototype, 'error');
+
+describe('ConsoleLoggerWithRedact', () => {
+  const valueGenerator = new RandomValueGenerator();
+  const domain = valueGenerator.httpsUrl();
+  const otherSensitiveField = valueGenerator.word();
+  const message = `ConnectionError: Failed to connect to ${domain}, ${otherSensitiveField}`;
+  const redactedMessage = `ConnectionError: Failed to connect to [RedactedDomain], [Redacted]`;
+  const redactStrings = [
+    { searchValue: domain, replaceValue: '[RedactedDomain]' },
+    { searchValue: otherSensitiveField, replaceValue: '[Redacted]' },
+  ];
+  const logger = new ConsoleLoggerWithRedact(redactStrings);
+
+  beforeEach(() => {
+    mockedSuperError.mockClear();
+  });
+
+  it('redacts sensitive data in `message`', () => {
+    logger.error(message);
+
+    expect(mockedSuperError).toHaveBeenCalledWith(redactedMessage, undefined, undefined);
+  });
+
+  it('redacts sensitive data in `message` and second parameter `stack`', () => {
+    logger.error(message, message);
+
+    expect(mockedSuperError).toHaveBeenCalledWith(redactedMessage, redactedMessage, undefined);
+  });
+
+  it('redacts sensitive data in `message` and second parameter `stack`, also passes context', () => {
+    const context = valueGenerator.word();
+    logger.error(message, message, context);
+
+    expect(mockedSuperError).toHaveBeenCalledWith(redactedMessage, redactedMessage, context);
+  });
+});

src/logging/console-logger-with-redact.ts

@@ -8,13 +8,20 @@ export class ConsoleLoggerWithRedact extends ConsoleLogger {
     this.stringPatternsToRedact = stringPatternsToRedact;
   }
 
+  // Simplified, because has just single signature, function from ConsoleLogger.
   error(message: any, stack?: string, context?: string) {
+    let cleanMessage = message;
     let cleanStack = stack;
+    if (typeof message == 'string') {
+      this.stringPatternsToRedact.forEach((redact) => {
+        cleanMessage = cleanMessage.replace(redact.searchValue, redact.replaceValue);
+      });
+    }
     if (typeof stack == 'string') {
       this.stringPatternsToRedact.forEach((redact) => {
-        cleanStack = stack.replace(redact.searchValue, redact.replaceValue);
+        cleanStack = cleanStack.replace(redact.searchValue, redact.replaceValue);
       });
     }
-    super.error(message, cleanStack, context);
+    super.error(cleanMessage, cleanStack, context);
   }
 }