refactor phase 4 hardening helpers and redacted logging

actions/core/guards.js

@@ -0,0 +1,11 @@
+export const isNonEmptyString = (value) => {
+    return typeof value === "string" && value.trim().length > 0;
+};
+
+export const sanitizeString = (value) => {
+    return typeof value === "string" ? value.trim() : "";
+};
+
+export const escapeODataString = (value) => {
+    return sanitizeString(value).replace(/'/g, "''");
+};

actions/core/logger.js

@@ -1,5 +1,35 @@
 import _ from "lodash";
 
+const MASK = "[REDACTED]";
+
+const redactString = (value) => {
+    if (typeof value !== "string") return value;
+
+    return value
+        .replace(
+            /([a-zA-Z0-9._%+-]{1,})@([a-zA-Z0-9.-]+\.[a-zA-Z]{2,})/g,
+            `${MASK}@${MASK}`
+        )
+        .replace(/Bearer\s+[A-Za-z0-9._\-]+/gi, `Bearer ${MASK}`)
+        .replace(/("client_secret"\s*:\s*")[^"]+("?)/gi, `$1${MASK}$2`)
+        .replace(/("access_token"\s*:\s*")[^"]+("?)/gi, `$1${MASK}$2`);
+};
+
+export const redactSensitive = (value) => {
+    if (value == null) return value;
+
+    if (typeof value === "string") {
+        return redactString(value);
+    }
+
+    try {
+        const json = JSON.stringify(value);
+        return redactString(json);
+    } catch (_error) {
+        return MASK;
+    }
+};
+
 export const getIP = (req) => {
     const forwarded = req.headers["x-forwarded-for"];
 
@@ -17,7 +47,7 @@ export const getIP = (req) => {
 export const consoleLogger = (err) => {
     console.log(
         "\n\n/////////////////////////////////////////////////\nRaw Error  " +
-            err +
+            redactSensitive(err) +
             "\n\n/////////////////////////////////////////////////\n"
     );
     var errStr =
@@ -40,22 +70,24 @@ export const consoleLogger = (err) => {
               "\n"
             : "") +
         (_.has(err, "response.data.error.message")
-            ? "\nMessage: " + err.response.data.error.message + "\n"
+            ? "\nMessage: " +
+              redactSensitive(err.response.data.error.message) +
+              "\n"
             : "") +
         (_.has(err, "response.config.url")
-            ? "\nRequest URL: " + err.config.url + "\n"
+            ? "\nRequest URL: " + redactSensitive(err.config.url) + "\n"
             : "") +
         (_.has(err, "response.headers.date")
             ? "\nRequest Time: " + err.response.headers.date + "\n"
             : "") +
         (_.has(err, "config.url")
-            ? "\nAxios config url: " + err.config.url + "\n"
+            ? "\nAxios config url: " + redactSensitive(err.config.url) + "\n"
             : "") +
         (_.has(err, "config.url")
-            ? "\nAxios message url: " + err.message + "\n"
+            ? "\nAxios message url: " + redactSensitive(err.message) + "\n"
             : "") +
         (_.has(err, "config.data")
-            ? "\nRequest payload: " + err.config.data + "\n"
+            ? "\nRequest payload: " + redactSensitive(err.config.data) + "\n"
             : "") +
         "\n/////////////////////////////////////////////////\n";