diff --git a/lib/logger/utils.spec.ts b/lib/logger/utils.spec.ts index 2073782a91c1c1af7836deb605b97d1ca37ea11b..3d36dc577e00abca48ee0d53ba92bf32150c4a63 100644 --- a/lib/logger/utils.spec.ts +++ b/lib/logger/utils.spec.ts @@ -53,6 +53,34 @@ describe('logger/utils', () => { expect(sanitizeValue(input)).toBe(output); }); + it('preserves secret template strings in redacted fields', () => { + const input = { + normal: 'value', + token: '{{ secrets.MY_SECRET }}', + password: '{{secrets.ANOTHER_SECRET}}', + content: '{{ secrets.CONTENT_SECRET }}', + npmToken: '{{ secrets.NPM_TOKEN }}', + forkToken: 'some-token', + nested: { + authorization: '{{ secrets.NESTED_SECRET }}', + password: 'some-password', + }, + }; + const expected = { + normal: 'value', + token: '{{ secrets.MY_SECRET }}', + password: '{{secrets.ANOTHER_SECRET}}', + content: '[content]', + npmToken: '{{ secrets.NPM_TOKEN }}', + forkToken: '***********', + nested: { + authorization: '{{ secrets.NESTED_SECRET }}', + password: '***********', + }, + }; + expect(sanitizeValue(input)).toEqual(expected); + }); + describe('prepareError', () => { function getError<T extends z.ZodType>( schema: T, diff --git a/lib/logger/utils.ts b/lib/logger/utils.ts index 35c07dc952b7a60068e15615db3f417f0cbb4226..ac2f5ec5f28b12f10afd0f44068df5d2318edfea 100644 --- a/lib/logger/utils.ts +++ b/lib/logger/utils.ts @@ -4,6 +4,7 @@ import bunyan from 'bunyan'; import fs from 'fs-extra'; import { RequestError as HttpError } from 'got'; import { ZodError } from 'zod'; +import { regEx } from '../util/regex'; import { redactedFields, sanitize } from '../util/sanitize'; import type { BunyanRecord, BunyanStream } from './types'; @@ -214,7 +215,12 @@ export function sanitizeValue( if (!val) { curValue = val; } else if (redactedFields.includes(key)) { - curValue = '***********'; + // Do not mask/sanitize secrets templates + if (is.string(val) && regEx(/^{{\s*secrets\..*}}$/).test(val)) { + curValue = val; + } else { + curValue = '***********'; + } } else if (contentFields.includes(key)) { curValue = '[content]'; } else if (key === 'secrets') {