1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
// Copyright (C) 2021-2024 Internet Systems Consortium, Inc. ("ISC")
//
// This Source Code Form is subject to the terms of the Mozilla Public
// License, v. 2.0. If a copy of the MPL was not distributed with this
// file, You can obtain one at http://mozilla.org/MPL/2.0/.

#include <config.h>

#include <process/redact_config.h>

#include <boost/algorithm/string.hpp><--- Include file:  not found. Please note: Cppcheck does not need standard library headers to get proper results.

using namespace isc;
using namespace isc::data;
using namespace std;

namespace {

template <typename ElementPtrType>
ElementPtrType
redact(ElementPtrType const& element, list<string> json_path) {
    if (!element) {
        isc_throw(BadValue, "redact() got a null pointer");
    }

    string const next_key(json_path.empty() ? string() : json_path.front());
    ElementPtr result;
    if (element->getType() == Element::list) {
        // If we are looking for a list...
        if (next_key == "*" || next_key == "[]") {
            // But if we are looking specifically for a list...
            if (next_key == "[]") {
                // Then advance in the path.
                json_path.pop_front();
            }
            // Then redact all children.
            result = Element::createList();
            for (ElementPtr const& child : element->listValue()) {
                result->add(redact(child, json_path));
            }
            return result;
        }
    } else if (element->getType() == Element::map) {
        // If we are looking for anything or if we have reached the end of a
        /// path...
        if (next_key == "*" || json_path.empty()) {
            // Then iterate through all the children.
            result = Element::createMap();
            for (auto const& kv : element->mapValue()) {
                std::string const& key(kv.first);
                ConstElementPtr const& value(kv.second);

                if (boost::algorithm::ends_with(key, "password") ||
                    boost::algorithm::ends_with(key, "secret")) {
                    // Sensitive data
                    result->set(key, Element::create(string("*****")));
                } else if (key == "user-context") {
                    // Skip user contexts.
                    result->set(key, value);
                } else {
                    if (json_path.empty()) {
                        // End of path means no sensitive data expected in this
                        // subtree, so we stop here.
                        result->set(key, value);
                    } else {
                        // We are looking for anything '*' so redact further.
                        result->set(key, redact(value, json_path));
                    }
                }
            }
            return result;
        } else {
            ConstElementPtr child(element->get(next_key));
            if (child) {
                result = isc::data::copy(element, 1);
                json_path.pop_front();
                result->set(next_key, redact(child, json_path));
                return result;
            }
        }
    }

    return element;
}

}  // namespace

namespace isc {
namespace process {

ConstElementPtr
redactConfig(ConstElementPtr const& element, list<string> const& json_path) {
    return redact(element, json_path);
}

}  // namespace process
}  // namespace isc