F #7106: remove user sensitive data in FireEdge logs (#3712)

Co-authored-by: Tino Vázquez <cvazquez@opennebula.io>

Author: jloboescalona2

src/fireedge/src/server/routes/entrypoints/Api/xmlrpc.js

@@ -29,6 +29,7 @@ const { fillResourceforHookConnection } = require('server/utils/opennebula')
 const { httpResponse, validateHttpMethod } = require('server/utils/server')
 const { useWorker, parseReturnWorker } = require('server/utils/worker')
 const {
+  removeSensitiveData,
   writeInLogger,
   writeInLoggerInvalidRPC,
 } = require('server/utils/logger')
@@ -71,10 +72,17 @@ const executeWorker = ({
     worker.terminate()
     const err = result && result.data && result.data.err
     const value = result && result.data && result.data.value
-    writeInLogger([command, paramsCommand, JSON.stringify(value)], {
-      format: 'worker: %s, [%s]: %s',
-      level: 2,
-    })
+    writeInLogger(
+      [
+        command,
+        removeSensitiveData(command, paramsCommand),
+        JSON.stringify(value),
+      ],
+      {
+        format: 'worker: %s, [%s]: %s',
+        level: 2,
+      }
+    )
     if (!err) {
       fillResourceforHookConnection(user, command, paramsCommand)
       res.locals.httpCode = parseReturnWorker(value)

src/fireedge/src/server/utils/constants/defaults.js

@@ -108,6 +108,12 @@ const defaults = {
   defaultLogMessageLength: 100,
   defaultTypeLog: 'prod',
   defaultWebpackMode: 'development',
+  defaultSensitiveDataForXMLRPC: [
+    {
+      regex: /^user\.allocate/,
+      maskIndex: 1,
+    },
+  ],
   defaultProductionWebpackMode: 'production',
   defaultWebpackDevTool: 'inline-source-map',
   defaultLogPath: '/var/log/one',

src/fireedge/src/server/utils/logger.js

@@ -22,8 +22,12 @@ const { sprintf } = require('sprintf-js')
 const morgan = require('morgan')
 const _ = require('lodash')
 const { defaults } = require('server/utils/constants')
-const { defaultWebpackMode, defaultLogsLevels, defaultLogMessageLength } =
-  defaults
+const {
+  defaultWebpackMode,
+  defaultLogsLevels,
+  defaultLogMessageLength,
+  defaultSensitiveDataForXMLRPC,
+} = defaults
 
 let logger = null
 
@@ -141,6 +145,28 @@ const writeInLogger = (message = '', optLog = {}) => {
   }
 }
 
+/**
+ * This function removes sensitive data from the logs.
+ *
+ * @param {string} command - XMLRPC command
+ * @param {string[]} paramCommands - XMLRPC parameters
+ * @returns {string[]} - Parameters with sensitive data masked
+ */
+const removeSensitiveData = (command = '', paramCommands = []) => {
+  const match = defaultSensitiveDataForXMLRPC.find(({ regex }) =>
+    regex.test(command)
+  )
+
+  if (!match) return paramCommands
+
+  const result = [...paramCommands]
+  if (match.maskIndex >= 0 && match.maskIndex < result.length) {
+    result[match.maskIndex] = '*****'
+  }
+
+  return result
+}
+
 /**
  * Write in logger when XMLRPC is invalid.
  *
@@ -158,6 +184,7 @@ module.exports = {
   initLogger,
   getLogger,
   getLoggerMiddleware,
+  removeSensitiveData,
   writeInLogger,
   writeInLoggerInvalidRPC,
 }