Node / ReticulumProjects / MeshChatX.git / files / meshchatx / src / backend / log_redaction.py

Displaying Raw • Download

T8b949e# SPDX-License-Identifier: 0BSD

T8b949e"""Redact sensitive fragments from diagnostic / bug-report log text."""

Tff7b72from T7ee787__future__ Tff7b72import Te6edf3annotations

Tff7b72import T7ee787re

T8b949e# Absolute Unix/Windows path-like tokens (kept conservative to avoid eating hex).

Te6edf3_ABS_PATH_RE Tff7b72= Te6edf3reTff7b72.Td2a8ffcompileTb4b4b4(

Ta5d6ffrTa5d6ff"Ta5d6ff(?:Ta5d6ff"

Ta5d6ffrTa5d6ff"Ta5d6ff(?:/(?:home|Users|tmp|var|etc|opt|usr|root|run|mnt|media|data|srv|private|Ta5d6ff"

Ta5d6ffrTa5d6ff"Ta5d6ffVolumes|Library|Applications)[^Ta5d6ff\Ta5d6ffsTffea00\"Ta5d6ff'Ta5d6ff]*)Ta5d6ff"

Ta5d6ffrTa5d6ff"Ta5d6ff|(?:[A-Za-z]:Tffea00\\Ta5d6ff[^Ta5d6ff\Ta5d6ffsTffea00\"Ta5d6ff'Ta5d6ff]+)Ta5d6ff"

Ta5d6ffrTa5d6ff"Ta5d6ff|(?:Tffea00\\Tffea00\\Ta5d6ff[^Ta5d6ff\Ta5d6ffsTffea00\"Ta5d6ff'Ta5d6ff]+)Ta5d6ff"

Ta5d6ffrTa5d6ff"Ta5d6ff)Ta5d6ff"Tb4b4b4,

Te6edf3reTff7b72.Td2a8ffIGNORECASETb4b4b4,

Tb4b4b4)

T8b949e# Full 32-byte hex hashes (RNS destination / identity). Partial prefixes stay.

Te6edf3_FULL_HEX_HASH_RE Tff7b72= Te6edf3reTff7b72.Td2a8ffcompileTb4b4b4(Ta5d6ffrTa5d6ff"Ta5d6ff(?<![0-9a-fA-F])([0-9a-fA-F]Tffd700{64}Ta5d6ff)(?![0-9a-fA-F])Ta5d6ff"Tb4b4b4)

T8b949e# Private-key-ish long hex blobs (>= 96 hex chars continuous).

Te6edf3_LONG_HEX_RE Tff7b72= Te6edf3reTff7b72.Td2a8ffcompileTb4b4b4(Ta5d6ffrTa5d6ff"Ta5d6ff(?<![0-9a-fA-F])([0-9a-fA-F]Ta5d6ff{Ta5d6ff96,})(?![0-9a-fA-F])Ta5d6ff"Tb4b4b4)

T8b949e# Email-ish tokens.

Te6edf3_EMAIL_RE Tff7b72= Te6edf3reTff7b72.Td2a8ffcompileTb4b4b4(Ta5d6ffrTa5d6ff"Ta5d6ff\Ta5d6ffb[A-Za-z0-9._Ta5d6ff%Ta5d6ff+-]+@[A-Za-z0-9.-]+Ta5d6ff\Ta5d6ff.[A-Za-z]Ta5d6ff{Ta5d6ff2,}Ta5d6ff\Ta5d6ffbTa5d6ff"Tb4b4b4)

T8b949e# IPv4 addresses (not link-local mesh addressing; UI logs should not leak host IPs by default).

Te6edf3_IPV4_RE Tff7b72= Te6edf3reTff7b72.Td2a8ffcompileTb4b4b4(

Ta5d6ffrTa5d6ff"Ta5d6ff\Ta5d6ffb(?:(?:25[0-5]|2[0-4]Ta5d6ff\Ta5d6ffd|[01]?Ta5d6ff\Ta5d6ffdTa5d6ff\Ta5d6ffd?)Ta5d6ff\Ta5d6ff.)Tffd700{3}Ta5d6ff(?:25[0-5]|2[0-4]Ta5d6ff\Ta5d6ffd|[01]?Ta5d6ff\Ta5d6ffdTa5d6ff\Ta5d6ffd?)Ta5d6ff\Ta5d6ffbTa5d6ff"Tb4b4b4,

Tb4b4b4)

T8b949e# PEM private key / certificate blocks.

Te6edf3_PEM_RE Tff7b72= Te6edf3reTff7b72.Td2a8ffcompileTb4b4b4(

Ta5d6ffrTa5d6ff"Ta5d6ff-----BEGIN [^-]*PRIVATE KEY-----[Ta5d6ff\Ta5d6ffsTa5d6ff\Ta5d6ffS]*?-----END [^-]*PRIVATE KEY-----Ta5d6ff"Tb4b4b4,

Te6edf3reTff7b72.Td2a8ffIGNORECASETb4b4b4,

Tb4b4b4)

T8b949e# Bearer / JWT-ish tokens and common secret assignments.

Te6edf3_BEARER_RE Tff7b72= Te6edf3reTff7b72.Td2a8ffcompileTb4b4b4(Ta5d6ffrTa5d6ff"Ta5d6ff\Ta5d6ffbBearerTa5d6ff\Ta5d6ffs+[A-Za-z0-9._Ta5d6ff\Ta5d6ff-+=/]Ta5d6ff{Ta5d6ff8,}Ta5d6ff"Tb4b4b4, Te6edf3reTff7b72.Td2a8ffIGNORECASETb4b4b4)

Te6edf3_BASIC_AUTH_RE Tff7b72= Te6edf3reTff7b72.Td2a8ffcompileTb4b4b4(Ta5d6ffrTa5d6ff"Ta5d6ff\Ta5d6ffbBasicTa5d6ff\Ta5d6ffs+[A-Za-z0-9+/=]Ta5d6ff{Ta5d6ff8,}Ta5d6ff"Tb4b4b4, Te6edf3reTff7b72.Td2a8ffIGNORECASETb4b4b4)

Te6edf3_SECRET_ASSIGN_RE Tff7b72= Te6edf3reTff7b72.Td2a8ffcompileTb4b4b4(

Ta5d6ffrTa5d6ff"Ta5d6ff\Ta5d6ffb(?:alias_identity_private_key|private_key|session|password|passwd|token|Ta5d6ff"

Ta5d6ffrTa5d6ff"Ta5d6ffapi[_-]?key|csrf|authorization)Ta5d6ff\Ta5d6ffs*[:=]Ta5d6ff\Ta5d6ffs*Ta5d6ff\Ta5d6ffS+Ta5d6ff"Tb4b4b4,

Te6edf3reTff7b72.Td2a8ffIGNORECASETb4b4b4,

Tb4b4b4)

Te6edf3REDACTED Tff7b72= Ta5d6ff"Ta5d6ff[redacted]Ta5d6ff"

Tff7b72def Td2a8ffredact_diagnostic_textTb4b4b4(Te6edf3textTb4b4b4: Tffa657strTb4b4b4) Tff7b72-Tff7b72> Tffa657strTb4b4b4:

T8b949e"""Return text with paths, full hashes, emails, and IPv4s replaced.

Partial destination hashes (shorter than 64 hex chars) are left alone so

operators can still correlate short display prefixes.

"""

Tff7b72if Tff7b72not Te6edf3textTb4b4b4:

Tff7b72return Te6edf3text

Te6edf3out Tff7b72= Te6edf3_PEM_RETff7b72.Td2a8ffsubTb4b4b4(Te6edf3REDACTEDTb4b4b4, Te6edf3textTb4b4b4)

Te6edf3out Tff7b72= Te6edf3_ABS_PATH_RETff7b72.Td2a8ffsubTb4b4b4(Te6edf3REDACTEDTb4b4b4, Te6edf3outTb4b4b4)

Te6edf3out Tff7b72= Te6edf3_LONG_HEX_RETff7b72.Td2a8ffsubTb4b4b4(Te6edf3REDACTEDTb4b4b4, Te6edf3outTb4b4b4)

Te6edf3out Tff7b72= Te6edf3_FULL_HEX_HASH_RETff7b72.Td2a8ffsubTb4b4b4(Te6edf3REDACTEDTb4b4b4, Te6edf3outTb4b4b4)

Te6edf3out Tff7b72= Te6edf3_EMAIL_RETff7b72.Td2a8ffsubTb4b4b4(Te6edf3REDACTEDTb4b4b4, Te6edf3outTb4b4b4)

Te6edf3out Tff7b72= Te6edf3_IPV4_RETff7b72.Td2a8ffsubTb4b4b4(Te6edf3REDACTEDTb4b4b4, Te6edf3outTb4b4b4)

Te6edf3out Tff7b72= Te6edf3_BEARER_RETff7b72.Td2a8ffsubTb4b4b4(Ta5d6fffTa5d6ff"Ta5d6ffBearer Tffd700{Te6edf3REDACTEDTffd700}Ta5d6ff"Tb4b4b4, Te6edf3outTb4b4b4)

Te6edf3out Tff7b72= Te6edf3_BASIC_AUTH_RETff7b72.Td2a8ffsubTb4b4b4(Ta5d6fffTa5d6ff"Ta5d6ffBasic Tffd700{Te6edf3REDACTEDTffd700}Ta5d6ff"Tb4b4b4, Te6edf3outTb4b4b4)

Te6edf3out Tff7b72= Te6edf3_SECRET_ASSIGN_RETff7b72.Td2a8ffsubTb4b4b4(Te6edf3REDACTEDTb4b4b4, Te6edf3outTb4b4b4)

Tff7b72return Te6edf3out