Class: Sentiero::Reporter::Scrubber

Inherits:
Object
  • Object
show all
Defined in:
lib/sentiero/reporter/scrubber.rb

Overview

Replaces values whose key matches a sensitive pattern with "[FILTERED]", before data leaves the host app, so secrets never traverse the network. Matching is case-insensitive and substring based ("user_password" matches "password").

Constant Summary collapse

FILTERED = 
"[FILTERED]"
DEFAULT_KEYS =

Superset of Redaction::BUILTIN_DENYLIST (the browser-lane URL param denylist) plus a few extras (credit card/SSN) the query-string lane doesn't need to cover. Keeping this as a union rather than a hand copy means the two lanes can't drift apart again.

(%w[
  password passwd secret token api_key apikey authorization
  access_token refresh_token secret_key private_key
  credit_card card_number cvv ssn
] + Redaction::BUILTIN_DENYLIST).uniq.freeze

Instance Method Summary collapse

Constructor Details

#initialize(keys = DEFAULT_KEYS) ⇒ Scrubber

Returns a new instance of Scrubber.



22
23
24
 
# File 'lib/sentiero/reporter/scrubber.rb', line 22

def initialize(keys = DEFAULT_KEYS)
  @patterns = Array(keys).map { |k| k.to_s.downcase }
end

Instance Method Details

#scrub(obj) ⇒ Object 



26
27
28
29
30
31
32
33
34
35
36
37
 
# File 'lib/sentiero/reporter/scrubber.rb', line 26

def scrub(obj)
  case obj
  when Hash
    obj.each_with_object(obj.class.new) do |(k, v), acc|
      acc[k] = sensitive?(k) ? FILTERED : scrub(v)
    end
  when Array
    obj.map { |v| scrub(v) }
  else
    obj
  end
end