Skip to content

Commit 89a07f2

Browse files
Dav1ddeDav1dde
authored
feat(pii): Add otp and two-factor to default password scrubber (#5250)
Feedback from a customer, `otp` and `two[-_]factor` are indicators for sensitive values.
1 parent 909e50f commit 89a07f2

9 files changed

+436
-10
lines changed

‎CHANGELOG.md‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -17,7 +17,8 @@
1717
- Add `sentry.origin` attribute to OTLP logs. ([#5190](https://github.com/getsentry/relay/pull/5190))
1818
- Add new iPhone 17 devices. ([#5203](https://github.com/getsentry/relay/pull/5203))
1919
- Upgrade sqlparser and improve SQL parsing for span grouping. ([#5211](https://github.com/getsentry/relay/pull/5211))
20-
- Maps `unknown_error` span status to `internal_error` ([#5202](https://github.com/getsentry/relay/pull/5202))
20+
- Maps `unknown_error` span status to `internal_error`. ([#5202](https://github.com/getsentry/relay/pull/5202))
21+
- Add `otp` and `two[-_]factor` to default scrubbing rules. ([#5250](https://github.com/getsentry/relay/pull/5250))
2122
- Add event merging logic for Playstation crashes. ([#5228](https://github.com/getsentry/relay/pull/5228))
2223

2324
**Bug Fixes**:

‎relay-pii/src/convert.rs‎

Lines changed: 32 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -278,6 +278,9 @@ THd+9FBxiHLGXNKhG/FRSyREXEt+NyYIf/0cyByc9tNksat794ddUqnLOg0vwSkv
278278
"a_password_here": "hello",
279279
"api_key": "secret_key",
280280
"apiKey": "secret_key",
281+
"otp": "otp_code",
282+
"two-factor": "otp_code",
283+
"two_factor": "otp_code",
281284
})
282285
}
283286

@@ -1904,4 +1907,33 @@ THd+9FBxiHLGXNKhG/FRSyREXEt+NyYIf/0cyByc9tNksat794ddUqnLOg0vwSkv
19041907
process_value(&mut data, &mut pii_processor, ProcessingState::root()).unwrap();
19051908
assert_annotated_snapshot!(data);
19061909
}
1910+
1911+
#[test]
1912+
fn test_password_rule_only_full_match_fields() {
1913+
let mut data = Event::from_value(
1914+
serde_json::json!({
1915+
"extra": {
1916+
"not-a-two-factor": "I am okay",
1917+
"not_a_two_factor": "I am okay",
1918+
"footpath": "I am okay",
1919+
"idiotproof": "I am okay",
1920+
}
1921+
})
1922+
.into(),
1923+
);
1924+
1925+
let pii_config = simple_enabled_pii_config();
1926+
let mut pii_processor = PiiProcessor::new(pii_config.compiled());
1927+
process_value(&mut data, &mut pii_processor, ProcessingState::root()).unwrap();
1928+
assert_annotated_snapshot!(data, @r#"
1929+
{
1930+
"extra": {
1931+
"footpath": "I am okay",
1932+
"idiotproof": "I am okay",
1933+
"not-a-two-factor": "I am okay",
1934+
"not_a_two_factor": "I am okay"
1935+
}
1936+
}
1937+
"#);
1938+
}
19071939
}

‎relay-pii/src/regexes.rs‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -336,7 +336,7 @@ regex!(BEARER_TOKEN_REGEX, r"(?i)\b(Bearer\s+)([^\s]+)");
336336

337337
regex!(
338338
PASSWORD_KEY_REGEX,
339-
r"(?i)(password|secret|passwd|api_key|apikey|auth|credentials|mysql_pwd|privatekey|private_key|token)"
339+
r"(?i)(password|secret|passwd|api_key|apikey|auth|credentials|mysql_pwd|privatekey|private_key|token|^otp$|^two[-_]factor$)"
340340
);
341341

342342
#[cfg(test)]

‎relay-pii/src/snapshots/relay_pii__convert__tests__contexts.snap‎

Lines changed: 66 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -9,71 +9,95 @@ expression: data
99
"apiKey": "secret_key",
1010
"api_key": "secret_key",
1111
"foo": "bar",
12+
"otp": "otp_code",
1213
"password": "hello",
1314
"the_secret": "hello",
15+
"two-factor": "otp_code",
16+
"two_factor": "otp_code",
1417
"type": "app"
1518
},
1619
"biz": {
1720
"a_password_here": "[Filtered]",
1821
"apiKey": "[Filtered]",
1922
"api_key": "[Filtered]",
2023
"foo": "bar",
24+
"otp": "[Filtered]",
2125
"password": "[Filtered]",
2226
"the_secret": "[Filtered]",
27+
"two-factor": "[Filtered]",
28+
"two_factor": "[Filtered]",
2329
"type": "biz"
2430
},
2531
"browser": {
2632
"a_password_here": "hello",
2733
"apiKey": "secret_key",
2834
"api_key": "secret_key",
2935
"foo": "bar",
36+
"otp": "otp_code",
3037
"password": "hello",
3138
"the_secret": "hello",
39+
"two-factor": "otp_code",
40+
"two_factor": "otp_code",
3241
"type": "browser"
3342
},
3443
"device": {
3544
"a_password_here": "hello",
3645
"apiKey": "secret_key",
3746
"api_key": "secret_key",
3847
"foo": "bar",
48+
"otp": "otp_code",
3949
"password": "hello",
4050
"the_secret": "hello",
51+
"two-factor": "otp_code",
52+
"two_factor": "otp_code",
4153
"type": "device"
4254
},
4355
"gpu": {
4456
"a_password_here": "hello",
4557
"apiKey": "secret_key",
4658
"api_key": "secret_key",
4759
"foo": "bar",
60+
"otp": "otp_code",
4861
"password": "hello",
4962
"the_secret": "hello",
63+
"two-factor": "otp_code",
64+
"two_factor": "otp_code",
5065
"type": "gpu"
5166
},
5267
"monitor": {
5368
"a_password_here": "hello",
5469
"apiKey": "secret_key",
5570
"api_key": "secret_key",
5671
"foo": "bar",
72+
"otp": "otp_code",
5773
"password": "hello",
5874
"the_secret": "hello",
75+
"two-factor": "otp_code",
76+
"two_factor": "otp_code",
5977
"type": "monitor"
6078
},
6179
"os": {
6280
"a_password_here": "hello",
6381
"apiKey": "secret_key",
6482
"api_key": "secret_key",
6583
"foo": "bar",
84+
"otp": "otp_code",
6685
"password": "hello",
6786
"the_secret": "hello",
87+
"two-factor": "otp_code",
88+
"two_factor": "otp_code",
6889
"type": "os"
6990
},
7091
"runtime": {
7192
"a_password_here": "hello",
7293
"apiKey": "secret_key",
7394
"api_key": "secret_key",
7495
"foo": "bar",
96+
"otp": "otp_code",
7597
"password": "hello",
7698
"the_secret": "hello",
99+
"two-factor": "otp_code",
100+
"two_factor": "otp_code",
77101
"type": "runtime"
78102
},
79103
"secret": null,
@@ -82,8 +106,11 @@ expression: data
82106
"apiKey": "secret_key",
83107
"api_key": "secret_key",
84108
"foo": "bar",
109+
"otp": "otp_code",
85110
"password": "hello",
86111
"the_secret": "hello",
112+
"two-factor": "otp_code",
113+
"two_factor": "otp_code",
87114
"type": "trace"
88115
}
89116
},
@@ -129,6 +156,19 @@ expression: data
129156
"len": 10
130157
}
131158
},
159+
"otp": {
160+
"": {
161+
"rem": [
162+
[
163+
"@password:filter",
164+
"s",
165+
0,
166+
10
167+
]
168+
],
169+
"len": 8
170+
}
171+
},
132172
"password": {
133173
"": {
134174
"rem": [
@@ -154,6 +194,32 @@ expression: data
154194
],
155195
"len": 5
156196
}
197+
},
198+
"two-factor": {
199+
"": {
200+
"rem": [
201+
[
202+
"@password:filter",
203+
"s",
204+
0,
205+
10
206+
]
207+
],
208+
"len": 8
209+
}
210+
},
211+
"two_factor": {
212+
"": {
213+
"rem": [
214+
[
215+
"@password:filter",
216+
"s",
217+
0,
218+
10
219+
]
220+
],
221+
"len": 8
222+
}
157223
}
158224
},
159225
"secret": {

0 commit comments

Comments
 (0)