Merge pull request #132 from SammyK/obfuscate-memcached-keys

Add key obfuscation to Memcached integration
DataDog · Nov 21, 2018 · 52dd285 · 52dd285
2 parents c29a477 + 36753af
commit 52dd285
Show file tree

Hide file tree

Showing 4 changed files with 105 additions and 62 deletions.
diff --git a/src/DDTrace/Integrations/Memcached/MemcachedIntegration.php b/src/DDTrace/Integrations/Memcached/MemcachedIntegration.php
@@ -4,6 +4,7 @@
 
 use DDTrace\Tags;
 use DDTrace\Types;
+use DDTrace\Obfuscation;
 use OpenTracing\GlobalTracer;
 
 /**
@@ -204,13 +205,10 @@ public static function traceCommand($memcached, $command, $args)
         $span->setTag(Tags\SERVICE_NAME, 'memcached');
         $span->setTag('memcached.command', $command);
 
-        if (is_array($args[0])) {
-            $key = implode(' ', $args[0]);
-        } else {
-            $key = $args[0];
-            self::setServerTagsByKey($span, $memcached, $key);
+        if (!is_array($args[0])) {
+            self::setServerTagsByKey($span, $memcached, $args[0]);
         }
-        $span->setTag('memcached.query', "$command $key");
+        $span->setTag('memcached.query', "$command " . Obfuscation::toObfuscatedString($args[0]));
         $span->setResource($command);
 
         try {
@@ -233,8 +231,7 @@ public static function traceCommandByKey($memcached, $command, $args)
         $span->setTag('memcached.server_key', $args[0]);
         self::setServerTagsByKey($span, $memcached, $args[0]);
 
-        $key = is_array($args[1]) ? implode(' ', $args[1]) : $args[1];
-        $span->setTag('memcached.query', "$command $key");
+        $span->setTag('memcached.query', "$command " . Obfuscation::toObfuscatedString($args[1]));
         $span->setResource($command);
 
         try {
@@ -256,9 +253,8 @@ public static function traceCas($memcached, $args)
         $span->setTag('memcached.command', 'cas');
         $span->setTag('memcached.cas_token', $args[0]);
 
-        $key = $args[1];
-        self::setServerTagsByKey($span, $memcached, $key);
-        $span->setTag('memcached.query', "cas $key");
+        self::setServerTagsByKey($span, $memcached, $args[1]);
+        $span->setTag('memcached.query', 'cas ?');
         $span->setResource('cas');
 
         try {
@@ -281,9 +277,8 @@ public static function traceCasByKey($memcached, $args)
         $span->setTag('memcached.cas_token', $args[0]);
 
         $serverKey = $args[1];
-        $key = $args[2];
         $span->setTag('memcached.server_key', $serverKey);
-        $span->setTag('memcached.query', "casByKey $key");
+        $span->setTag('memcached.query', 'casByKey ?');
         $span->setResource('casByKey');
         self::setServerTagsByKey($span, $memcached, $serverKey);
 
@@ -305,7 +300,7 @@ public static function traceMulti($memcached, $command, $args)
         $span->setTag(Tags\SERVICE_NAME, 'memcached');
         $span->setTag('memcached.command', $command);
 
-        $query = "$command " . implode(',', self::extractKeys($args[0]));
+        $query = "$command " . Obfuscation::toObfuscatedString($args[0], ',');
         $span->setTag('memcached.query', $query);
         $span->setResource($command);
 
@@ -329,7 +324,7 @@ public static function traceMultiByKey($memcached, $command, $args)
         $span->setTag('memcached.server_key', $args[0]);
         self::setServerTagsByKey($span, $memcached, $args[0]);
 
-        $query = "$command " . implode(',', self::extractKeys($args[1]));
+        $query = "$command " . Obfuscation::toObfuscatedString($args[1], ',');
         $span->setTag('memcached.query', $query);
         $span->setResource($command);
 
@@ -358,21 +353,4 @@ private static function setServerTagsByKey($span, $memcached, $key)
         $span->setTag(Tags\TARGET_HOST, $server['host']);
         $span->setTag(Tags\TARGET_PORT, $server['port']);
     }
-
-    /**
-     * Given a callback arg, it extract the keys depending on scalar vs associative array.
-     *
-     * @param $array
-     * @return array
-     */
-    private static function extractKeys($array)
-    {
-        if (array_keys($array) === range(0, count($array) - 1)) {
-            // Non-Association array, used in getMulti...
-            return array_values($array);
-        } else {
-            // Associative array, used in setMulti...
-            return array_keys($array);
-        }
-    }
 }
diff --git a/src/DDTrace/Obfuscation.php b/src/DDTrace/Obfuscation.php
@@ -0,0 +1,25 @@
+<?php
+
+namespace DDTrace;
+
+final class Obfuscation
+{
+    const REPLACEMENT = '?';
+    const DEFAULT_GLUE = ' ';
+
+    /**
+     * Obfuscate secrets with a replacement
+     *
+     * @param string|array $keys
+     * @param string $glue
+     * @return string
+     */
+    public static function toObfuscatedString($keys, $glue = self::DEFAULT_GLUE)
+    {
+        if (!is_array($keys)) {
+            return self::REPLACEMENT;
+        }
+        $obfuscatedKeys = str_repeat(self::REPLACEMENT . $glue, count($keys));
+        return rtrim($obfuscatedKeys, $glue);
+    }
+}