-
Notifications
You must be signed in to change notification settings - Fork 10
/
json.go
211 lines (189 loc) · 6.24 KB
/
json.go
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
// Unless explicitly stated otherwise all files in this repository are licensed
// under the Apache License Version 2.0.
// This product includes software developed at Datadog (https://www.datadoghq.com/).
// Copyright 2016-present Datadog, Inc.
package obfuscate
import (
"strconv"
"strings"
"github.com/n9e/n9e-agentd/staging/datadog-agent/pkg/trace/config"
"github.com/n9e/n9e-agentd/staging/datadog-agent/pkg/trace/pb"
"k8s.io/klog/v2"
)
// obfuscateJSON obfuscates the given span's tag using the given obfuscator. If the obfuscator is
// nil it is considered disabled.
func (o *Obfuscator) obfuscateJSON(span *pb.Span, tag string, obfuscator *jsonObfuscator) {
if obfuscator == nil || span.Meta == nil || span.Meta[tag] == "" {
// obfuscator is disabled or tag is not present
return
}
span.Meta[tag], _ = obfuscator.obfuscate([]byte(span.Meta[tag]))
// we should accept whatever the obfuscator returns, even if it's an error: a parsing
// error simply means that the JSON was invalid, meaning that we've only obfuscated
// as much of it as we could. It is safe to accept the output, even if partial.
}
type jsonObfuscator struct {
keepKeys map[string]bool // the values for these keys will not be obfuscated
transformKeys map[string]bool // the values for these keys pass through the transformer
transformer func(string) string
scan *scanner // scanner
closures []bool // closure stack, true if object (e.g. {[{ => []bool{true, false, true})
key bool // true if scanning a key
wiped bool // true if obfuscation string (`"?"`) was already written for current value
keeping bool // true if not obfuscating
transformingValue bool // true if collecting the next literal for transformation
keepDepth int // the depth at which we've stopped obfuscating
}
func newJSONObfuscator(cfg *config.JSONObfuscationConfig, o *Obfuscator) *jsonObfuscator {
keepValue := make(map[string]bool, len(cfg.KeepValues))
for _, v := range cfg.KeepValues {
keepValue[v] = true
}
var (
transformKeys map[string]bool
transformer func(string) string
)
if len(cfg.ObfuscateSQLValues) > 0 {
transformer = sqlObfuscationTransformer(o)
transformKeys = make(map[string]bool, len(cfg.ObfuscateSQLValues))
for _, v := range cfg.ObfuscateSQLValues {
transformKeys[v] = true
}
}
return &jsonObfuscator{
closures: []bool{},
keepKeys: keepValue,
transformKeys: transformKeys,
transformer: transformer,
scan: &scanner{},
}
}
func sqlObfuscationTransformer(o *Obfuscator) func(string) string {
return func(s string) string {
result, err := o.ObfuscateSQLString(s)
if err != nil {
klog.V(5).Infof("Failed to obfuscate SQL string '%s': %s", s, err.Error())
// instead of returning an empty string we explicitly return an error string here within the result in order
// to surface the problem clearly to the user
return "Datadog-agent failed to obfuscate SQL string. Enable agent debug logs for more info."
}
return result.Query
}
}
// setKey verifies if we are currently scanning a key based on the current state
// and updates the state accordingly. It must be called only after a closure or a
// value scan has ended.
func (p *jsonObfuscator) setKey() {
n := len(p.closures)
p.key = n == 0 || p.closures[n-1] // true if we are at top level or in an object
p.wiped = false
}
func (p *jsonObfuscator) obfuscate(data []byte) (string, error) {
var out strings.Builder
keyBuf := make([]byte, 0, 10) // recording key token
valBuf := make([]byte, 0, 10) // recording value
p.scan.reset()
for _, c := range data {
p.scan.bytes++
op := p.scan.step(p.scan, c)
depth := len(p.closures)
switch op {
case scanBeginObject:
// object begins: {
p.closures = append(p.closures, true)
p.setKey()
p.transformingValue = false
case scanBeginArray:
// array begins: [
p.closures = append(p.closures, false)
p.setKey()
p.transformingValue = false
case scanEndArray, scanEndObject:
// array or object closing
if n := len(p.closures) - 1; n > 0 {
p.closures = p.closures[:n]
}
fallthrough
case scanObjectValue, scanArrayValue:
// done scanning value
p.setKey()
if p.transformingValue && p.transformer != nil {
v, err := strconv.Unquote(string(valBuf))
if err != nil {
v = string(valBuf)
}
result := p.transformer(v)
out.WriteByte('"')
out.WriteString(result)
out.WriteByte('"')
p.transformingValue = false
valBuf = valBuf[:0]
} else if p.keeping && depth < p.keepDepth {
p.keeping = false
}
case scanBeginLiteral, scanContinue:
// starting or continuing a literal
if p.transformingValue {
valBuf = append(valBuf, c)
continue
} else if p.key {
// it's a key
keyBuf = append(keyBuf, c)
} else if !p.keeping {
// it's a value we're not keeping
if !p.wiped {
out.Write([]byte(`"?"`))
p.wiped = true
}
continue
}
case scanObjectKey:
// done scanning key
k := strings.Trim(string(keyBuf), `"`)
if !p.keeping && p.keepKeys[k] {
// we should not obfuscate values of this key
p.keeping = true
p.keepDepth = depth + 1
} else if !p.transformingValue && p.transformer != nil && p.transformKeys[k] {
// the string value immediately following this key will be passed through the value transformer
// if anything other than a literal is found then sql obfuscation is stopped and json obfuscation
// proceeds as usual
p.transformingValue = true
}
keyBuf = keyBuf[:0]
p.key = false
case scanSkipSpace:
continue
case scanError:
// we've encountered an error, mark that there might be more JSON
// using the ellipsis and return whatever we've managed to obfuscate
// thus far.
out.Write([]byte("..."))
return out.String(), p.scan.err
}
out.WriteByte(c)
}
if p.scan.eof() == scanError {
// if an error occurred it's fine, simply add the ellipsis to indicate
// that the input has been truncated.
out.Write([]byte("..."))
return out.String(), p.scan.err
}
return out.String(), nil
}
func stringOp(op int) string {
return [...]string{
"Continue",
"BeginLiteral",
"BeginObject",
"ObjectKey",
"ObjectValue",
"EndObject",
"BeginArray",
"ArrayValue",
"EndArray",
"SkipSpace",
"End",
"Error",
}[op]
}