Merge pull request #1027 from github/timrogers/sanitiize-logs-urlencoded

Improve log secret sanitization to remove secrets that have been URL encoded

RELEASENOTES.md

@@ -1 +1,2 @@
-- Warn when the `--ssh-port` argument for `bbs2gh migrate-repo` and `bbs2gh generate-script` is set to the default port for Git operations
+- Improve log sanitization to also remove secret values that have been URL encoded
+- Warn when the `--ssh-port` argument for `bbs2gh migrate-repo` and `bbs2gh generate-script` is set to the default port for Git operations

src/Octoshift/Services/OctoLogger.cs

@@ -83,7 +83,8 @@ private string MaskSecrets(string msg)
 
         foreach (var secret in _secrets.Where(x => x is not null))
         {
-            result = result.Replace(secret, "***");
+            result = result.Replace(secret, "***")
+                .Replace(Uri.EscapeDataString(secret), "***");
         }
 
         return result;

src/OctoshiftCLI.Tests/Octoshift/Services/OctoLoggerTests.cs

@@ -25,25 +25,39 @@ public OctoLoggerTests()
     public void Secrets_Should_Be_Masked_From_Logs_And_Console()
     {
         var secret = "purplemonkeydishwasher";
+        var urlEncodedSecret = Uri.EscapeDataString(secret);
 
         _octoLogger.RegisterSecret(secret);
 
         _octoLogger.Verbose = false;
         _octoLogger.LogInformation($"Don't tell anybody that {secret} is my password");
+        _octoLogger.LogInformation($"Don't tell anyone that {urlEncodedSecret} is my URL encoded password");
         _octoLogger.LogVerbose($"Don't tell anybody that {secret} is my password");
+        _octoLogger.LogVerbose($"Don't tell anyone that {urlEncodedSecret} is my URL encoded password");
         _octoLogger.LogWarning($"Don't tell anybody that {secret} is my password");
+        _octoLogger.LogWarning($"Don't tell anyone that {urlEncodedSecret} is my URL encoded password");
         _octoLogger.LogSuccess($"Don't tell anybody that {secret} is my password");
+        _octoLogger.LogSuccess($"Don't tell anyone that {urlEncodedSecret} is my URL encoded password");
         _octoLogger.LogError($"Don't tell anybody that {secret} is my password");
+        _octoLogger.LogError($"Don't tell anyone that {urlEncodedSecret} is my URL encoded password");
         _octoLogger.LogError(new OctoshiftCliException($"Don't tell anybody that {secret} is my password"));
+        _octoLogger.LogError(new OctoshiftCliException($"Don't tell anyone that {urlEncodedSecret} is my URL encoded password"));
         _octoLogger.LogError(new InvalidOperationException($"Don't tell anybody that {secret} is my password"));
+        _octoLogger.LogError(new InvalidOperationException($"Don't tell anyone that {urlEncodedSecret} is my URL encoded password"));
 
         _octoLogger.Verbose = true;
         _octoLogger.LogVerbose($"Don't tell anybody that {secret} is my password");
+        _octoLogger.LogVerbose($"Don't tell anyone that {urlEncodedSecret} is my URL encoded password");
 
         _consoleOutput.Should().NotContain(secret);
         _logOutput.Should().NotContain(secret);
         _verboseLogOutput.Should().NotContain(secret);
         _consoleError.Should().NotContain(secret);
+
+        _consoleOutput.Should().NotContain(urlEncodedSecret);
+        _logOutput.Should().NotContain(urlEncodedSecret);
+        _verboseLogOutput.Should().NotContain(urlEncodedSecret);
+        _consoleError.Should().NotContain(urlEncodedSecret);
     }
 
     [Fact]