hide more headers

pkg/awsutil/util.go

@@ -10,7 +10,13 @@ import (
 	log "github.com/sirupsen/logrus"
 )
 
-var REAuthHeader = regexp.MustCompile(`(?m:^(Auth[^:]*):.*$)`)
+var (
+	RESecretHeader = regexp.MustCompile(`(?m:^([^:]*(Auth|Security)[^:]*):.*$)`)
+)
+
+func HideSecureHeaders(dump []byte) []byte {
+	return RESecretHeader.ReplaceAll(dump, []byte("$1: <hidden>"))
+}
 
 func DumpRequest(r *http.Request) string {
 	dump, err := httputil.DumpRequest(r, true)
@@ -21,7 +27,7 @@ func DumpRequest(r *http.Request) string {
 	}
 
 	dump = bytes.TrimSpace(dump)
-	dump = REAuthHeader.ReplaceAll(dump, []byte("$1: <hidden>"))
+	dump = HideSecureHeaders(dump)
 	dump = util.IndentBytes(dump, []byte("    > "))
 	return string(dump)
 }

pkg/awsutil/util_test.go

@@ -0,0 +1,36 @@
+package awsutil_test
+
+import (
+	"fmt"
+	"testing"
+
+	"github.com/rebuy-de/aws-nuke/pkg/awsutil"
+)
+
+func TestSecretRegex(t *testing.T) {
+	cases := []struct{ in, out string }{
+		{
+			in:  "GET / HTTP/1.1\nAuthorization: Never gonna give you up\nHost: bish",
+			out: "GET / HTTP/1.1\nAuthorization: <hidden>\nHost: bish",
+		},
+		{
+			in:  "GET / HTTP/1.1\nX-Amz-Security-Token: Never gonna let you down\nHost: bash",
+			out: "GET / HTTP/1.1\nX-Amz-Security-Token: <hidden>\nHost: bash",
+		},
+		{
+			in:  "GET / HTTP/1.1\nX-Amz-Security-Token: Never gonna run around and desert you\nAuthorization: Never gonna make you cry",
+			out: "GET / HTTP/1.1\nX-Amz-Security-Token: <hidden>\nAuthorization: <hidden>",
+		},
+	}
+
+	for i, tc := range cases {
+		t.Run(fmt.Sprint(i), func(t *testing.T) {
+			want := tc.out
+			have := string(awsutil.HideSecureHeaders([]byte(tc.in)))
+
+			if want != have {
+				t.Errorf("Assertion failed. Want: %#v. Have: %#v", want, have)
+			}
+		})
+	}
+}