145 lines
4.0 KiB
Dart
145 lines
4.0 KiB
Dart
class LogRedactionManager {
|
|
static final Set<String> _tokens = <String>{};
|
|
static final Set<String> _urls = <String>{};
|
|
static final Set<String> _customValues = <String>{};
|
|
static final RegExp _ipv4Pattern = RegExp(
|
|
r'\b(\d{1,3})([.-])(\d{1,3})\2(\d{1,3})\2(\d{1,3})\b',
|
|
);
|
|
static final RegExp _ipv4HostPattern = RegExp(r'^\d{1,3}([.-]\d{1,3}){3}$');
|
|
|
|
/// Register a server access token or Plex.tv token for redaction.
|
|
static void registerToken(String? token) {
|
|
final normalized = _normalize(token);
|
|
if (normalized == null) return;
|
|
|
|
_tokens.add(normalized);
|
|
|
|
// Tokens often appear URL encoded in query params.
|
|
final encoded = Uri.encodeQueryComponent(normalized);
|
|
if (encoded != normalized) {
|
|
_tokens.add(encoded);
|
|
}
|
|
}
|
|
|
|
/// Register the server/base URL currently in use.
|
|
static void registerServerUrl(String? url) {
|
|
final normalized = _normalize(url);
|
|
if (normalized == null) return;
|
|
|
|
final uri = Uri.tryParse(normalized);
|
|
final host = uri?.host;
|
|
if (host != null && host.isNotEmpty && _isIpv4Like(host)) {
|
|
// Do not register full IP-based URLs; regex redaction handles them.
|
|
return;
|
|
}
|
|
|
|
if (host == null && _isIpv4Like(normalized)) {
|
|
return;
|
|
}
|
|
|
|
final strippedSlash = normalized.endsWith('/')
|
|
? normalized.substring(0, normalized.length - 1)
|
|
: normalized;
|
|
|
|
if (strippedSlash.isNotEmpty) {
|
|
_urls.add(strippedSlash);
|
|
_urls.add('$strippedSlash/'); // Include trailing slash variant.
|
|
}
|
|
|
|
// Capture origin and host-level strings as well to cover most cases.
|
|
if (uri != null && uri.host.isNotEmpty) {
|
|
final origin =
|
|
'${uri.scheme.isEmpty ? 'https' : uri.scheme}://${uri.host}${uri.hasPort ? ':${uri.port}' : ''}';
|
|
_urls.add(origin);
|
|
if (origin.endsWith('/')) {
|
|
_urls.add(origin.substring(0, origin.length - 1));
|
|
}
|
|
}
|
|
}
|
|
|
|
/// Register other sensitive values that need redaction.
|
|
static void registerCustomValue(String? value) {
|
|
final normalized = _normalize(value);
|
|
if (normalized == null) return;
|
|
_customValues.add(normalized);
|
|
}
|
|
|
|
/// Reset any tracked sensitive values (e.g., on logout).
|
|
static void clearTrackedValues() {
|
|
_tokens.clear();
|
|
_urls.clear();
|
|
_customValues.clear();
|
|
}
|
|
|
|
/// Redact known sensitive values from the provided message.
|
|
static String redact(String message) {
|
|
var redacted = message;
|
|
|
|
redacted = redacted.replaceAllMapped(
|
|
_ipv4Pattern,
|
|
(match) => _maskIpv4(match.group(1)!, match.group(2)!, match.group(5)!),
|
|
);
|
|
|
|
for (final url in _urls) {
|
|
redacted = redacted.replaceAll(url, _maskUrlPreview(url));
|
|
}
|
|
|
|
for (final token in _tokens) {
|
|
redacted = redacted.replaceAll(token, '[REDACTED_TOKEN]');
|
|
}
|
|
|
|
for (final custom in _customValues) {
|
|
redacted = redacted.replaceAll(custom, '[REDACTED]');
|
|
}
|
|
|
|
return redacted;
|
|
}
|
|
|
|
static String? _normalize(String? value) {
|
|
if (value == null) return null;
|
|
final trimmed = value.trim();
|
|
if (trimmed.isEmpty) return null;
|
|
return trimmed;
|
|
}
|
|
|
|
static bool _isIpv4Like(String value) {
|
|
return _ipv4HostPattern.hasMatch(value);
|
|
}
|
|
|
|
static String _maskIpv4(String first, String separator, String last) {
|
|
return '$first$separator'
|
|
'x$separator'
|
|
'x$separator'
|
|
'$last';
|
|
}
|
|
|
|
static String _maskUrlPreview(String url) {
|
|
const startPreviewLength = 12;
|
|
const endPreviewLength = 8;
|
|
|
|
if (url.isEmpty) {
|
|
return '[REDACTED_URL]';
|
|
}
|
|
|
|
if (url.length <= 4) {
|
|
return '[REDACTED_URL]';
|
|
}
|
|
|
|
final startLength = url.length <= startPreviewLength
|
|
? (url.length / 2).ceil()
|
|
: startPreviewLength;
|
|
final remainingForEnd = url.length - startLength;
|
|
final endLength = remainingForEnd <= endPreviewLength
|
|
? remainingForEnd
|
|
: endPreviewLength;
|
|
|
|
final start = url.substring(0, startLength);
|
|
if (endLength <= 0) {
|
|
return '$start...[REDACTED_URL]';
|
|
}
|
|
|
|
final end = url.substring(url.length - endLength);
|
|
return '$start...[REDACTED_URL]...$end';
|
|
}
|
|
}
|