-
Notifications
You must be signed in to change notification settings - Fork 662
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
socket-mode(fix): redact ephemeral tokens and secrets from debug logs #1832
base: main
Are you sure you want to change the base?
Changes from 3 commits
d097cd6
b4718d8
e7a1166
3147e08
File filter
Filter by extension
Conversations
Jump to
Diff view
Diff view
There are no files selected for viewing
Original file line number | Diff line number | Diff line change |
---|---|---|
|
@@ -284,8 +284,6 @@ | |
this.logger.debug('Unexpected binary message received, ignoring.'); | ||
return; | ||
} | ||
const payload = data.toString(); | ||
this.logger.debug(`Received a message on the WebSocket: ${payload}`); | ||
|
||
// Parse message into slack event | ||
let event: { | ||
|
@@ -299,10 +297,13 @@ | |
accepts_response_payload?: boolean; // type: events_api, slash_commands, interactive | ||
}; | ||
|
||
const payload = data?.toString(); | ||
try { | ||
event = JSON.parse(payload); | ||
this.logger.debug(`Received a message on the WebSocket: ${JSON.stringify(SocketModeClient.redact(event))}`); | ||
} catch (parseError) { | ||
// Prevent application from crashing on a bad message, but log an error to bring attention | ||
this.logger.debug(`Received a message on the WebSocket: ${payload}`); | ||
this.logger.debug( | ||
`Unable to parse an incoming WebSocket message (will ignore): ${parseError}, ${payload}`, | ||
); | ||
|
@@ -325,7 +326,7 @@ | |
// Define Ack, a helper method for acknowledging events incoming from Slack | ||
const ack = async (response: Record<string, unknown>): Promise<void> => { | ||
if (this.logger.getLevel() === LogLevel.DEBUG) { | ||
this.logger.debug(`Calling ack() - type: ${event.type}, envelope_id: ${event.envelope_id}, data: ${JSON.stringify(response)}`); | ||
this.logger.debug(`Calling ack() - type: ${event.type}, envelope_id: ${event.envelope_id}, data: ${JSON.stringify(SocketModeClient.redact(response))}`); | ||
} | ||
await this.send(event.envelope_id, response); | ||
}; | ||
|
@@ -386,9 +387,8 @@ | |
} else { | ||
this.emit('outgoing_message', message); | ||
|
||
const flatMessage = JSON.stringify(message); | ||
this.logger.debug(`Sending a WebSocket message: ${flatMessage}`); | ||
this.websocket.send(flatMessage, (error) => { | ||
this.logger.debug(`Sending a WebSocket message: ${JSON.stringify(SocketModeClient.redact(message))}`); | ||
this.websocket.send(JSON.stringify(message), (error) => { | ||
if (error) { | ||
this.logger.error(`Failed to send a WebSocket message (error: ${error})`); | ||
return reject(websocketErrorWithOriginal(error)); | ||
|
@@ -398,6 +398,37 @@ | |
} | ||
}); | ||
} | ||
|
||
/** | ||
* Removes secrets and tokens from socket request and response objects | ||
* before logging. | ||
* @param body - the object with values for redaction. | ||
* @returns the same object with redacted values. | ||
*/ | ||
private static redact(body?: Record<string, unknown>): Record<string, unknown> | unknown[] | undefined { | ||
if (body === undefined || body === null) { | ||
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. The type of the There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. Great callout with the optional |
||
return body; | ||
} | ||
const record = Object.create(body); | ||
if (Array.isArray(body)) { | ||
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. Same question as above: should There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. Not directly, but it's possible that keys somewhere within the body contain an Array, which would be hit in some recursive case. Possibly with details from |
||
return body.map((item) => ( | ||
(typeof item === 'object' && item !== null) ? | ||
SocketModeClient.redact(item as Record<string, unknown>) : | ||
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. I think you may require type casting here because my previous comment is unaddressed: if I know that in a variety of places within node-slack-sdk and bolt-js today we use type casting liberally. In general (not that I'm a TS expert) my understanding is type casting is a sign that the types of variables are not thorough enough. Moving forward with the node SDK and bolt-js, I would like for us to, when possible, consider type casting as a last resort and avoid them. There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. Found the PR that fixes some coverups caused by blunt casting! slackapi/bolt-js#1806 I am wary of casting and ought to take this lesson to heart more 😳 |
||
item | ||
)); | ||
} | ||
Object.keys(body).forEach((key: string) => { | ||
const value = body[key]; | ||
if (typeof value === 'object' && value !== null) { | ||
record[key] = SocketModeClient.redact(value as Record<string, unknown>); | ||
} else if (key.match(/.*token.*/) !== null || key.match(/secret/)) { | ||
record[key] = '[[REDACTED]]'; | ||
} else { | ||
record[key] = value; | ||
} | ||
}); | ||
return record; | ||
} | ||
} | ||
|
||
/* Instrumentation */ | ||
|
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
What may help in this function is to define a recursive utility type that encapsulates
Record<string, unknown>
; something that signifies "an array of objects that itself can contain objects (..and so on), or an object that itself can contain objects (..and so on)." I think that could help you eliminate the type casting below. Perhaps something like:In theory, in my head, this could be helpful to hint to TS how to derive types as you dissect the thing to redact. I have hit problems with recursive types in TS before, but give it a shot and see if that helps!
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
I wanted this to work... Found that recursive types sometimes won't work? It might be caused by a certain version of TS cause it seemed to have worked in some earlier version but not in this version 😢