Class: Sqreen::SensitiveDataRedactor

Inherits:
Object
  • Object
show all
Defined in:
lib/sqreen/sensitive_data_redactor.rb

Overview

For redacting sensitive data and avoid having it sent to our servers

Constant Summary collapse

DEFAULT_SENSITIVE_KEYS = 
Set.new(%w[password password2 password_confirmation secret passwd authorization api_key apikey token access_token jwt_token cvv cvv2]).freeze
DEFAULT_REGEX = 
/\A(?:\d[ -]*?){13,16}\z/
MASK = 
'<Redacted by Sqreen>'.freeze

Class Method Summary collapse

Instance Method Summary collapse

Constructor Details

#initialize(params = {}) ⇒ SensitiveDataRedactor

Returns a new instance of SensitiveDataRedactor.



37
38
39
40
 
# File 'lib/sqreen/sensitive_data_redactor.rb', line 37

def initialize(params = {})
  @regex = params[:regex] || DEFAULT_REGEX
  @keys = (params[:keys] || DEFAULT_SENSITIVE_KEYS).map(&:downcase)
end

Class Method Details

.all_strings(v) ⇒ Object 



78
79
80
81
82
 
# File 'lib/sqreen/sensitive_data_redactor.rb', line 78

def all_strings(v)
  accum = []
  all_strings_impl(v, accum)
  accum
end

.from_config ⇒ Object 



18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
 
# File 'lib/sqreen/sensitive_data_redactor.rb', line 18

def self.from_config
  keys = Sqreen.config_get(:strip_sensitive_keys)
  keys = keys.split(',') if keys && keys.is_a?(String)

  regex = Sqreen.config_get(:strip_sensitive_regex)
  if regex && regex.is_a?(String)
    begin
      regex = Regexp.compile(regex)
    rescue RegexpError
      Sqreen.log.warn("Invalid regular expression given in strip_sensitive_regex: #{regex}")
      regex = nil
    end
  else
    regex = nil
  end

  new(keys: keys, regex: regex)
end

Instance Method Details

#redact(obj) ⇒ Object 



42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
 
# File 'lib/sqreen/sensitive_data_redactor.rb', line 42

def redact(obj)
  result = obj
  redacted = []

  case obj
  when String
    if obj =~ @regex
      result = MASK
      redacted << obj
    end
  when Array
    result = []
    obj.each do |e|
      e, r = redact(e)
      result << e
      redacted += r
    end
  when Hash
    result = {}
    obj.each do |k, v|
      ck = k.is_a?(String) ? k.downcase : k
      if @keys.include?(ck)
        redacted += SensitiveDataRedactor.all_strings(v)
        v = MASK
      else
        v, r = redact(v)
        redacted += r
      end
      result[k] = v
    end
  end

  [result, redacted]
end