Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

utils: Ensure JWT redaction for error messages #1768

Merged
merged 23 commits into from
Aug 15, 2024
Merged

Conversation

MicroFish91
Copy link
Contributor

@MicroFish91 MicroFish91 commented Aug 13, 2024

Ensure anything resembling a JWT is automatically redacted from errors before submitting to telemetry

@MicroFish91 MicroFish91 changed the title utils: Ensure anything resembling a JWT is automatically redacted from errors before submitting to telemetry utils: Add JWT redaction for telemetry errors Aug 13, 2024
@MicroFish91 MicroFish91 changed the title utils: Add JWT redaction for telemetry errors utils: Add JWT redaction for error messages Aug 13, 2024
@MicroFish91 MicroFish91 marked this pull request as ready for review August 13, 2024 21:50
@MicroFish91 MicroFish91 requested a review from a team as a code owner August 13, 2024 21:50
@MicroFish91 MicroFish91 changed the title utils: Add JWT redaction for error messages utils: Ensure JWT redaction for error messages Aug 13, 2024
utils/src/masking.ts Outdated Show resolved Hide resolved
Copy link
Member

@nturinski nturinski left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I assumed that they were fake tokens, but I did double-check to verify that they were. I am concerned that cred-scan is going to flag us for having PAT in our code now even if it is for testing purposes.

@MicroFish91
Copy link
Contributor Author

MicroFish91 commented Aug 15, 2024

I assumed that they were fake tokens, but I did double-check to verify that they were. I am concerned that cred-scan is going to flag us for having PAT in our code now even if it is for testing purposes.

Yeah fake credentials, but valid JWTs.

I think it will be okay because of this inclusion in the CredScanSuppressions.json:

{
    "file": "utils\\test\\masking.test.ts",
    "_justification": "Fake credentials used for unit tests."
}

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants