a00485cf13
Server-side (primary): Apply redact.Text/InputMap on task message content, output, and input fields before DB persistence and WebSocket broadcast. Extended redact package with GitLab tokens, JWTs, connection strings, and PASSWORD/SECRET/TOKEN env var patterns. Frontend (fallback): redactSecrets utility mirrors server patterns, applied in buildTimeline and ToolCallRow render as a safety net.
37 lines
1.9 KiB
TypeScript
37 lines
1.9 KiB
TypeScript
/**
|
|
* Client-side fallback for redacting sensitive information in agent output.
|
|
* The server performs primary redaction; this is a safety net for display.
|
|
*/
|
|
|
|
const patterns: { re: RegExp; replacement: string }[] = [
|
|
// AWS access key IDs
|
|
{ re: /\bAKIA[0-9A-Z]{16}\b/g, replacement: "[REDACTED AWS KEY]" },
|
|
// AWS secret access keys
|
|
{ re: /(?:aws_secret_access_key|secret_?access_?key)\s*[=:]\s*[A-Za-z0-9/+=]{40}/gi, replacement: "[REDACTED AWS SECRET]" },
|
|
// PEM private keys
|
|
{ re: /-----BEGIN[A-Z\s]*PRIVATE KEY-----[\s\S]*?-----END[A-Z\s]*PRIVATE KEY-----/g, replacement: "[REDACTED PRIVATE KEY]" },
|
|
// GitHub tokens
|
|
{ re: /\b(?:ghp|gho|ghu|ghs|ghr)_[A-Za-z0-9_]{36,255}\b/g, replacement: "[REDACTED GITHUB TOKEN]" },
|
|
// GitLab personal access tokens
|
|
{ re: /\bglpat-[A-Za-z0-9_-]{20,}\b/g, replacement: "[REDACTED GITLAB TOKEN]" },
|
|
// OpenAI / Anthropic API keys
|
|
{ re: /\bsk-[A-Za-z0-9_-]{20,}\b/g, replacement: "[REDACTED API KEY]" },
|
|
// Slack tokens
|
|
{ re: /\bxox[bporas]-[A-Za-z0-9-]{10,}\b/g, replacement: "[REDACTED SLACK TOKEN]" },
|
|
// JWT tokens
|
|
{ re: /\bey[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}\b/g, replacement: "[REDACTED JWT]" },
|
|
// Bearer tokens
|
|
{ re: /\bBearer\s+[A-Za-z0-9\-._~+/]+=*/gi, replacement: "Bearer [REDACTED]" },
|
|
// Connection strings with embedded passwords
|
|
{ re: /(?:postgres|mysql|mongodb|redis|amqp)(?:ql)?:\/\/[^:\s]+:[^@\s]+@/gi, replacement: "[REDACTED CONNECTION STRING]@" },
|
|
// Generic key=value secret env vars
|
|
{ re: /(?:API_KEY|API_SECRET|SECRET_KEY|SECRET|ACCESS_TOKEN|AUTH_TOKEN|PRIVATE_KEY|DATABASE_URL|DB_PASSWORD|DB_URL|REDIS_URL|PASSWORD|TOKEN)\s*[=:]\s*\S+/gi, replacement: "[REDACTED CREDENTIAL]" },
|
|
];
|
|
|
|
export function redactSecrets(text: string): string {
|
|
let result = text;
|
|
for (const { re, replacement } of patterns) {
|
|
result = result.replace(re, replacement);
|
|
}
|
|
return result;
|
|
}
|