SNOW-1260011: mask password in the logs (#1116)

The logger will now masked all secrets in the logs.

Author: sfc-gh-ext-simba-jl

log.go

@@ -5,13 +5,14 @@ package gosnowflake
 import (
 	"context"
 	"fmt"
-	rlog "github.com/sirupsen/logrus"
 	"io"
 	"os"
 	"path"
 	"runtime"
 	"strings"
 	"time"
+
+	rlog "github.com/sirupsen/logrus"
 )
 
 // SFSessionIDKey is context key of session id
@@ -61,6 +62,16 @@ type defaultLogger struct {
 	file    *os.File
 }
 
+type sfTextFormatter struct {
+	rlog.TextFormatter
+}
+
+func (f *sfTextFormatter) Format(entry *rlog.Entry) ([]byte, error) {
+	// mask all secrets before calling the default Format method
+	entry.Message = maskSecrets(entry.Message)
+	return f.TextFormatter.Format(entry)
+}
+
 // SetLogLevel set logging level for calling defaultLogger
 func (log *defaultLogger) SetLogLevel(level string) error {
 	newEnabled := strings.ToUpper(level) != "OFF"
@@ -116,9 +127,10 @@ func (log *defaultLogger) WithContext(ctx context.Context) *rlog.Entry {
 // CreateDefaultLogger return a new instance of SFLogger with default config
 func CreateDefaultLogger() SFLogger {
 	var rLogger = rlog.New()
-	var formatter = rlog.TextFormatter{CallerPrettyfier: SFCallerPrettyfier}
+	var formatter = new(sfTextFormatter)
+	formatter.CallerPrettyfier = SFCallerPrettyfier
+	rLogger.SetFormatter(formatter)
 	rLogger.SetReportCaller(true)
-	rLogger.SetFormatter(&formatter)
 	var ret = defaultLogger{inner: rLogger, enabled: true}
 	return &ret //(&ret).(*SFLogger)
 }

log_test.go

@@ -323,3 +323,20 @@ func TestLogKeysWithRegisterContextVariableToLog(t *testing.T) {
 		t.Fatalf("expected that REQUEST_ID would be in logs if logger.WithContext and RegisterContextVariableToLog was used, but got: %v", strbuf)
 	}
 }
+
+func TestLogMaskSecrets(t *testing.T) {
+	logger := CreateDefaultLogger()
+	buf := &bytes.Buffer{}
+	logger.SetOutput(buf)
+
+	ctx := context.Background()
+	query := "create user testuser password='testpassword'"
+	logger.WithContext(ctx).Infof("Query: %#v", query)
+
+	// verify output
+	expected := "create user testuser password='****"
+	var strbuf = buf.String()
+	if !strings.Contains(strbuf, expected) {
+		t.Fatalf("expected that password would be masked. WithContext was used, but got: %v", strbuf)
+	}
+}