fix(security): redact secrets from exported logs

go_backend/log_progress_timeout_supplement_test.go

@@ -26,6 +26,8 @@ func TestLogBufferExportedHelpersAndRedaction(t *testing.T) {
 	LogDebug("debug", "client_secret=secret")
 	LogWarn("warn", "warning password=secret")
 	GoLog("[GoTag] success token=abc")
+	LogError("json", `{"access_token":"json-secret","session_secret":"session-secret"}`)
+	LogError("query", "https://example.test/?X-Amz-Signature=signed-secret&X-Amz-Security-Token=session-token")
 
 	var entries []LogEntry
 	if err := json.Unmarshal([]byte(GetLogBuffer().GetAll()), &entries); err != nil {
@@ -35,7 +37,7 @@ func TestLogBufferExportedHelpersAndRedaction(t *testing.T) {
 		t.Fatalf("expected log entries, got %#v", entries)
 	}
 	for _, entry := range entries {
-		if strings.Contains(entry.Message, "secret-token") || strings.Contains(entry.Message, "api_key=value") || strings.Contains(entry.Message, "password=secret") {
+		if strings.Contains(entry.Message, "secret-token") || strings.Contains(entry.Message, "api_key=value") || strings.Contains(entry.Message, "password=secret") || strings.Contains(entry.Message, "json-secret") || strings.Contains(entry.Message, "session-secret") || strings.Contains(entry.Message, "signed-secret") || strings.Contains(entry.Message, "session-token") {
 			t.Fatalf("log was not redacted: %#v", entry)
 		}
 	}

go_backend/logbuffer.go

@@ -35,8 +35,8 @@ var (
 	logBufferOnce   sync.Once
 
 	authorizationBearerPattern = regexp.MustCompile(`(?i)\bAuthorization\b\s*[:=]\s*Bearer\s+[A-Za-z0-9._~+/\-]+=*`)
-	genericKeyValuePattern     = regexp.MustCompile(`(?i)\b(access[_\s-]?token|refresh[_\s-]?token|id[_\s-]?token|client[_\s-]?secret|authorization|password|api[_\s-]?key)\b(\s*[:=]\s*)([^\s,;]+)`)
-	queryTokenPattern          = regexp.MustCompile(`(?i)([?&](?:access_token|refresh_token|id_token|token|client_secret|api_key|apikey|password)=)[^&\s]+`)
+	genericKeyValuePattern     = regexp.MustCompile(`(?i)("?(?:access[_\s-]?token|refresh[_\s-]?token|id[_\s-]?token|client[_\s-]?secret|authorization|password|api[_\s-]?key|session[_\s-]?secret|cookie|set-cookie)"?)(\s*[:=]\s*)("(?:\\.|[^"\\])*"|[^\s,;}\]]+)`)
+	queryTokenPattern          = regexp.MustCompile(`(?i)([?&](?:access_token|refresh_token|id_token|token|client_secret|api_key|apikey|password|code|grant|sig|signature|x-amz-signature|x-amz-credential|x-amz-security-token|awsaccesskeyid|googleaccessid|policy|key-pair-id)=)[^&\s]+`)
 	bearerTokenPattern         = regexp.MustCompile(`(?i)\bBearer\s+[A-Za-z0-9._~+/\-]+=*`)
 )
 

lib/utils/logger.dart

@@ -16,12 +16,12 @@ final RegExp _authorizationBearerPattern = RegExp(
 );
 
 final RegExp _genericSensitiveKeyValuePattern = RegExp(
-  r'\b(access[_\s-]?token|refresh[_\s-]?token|id[_\s-]?token|client[_\s-]?secret|authorization|password|api[_\s-]?key)\b(\s*[:=]\s*)([^\s,;]+)',
+  r'("?(?:access[_\s-]?token|refresh[_\s-]?token|id[_\s-]?token|client[_\s-]?secret|authorization|password|api[_\s-]?key|session[_\s-]?secret|cookie|set-cookie)"?)(\s*[:=]\s*)("(?:\\.|[^"\\])*"|[^\s,;}\]]+)',
   caseSensitive: false,
 );
 
 final RegExp _sensitiveQueryPattern = RegExp(
-  r'([?&](?:access_token|refresh_token|id_token|token|client_secret|api_key|apikey|password)=)[^&\s]+',
+  r'([?&](?:access_token|refresh_token|id_token|token|client_secret|api_key|apikey|password|code|grant|sig|signature|x-amz-signature|x-amz-credential|x-amz-security-token|awsaccesskeyid|googleaccessid|policy|key-pair-id)=)[^&\s]+',
   caseSensitive: false,
 );