Redact ?token= querystring parameter from GHES <3.8 archive URLs in logs

RELEASENOTES.md

@@ -1,2 +1,3 @@
 
-- Skip GitHub status checking on startup if environment variable `GEI_SKIP_STATUS_CHECK` is set to true.
+- Skip GitHub status checking on startup if environment variable `GEI_SKIP_STATUS_CHECK` is set to `true`
+- Redact `?token=` querystring parameter from GHES <3.8 archive URLs in logs

src/Octoshift/Services/OctoLogger.cs

@@ -3,6 +3,7 @@
 using System.IO;
 using System.Linq;
 using System.Net.Http;
+using System.Text.RegularExpressions;
 
 namespace OctoshiftCLI.Services;
 
@@ -30,6 +31,11 @@ public class OctoLogger
 
     private const string GENERIC_ERROR_MESSAGE = "An unexpected error happened. Please see the logs for details.";
 
+    private readonly List<string> _redactionPatterns = new()
+    {
+        "\\b(?<=token=)(.+?)\\b"
+    };
+
     public OctoLogger()
     {
         var logStartTime = DateTime.Now;
@@ -59,7 +65,7 @@ public OctoLogger(Action<string> writeToLog, Action<string> writeToVerboseLog, A
     private void Log(string msg, string level)
     {
         var output = FormatMessage(msg, level);
-        output = MaskSecrets(output);
+        output = Redact(output);
         if (level == LogLevel.ERROR)
         {
             _writeToConsoleError(output);
@@ -78,7 +84,7 @@ private string FormatMessage(string msg, string level)
         return $"[{timeFormat}] [{level}] {msg}\n";
     }
 
-    private string MaskSecrets(string msg)
+    private string Redact(string msg)
     {
         var result = msg;
 
@@ -88,6 +94,11 @@ private string MaskSecrets(string msg)
                 .Replace(Uri.EscapeDataString(secret), "***");
         }
 
+        foreach (var redactionPattern in _redactionPatterns)
+        {
+            result = Regex.Replace(result, redactionPattern, "***");
+        }
+
         return result;
     }
 
@@ -117,14 +128,14 @@ public virtual void LogError(Exception ex)
         var verboseMessage = ex is HttpRequestException httpEx ? $"[HTTP ERROR {(int?)httpEx.StatusCode}] {ex}" : ex.ToString();
         var logMessage = Verbose ? verboseMessage : ex is OctoshiftCliException ? ex.Message : GENERIC_ERROR_MESSAGE;
 
-        var output = MaskSecrets(FormatMessage(logMessage, LogLevel.ERROR));
+        var output = Redact(FormatMessage(logMessage, LogLevel.ERROR));
 
         Console.ForegroundColor = ConsoleColor.Red;
         _writeToConsoleError(output);
         Console.ResetColor();
 
         _writeToLog(output);
-        _writeToVerboseLog(MaskSecrets(FormatMessage(verboseMessage, LogLevel.ERROR)));
+        _writeToVerboseLog(Redact(FormatMessage(verboseMessage, LogLevel.ERROR)));
     }
 
     public virtual void LogVerbose(string msg)
@@ -137,7 +148,7 @@ public virtual void LogVerbose(string msg)
         }
         else
         {
-            _writeToVerboseLog(MaskSecrets(FormatMessage(msg, LogLevel.VERBOSE)));
+            _writeToVerboseLog(Redact(FormatMessage(msg, LogLevel.VERBOSE)));
         }
     }
 

src/OctoshiftCLI.Tests/Octoshift/Services/OctoLoggerTests.cs

@@ -60,6 +60,32 @@ public void Secrets_Should_Be_Masked_From_Logs_And_Console()
         _consoleError.Should().NotContain(urlEncodedSecret);
     }
 
+    [Fact]
+    public void Ghes_Archive_Url_Tokens_Should_Be_Replaced_In_Logs_And_Console()
+    {
+
+        var ghesArchiveUrl = "https://files.github.acmeinc.com/foo?token=foobar";
+
+        _octoLogger.Verbose = false;
+        _octoLogger.LogInformation($"Archive URL: {ghesArchiveUrl}");
+        _octoLogger.LogVerbose($"Archive URL: {ghesArchiveUrl}");
+        _octoLogger.LogWarning($"Archive URL: {ghesArchiveUrl}");
+        _octoLogger.LogSuccess($"Archive URL: {ghesArchiveUrl}");
+        _octoLogger.LogError($"Archive URL: {ghesArchiveUrl}");
+        _octoLogger.LogError(new OctoshiftCliException("Archive URL: {ghesArchiveUrl}"));
+        _octoLogger.LogError(new InvalidOperationException("Archive URL: {ghesArchiveUrl}"));
+
+        _octoLogger.Verbose = true;
+        _octoLogger.LogVerbose("Archive URL: {ghesArchiveUrl}");
+
+        _consoleOutput.Should().NotContain(ghesArchiveUrl);
+        _logOutput.Should().NotContain(ghesArchiveUrl);
+        _verboseLogOutput.Should().NotContain(ghesArchiveUrl);
+        _consoleError.Should().NotContain(ghesArchiveUrl);
+
+        _consoleOutput.Should().Contain("Archive URL: https://files.github.acmeinc.com/foo?token=***");
+    }
+
     [Fact]
     public void LogError_For_OctoshiftCliException_Should_Log_Exception_Message_In_Non_Verbose_Mode()
     {