Redact the rest values once the previous one matches redact fields

Signed-off-by: JenTing Hsiao <[email protected]>

Author: jenting

components/common-go/log/redact.go

@@ -7,6 +7,7 @@ package log
 import (
 	"encoding/json"
 	"fmt"
+	"reflect"
 	"strings"
 )
 
@@ -16,6 +17,9 @@ var (
 		"auth_",
 		"password",
 		"token",
+		"key",
+		"jwt",
+		"secret",
 	}
 )
 
@@ -59,6 +63,7 @@ func redactArray(data *[]interface{}) {
 }
 
 func redactObject(data *map[string]interface{}) {
+	var forceRedact bool
 	for k, v := range *data {
 		for _, prohibited := range redactedFields {
 			if strings.Contains(strings.ToLower(fmt.Sprintf("%v", k)), prohibited) {
@@ -67,10 +72,18 @@ func redactObject(data *map[string]interface{}) {
 			}
 		}
 
+		if forceRedact {
+			(*data)[k] = redactedValue
+		}
 		if (*data)[k] != redactedValue {
 			//TODO: refactor
 			//nolint:gosec
+			was := (*data)[k]
 			(*data)[k] = redactValue(&v)
+			if !reflect.DeepEqual(was, (*data)[k]) {
+				// force the rest values to redact
+				forceRedact = true
+			}
 		}
 	}
 }

components/common-go/log/redact_test.go

@@ -14,8 +14,8 @@ func TestRedactJSON(t *testing.T) {
 		Expectation string
 	}{
 		{
-			`{"auth":{"total":{}},"source":{"file":{"contextPath":".","dockerfilePath":".gitpod.dockerfile","dockerfileVersion":"82561e7f6455e3c0e6ee98be03c4d9aab4d459f8","source":{"git":{"checkoutLocation":"test.repo","cloneTaget":"good-workspace-image","config":{"authPassword":"super-secret-password","authUser":"oauth2","authentication":"BASIC_AUTH"},"remoteUri":"https://github.com/AlexTugarev/test.repo.git","targetMode":"REMOTE_BRANCH"}}}}}`,
-			`{"auth":{"total":{}},"source":{"file":{"contextPath":".","dockerfilePath":".gitpod.dockerfile","dockerfileVersion":"82561e7f6455e3c0e6ee98be03c4d9aab4d459f8","source":{"git":{"checkoutLocation":"test.repo","cloneTaget":"good-workspace-image","config":{"authPassword":"[redacted]","authUser":"oauth2","authentication":"BASIC_AUTH"},"remoteUri":"https://github.com/AlexTugarev/test.repo.git","targetMode":"REMOTE_BRANCH"}}}}}`,
+			`{"auth":{"total":{}},"env":[{"name":"SECRET_PASSWORD","value":"i-am-leaked-in-the-logs-yikes"},{"name":"GITHUB_TOKEN","value":"thisismyGitHubTokenDontStealIt"},{"name":"SUPER_SEKRET","value":"you.cant.see.me.or.can.you"},{"name":"GITHUB_SSH_PRIVATE_KEY","value":"super-secret-private-ssh-key-from-github"},{"name":"SHELL","value":"zsh"},{"name":"GITLAB_TOKEN","value":"abcsecrettokendef"}],"source":{"file":{"contextPath":".","dockerfilePath":".gitpod.dockerfile","dockerfileVersion":"82561e7f6455e3c0e6ee98be03c4d9aab4d459f8","source":{"git":{"checkoutLocation":"test.repo","cloneTaget":"good-workspace-image","config":{"authPassword":"super-secret-password","authUser":"oauth2","authentication":"BASIC_AUTH"},"remoteUri":"https://github.com/AlexTugarev/test.repo.git","targetMode":"REMOTE_BRANCH"}}}}}`,
+			`{"auth":{"total":{}},"env":[{"name":"[redacted]","value":"[redacted]"},{"name":"[redacted]","value":"[redacted]"},{"name":"SUPER_SEKRET","value":"you.cant.see.me.or.can.you"},{"name":"[redacted]","value":"[redacted]"},{"name":"SHELL","value":"zsh"},{"name":"[redacted]","value":"[redacted]"}],"source":{"file":{"contextPath":".","dockerfilePath":".gitpod.dockerfile","dockerfileVersion":"82561e7f6455e3c0e6ee98be03c4d9aab4d459f8","source":{"git":{"checkoutLocation":"test.repo","cloneTaget":"good-workspace-image","config":{"authPassword":"[redacted]","authUser":"oauth2","authentication":"BASIC_AUTH"},"remoteUri":"https://github.com/AlexTugarev/test.repo.git","targetMode":"REMOTE_BRANCH"}}}}}`,
 		},
 	}