Remove secret values from a string

Replaces each secret wherever it appears, in both the form it was passed and the percent-encoded form a URL carries. Used on the messages built from a transport failure, because a curl error normally carries the URL that failed and that URL may hold a query-string credential.

Usage

redact_secrets(text, secrets = NULL)

Arguments

text

A single string.

secrets

A named list of secret values, as passed to secret_query.

Value

text, with every secret value replaced by <redacted>.

Details

Matching on the value rather than on the parameter name is deliberate: the same secret can reach a message through a URL, a header dump, or a proxy error, and only the value is common to all three.

Both forms have to be matched because a secret never reaches a URL in the form it was passed. httr2::req_url_query() percent-encodes it, so a key holding +, /, or =, which is an ordinary shape for a base64 key, arrives as %2B, %2F, and %3D. Matching only the raw value would let exactly those keys through into a logged detail.

Examples

redact_secrets(
  "Could not resolve host: example.org/?api_key=abc123",
  list(api_key = "abc123")
)
#> [1] "Could not resolve host: example.org/?api_key=<redacted>"

# The encoded form is caught too, which is the one a URL actually carries.
redact_secrets(
  "Could not resolve host: example.org/?api_key=ab%2Bcd",
  list(api_key = "ab+cd")
)
#> [1] "Could not resolve host: example.org/?api_key=<redacted>"