mirror of
https://github.com/rustfs/rustfs.git
synced 2026-08-30 00:47:13 +00:00
Zhengchao An
45c03ca37f
test(obs): replace source-text logging tests with logging guardrail script coverage The seven fs::read_to_string source-text tests in crates/obs/src/logging.rs asserted retired logging patterns and required structured-logging fields across 13 files in other crates, four of them reverse reads into the rustfs binary crate. Their patterns are now enforced by scripts/check_logging_guardrails.sh, which runs in pre-commit and CI, covers the same files through checked_files plus require_patterns, and does not silently lapse when a governed file moves. Part of rustfs/backlog#1884.
101 lines
3.7 KiB
Rust
101 lines
3.7 KiB
Rust
// Copyright 2024 RustFS Team
|
|
//
|
|
// Licensed under the Apache License, Version 2.0 (the "License");
|
|
// you may not use this file except in compliance with the License.
|
|
// You may obtain a copy of the License at
|
|
//
|
|
// http://www.apache.org/licenses/LICENSE-2.0
|
|
//
|
|
// Unless required by applicable law or agreed to in writing, software
|
|
// distributed under the License is distributed on an "AS IS" BASIS,
|
|
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
|
// See the License for the specific language governing permissions and
|
|
// limitations under the License.
|
|
|
|
use rustfs_security_governance::{RedactionLevel, RedactionPolicyError, RedactionRule, validate_redaction_rules};
|
|
pub use rustfs_utils::MaskedAccessKey;
|
|
|
|
pub const REDACTED_LOG_VALUE: &str = "***redacted***";
|
|
|
|
pub const LOGGING_REDACTION_RULES: &[RedactionRule] = &[
|
|
RedactionRule::new("access_key", RedactionLevel::Sensitive, "principal identifiers should be masked in logs"),
|
|
RedactionRule::new(
|
|
"authorization",
|
|
RedactionLevel::Secret,
|
|
"authorization headers may carry bearer or signature material",
|
|
),
|
|
RedactionRule::new(
|
|
"client_secret",
|
|
RedactionLevel::Secret,
|
|
"OIDC and external provider client secrets must never be logged",
|
|
),
|
|
RedactionRule::new("secret_key", RedactionLevel::Secret, "secret access keys must never be logged"),
|
|
RedactionRule::new(
|
|
"session_token",
|
|
RedactionLevel::Secret,
|
|
"session tokens can be replayed if exposed in logs",
|
|
),
|
|
RedactionRule::new("token", RedactionLevel::Secret, "generic token fields are treated as secret by default"),
|
|
];
|
|
|
|
pub fn validate_logging_redaction_rules() -> Result<(), RedactionPolicyError> {
|
|
validate_redaction_rules(LOGGING_REDACTION_RULES)
|
|
}
|
|
|
|
pub fn is_sensitive_log_field(field_name: &str) -> bool {
|
|
LOGGING_REDACTION_RULES
|
|
.iter()
|
|
.any(|rule| rule.field().eq_ignore_ascii_case(field_name.trim()) && rule.level().requires_redaction())
|
|
}
|
|
|
|
pub fn redacted_log_value(value: &str) -> &'static str {
|
|
if value.is_empty() { "" } else { REDACTED_LOG_VALUE }
|
|
}
|
|
|
|
pub fn redacted_optional_log_value(value: Option<&str>) -> Option<&'static str> {
|
|
value.map(redacted_log_value)
|
|
}
|
|
|
|
#[cfg(test)]
|
|
mod tests {
|
|
use super::*;
|
|
|
|
#[test]
|
|
fn logging_redaction_rules_are_valid() {
|
|
assert!(validate_logging_redaction_rules().is_ok());
|
|
}
|
|
|
|
#[test]
|
|
fn identifies_sensitive_log_fields_case_insensitively() {
|
|
assert!(is_sensitive_log_field("access_key"));
|
|
assert!(is_sensitive_log_field("Authorization"));
|
|
assert!(is_sensitive_log_field("session_token"));
|
|
assert!(!is_sensitive_log_field("bucket"));
|
|
assert!(!is_sensitive_log_field("status_code"));
|
|
}
|
|
|
|
#[test]
|
|
fn redacted_log_value_preserves_empty_values() {
|
|
assert_eq!(redacted_log_value(""), "");
|
|
assert_eq!(redacted_log_value("secret"), REDACTED_LOG_VALUE);
|
|
assert_eq!(redacted_optional_log_value(None), None);
|
|
assert_eq!(redacted_optional_log_value(Some("")), Some(""));
|
|
assert_eq!(redacted_optional_log_value(Some("secret")), Some(REDACTED_LOG_VALUE));
|
|
}
|
|
|
|
#[test]
|
|
fn masked_access_key_masks_short_values() {
|
|
assert_eq!(MaskedAccessKey("").to_string(), "");
|
|
assert_eq!(MaskedAccessKey("a").to_string(), "***");
|
|
assert_eq!(MaskedAccessKey("abcd").to_string(), "***");
|
|
assert_eq!(MaskedAccessKey("abcde").to_string(), "a***e");
|
|
assert_eq!(MaskedAccessKey("abcdefgh").to_string(), "a***h");
|
|
}
|
|
|
|
#[test]
|
|
fn masked_access_key_masks_long_values() {
|
|
assert_eq!(MaskedAccessKey("AKIAIOSFODNN7EXAMPLE").to_string(), "AKIA***MPLE");
|
|
assert_eq!(format!("{:?}", MaskedAccessKey("keystone:user-1234")), "keys***1234");
|
|
}
|
|
}
|