Merge pull request #5828 from snyk/chore/CLI-820_logheader

PeterSchafer · web-flow · commit 3d6add921abe · 2025-04-10T22:13:45.000+02:00
chore: Change redaction logic to avoid false positive secret detection in log files
diff --git a/cliv2/cmd/cliv2/logheaderfooter.go b/cliv2/cmd/cliv2/logheaderfooter.go
@@ -13,18 +13,25 @@ import (
 	"strconv"
 	"strings"
 
-	"github.com/snyk/cli/cliv2/internal/cliv2"
-	"github.com/snyk/cli/cliv2/internal/utils"
 	"github.com/snyk/error-catalog-golang-public/snyk_errors"
 	"github.com/snyk/go-application-framework/pkg/auth"
 	"github.com/snyk/go-application-framework/pkg/configuration"
 	"github.com/snyk/go-application-framework/pkg/local_workflows/config_utils"
 
+	"github.com/snyk/cli/cliv2/internal/cliv2"
+	"github.com/snyk/cli/cliv2/internal/utils"
+
 	localworkflows "github.com/snyk/go-application-framework/pkg/local_workflows"
 	"github.com/snyk/go-application-framework/pkg/networking"
 	"github.com/snyk/go-application-framework/pkg/networking/fips"
 )
 
+func redactAuthorizationTokens(token string) string {
+	temp := sha256.Sum256([]byte(token))
+	tokenShaSum := fmt.Sprintf("%s***%s", hex.EncodeToString(temp[0:4]), hex.EncodeToString(temp[12:16]))
+	return tokenShaSum
+}
+
 func logHeaderAuthorizationInfo(
 	config configuration.Configuration,
 	networkAccess networking.NetworkAccess,
@@ -47,18 +54,16 @@ func logHeaderAuthorizationInfo(
 	if len(splitHeader) == 2 {
 		tokenType := splitHeader[0]
 		token := splitHeader[1]
-		temp := sha256.Sum256([]byte(token))
-		tokenShaSum = hex.EncodeToString(temp[0:16]) + "[...]"
+		tokenShaSum = redactAuthorizationTokens(token)
 		tokenDetails = fmt.Sprintf(" (type=%s)", tokenType)
 	}
 
 	if config.GetBool(configuration.FF_OAUTH_AUTH_FLOW_ENABLED) {
 		oauthEnabled = "Enabled"
 		token, err := auth.GetOAuthToken(config)
 		if token != nil && err == nil {
+			tokenShaSum = redactAuthorizationTokens(token.AccessToken)
 			tokenDetails = fmt.Sprintf(" (type=oauth; expiry=%v)", token.Expiry.UTC())
-			temp := sha256.Sum256([]byte(token.AccessToken))
-			tokenShaSum = hex.EncodeToString(temp[0:16]) + "[...]"
 		}
 	}
 
