[CWS] add jwt as default sensitive word

Author: safchain

pkg/security/utils/scrubber.go

@@ -16,7 +16,7 @@ import (
 )
 
 var (
-	additionals = []string{"*token*"}
+	additionals = []string{"*token*", "*jwt*"}
 )
 
 // Scrubber is a struct that holds the proc scrubber and the regex scrubber

pkg/security/utils/scrubber_test.go

@@ -13,21 +13,45 @@ import (
 )
 
 func TestScrubber(t *testing.T) {
-	t.Run("cmdline", func(t *testing.T) {
-		scrubber, err := NewScrubber([]string{"token"}, []string{"t[a-z]*n", "t.st"})
+	t.Run("cmdline-default", func(t *testing.T) {
+		scrubber, err := NewScrubber(nil, nil)
 		assert.NoError(t, err)
 		assert.NotNil(t, scrubber)
 
-		scrubbed := scrubber.ScrubCommand([]string{"--token 1234567890 --test 1234567890"})
+		scrubbed := scrubber.ScrubCommand([]string{"cmd --secret 1234567890 --token 1234567890 --jwt abc"})
+		assert.Equal(t, []string{"cmd", "--secret", "********", "--token", "********", "--jwt", "********"}, scrubbed)
+
+		scrubbed = scrubber.ScrubCommand([]string{"cmd", "--secret", "1234567890", "--token", "1234567890", "--jwt", "abc"})
+		assert.Equal(t, []string{"cmd", "--secret", "********", "--token", "********", "--jwt", "********"}, scrubbed)
+	})
+
+	t.Run("cmdline-custom-word", func(t *testing.T) {
+		scrubber, err := NewScrubber([]string{"custom"}, nil)
+		assert.NoError(t, err)
+		assert.NotNil(t, scrubber)
+
+		scrubbed := scrubber.ScrubCommand([]string{"cmd --secret 1234567890 --token 1234567890 --custom abc"})
+		assert.Equal(t, []string{"cmd", "--secret", "********", "--token", "********", "--custom", "********"}, scrubbed)
+
+		scrubbed = scrubber.ScrubCommand([]string{"cmd", "--secret", "1234567890", "--token", "1234567890", "--custom", "abc"})
+		assert.Equal(t, []string{"cmd", "--secret", "********", "--token", "********", "--custom", "********"}, scrubbed)
+	})
+
+	t.Run("cmdline-custom-regexp", func(t *testing.T) {
+		scrubber, err := NewScrubber(nil, []string{"a[a-z]*c", "t.st"})
+		assert.NoError(t, err)
+		assert.NotNil(t, scrubber)
+
+		scrubbed := scrubber.ScrubCommand([]string{"--abc 1234567890 --test 1234567890"})
 		assert.Equal(t, []string{"--***** 1234567890 --***** 1234567890"}, scrubbed)
 	})
 
-	t.Run("line", func(t *testing.T) {
-		scrubber, err := NewScrubber([]string{"token"}, []string{"t[a-z]*n", "t.st"})
+	t.Run("line-custom-regexp", func(t *testing.T) {
+		scrubber, err := NewScrubber(nil, []string{"a[a-z]*c", "t.st"})
 		assert.NoError(t, err)
 		assert.NotNil(t, scrubber)
 
-		scrubbed := scrubber.ScrubLine("token 1234567890 test 1234567890")
+		scrubbed := scrubber.ScrubLine("abc 1234567890 test 1234567890")
 		assert.Equal(t, "***** 1234567890 ***** 1234567890", scrubbed)
 	})
 }