38 lines
1.3 KiB
Python
38 lines
1.3 KiB
Python
"""Secret redaction for anything shown on screen or written to disk.
|
|
|
|
Firmware prints the OTA token in clear text (ota_client.cpp:
|
|
"OTA token loaded from NVS: %s", "received token: %s") and env.txt
|
|
values may be echoed. Influx tokens are ~88-char base64 strings.
|
|
Redaction is applied before a line leaves the serial layer.
|
|
"""
|
|
|
|
from __future__ import annotations
|
|
|
|
import re
|
|
|
|
MASK = "<REDACTED>"
|
|
|
|
_RULES: list[re.Pattern[str]] = [
|
|
# "... token loaded from NVS: X", "... received token: X", "token: X"
|
|
re.compile(r"(?i)(\btoken\b[^:=\n]{0,40}[:=]\s*)(\S+)"),
|
|
# HTTP auth header echo: "Authorization: Token X" / "Token X"
|
|
re.compile(r"(\bToken\s+)([A-Za-z0-9_\-+/=]{16,})"),
|
|
# env-style secrets: INFLUX_TOKEN=..., PASSWORD=...
|
|
re.compile(r"(?i)(\b(?:INFLUX_TOKEN|PASSWORD|PASS|SECRET|API_KEY)\s*=\s*)(\S+)"),
|
|
]
|
|
# Bare long base64/url-safe blobs (Influx tokens end in "==").
|
|
_BLOB = re.compile(r"(?<![A-Za-z0-9_\-+/])[A-Za-z0-9_\-+/]{40,}={0,2}(?![A-Za-z0-9_\-+/=])")
|
|
# Pure hex runs (MACs, addresses, hashes) are not secrets.
|
|
_BLOB_ALLOW = re.compile(r"^[0-9A-Fa-f]+$")
|
|
|
|
|
|
def redact(text: str) -> str:
|
|
for rule in _RULES:
|
|
text = rule.sub(lambda m: m.group(1) + MASK, text)
|
|
|
|
def _blob(m: re.Match[str]) -> str:
|
|
s = m.group(0)
|
|
return s if _BLOB_ALLOW.search(s) else MASK
|
|
|
|
return _BLOB.sub(_blob, text)
|