sweep: DIRACGrid#7835 fix(Resources): hide private key from the logs

aldbr · Oct 16, 2024 · c75848d · c75848d
1 parent e02d21f
commit c75848d
Show file tree

Hide file tree

Showing 2 changed files with 9 additions and 0 deletions.
diff --git a/src/DIRAC/Resources/LogFilters/SensitiveDataFilter.py b/src/DIRAC/Resources/LogFilters/SensitiveDataFilter.py
@@ -43,6 +43,7 @@ def __filter(self, record):
         # a list of sensitive words to replace
         sensitiveData = [
             r"-----BEGIN CERTIFICATE-----.*?-----END CERTIFICATE-----",
+            r"-----BEGIN PRIVATE KEY-----.*?-----END PRIVATE KEY-----",
         ]
 
         # record.args can be a tuple

diff --git a/src/DIRAC/Resources/LogFilters/test/Test_LogFilter.py b/src/DIRAC/Resources/LogFilters/test/Test_LogFilter.py
@@ -93,6 +93,14 @@ def test_pf(pf, record, result):
             ("blablabla ***REDACTED*** blablabla", "Variable message"),
             # should not display the certificate
         ),
+        (
+            (
+                "blablabla -----BEGIN PRIVATE KEY-----\n12345\n45678\n-----END PRIVATE KEY----- blablabla",
+                "Variable message",
+            ),
+            ("blablabla ***REDACTED*** blablabla", "Variable message"),
+            # should not display the certificate
+        ),
         ((5, ""), ("5", "")),  # special case
         (("", 5), ("", "5")),  # special case
         (({"ce": "test"}, ""), ("{'ce': 'test'}", "")),  # special case