explore multi-line masking

pipeline/runtime/replacer.go

@@ -9,8 +9,6 @@ import (
 	"strings"
 )
 
-const maskedF = "[secret:%s]"
-
 // replacer is an io.Writer that finds and masks sensitive data.
 type replacer struct {
 	w io.WriteCloser
@@ -21,18 +19,22 @@ type replacer struct {
 func newReplacer(w io.WriteCloser, secrets []Secret) io.WriteCloser {
 	var oldnew []string
 	for _, secret := range secrets {
-		if len(secret.GetValue()) == 0 || secret.IsMasked() == false {
+		v := secret.GetValue()
+		if len(v) == 0 || secret.IsMasked() == false {
 			continue
 		}
-		// name := strings.ToLower(secret.GetName())
-		// masked := fmt.Sprintf(maskedF, name)
-
-		// TODO temporarily revert back to masking secrets
-		// using the asterisk symbol due to confusion when
-		// masking with [secret:name]
-		masked := "******"
-		oldnew = append(oldnew, string(secret.GetValue()))
-		oldnew = append(oldnew, masked)
+
+		for _, part := range strings.Split(v, "\n") {
+			part = strings.TrimSpace(part)
+
+			if len(part) == 0 {
+				continue
+			}
+
+			masked := "******"
+			oldnew = append(oldnew, part)
+			oldnew = append(oldnew, masked)
+		}
 	}
 	if len(oldnew) == 0 {
 		return w

pipeline/runtime/replacer_test.go

@@ -27,6 +27,35 @@ func TestReplace(t *testing.T) {
 	}
 }
 
+func TestReplaceMultiline(t *testing.T) {
+	key := `
+-----BEGIN PRIVATE KEY-----
+MIIBVQIBADANBgkqhkiG9w0BAQEFAASCAT8wggE7AgEAAkEA0SC5BIYpanOv6wSm
+dHVVMRa+6iw/0aJpT9/LKcZ0XYQ43P9Vwn8c46MDvFJ+Uy41FwbxT+QpXBoLlp8D
+sJY/dQIDAQABAkAesoL2GwtxSNIF2YTli2OZ9RDJJv2nNAPpaZxU4YCrST1AXGPB
+tFm0LjYDDlGJ448syKRpdypAyCR2LidwrVRxAiEA+YU5Zv7bOwODCsmtQtIfBfhu
+6SMBGMDijK7OYfTtjQsCIQDWjvly6b6doVMdNjqqTsnA8J1ShjSb8bFXkMels941
+fwIhAL4Rr7I3PMRtXmrfSa325U7k+Yd59KHofCpyFiAkNLgVAiB8JdR+wnOSQAOY
+loVRgC9LXa6aTp9oUGxeD58F6VK9PwIhAIDhSxkrIatXw+dxelt8DY0bEdDbYzky
+r9nicR5wDy2W
+-----END PRIVATE KEY-----`
+
+	line := `> MIIBVQIBADANBgkqhkiG9w0BAQEFAASCAT8wggE7AgEAAkEA0SC5BIYpanOv6wSm`
+
+	secrets := []Secret{
+		&mockSecret{Name: "SSH_KEY", Data: key, Mask: true},
+	}
+
+	buf := new(bytes.Buffer)
+	w := newReplacer(&nopCloser{buf}, secrets)
+	w.Write([]byte(line))
+	w.Close()
+
+	if got, want := buf.String(), "> ******"; got != want {
+		t.Errorf("Want masked string %s, got %s", want, got)
+	}
+}
+
 // this test verifies that if there are no secrets to scan and
 // mask, the io.WriteCloser is returned as-is.
 func TestReplaceNone(t *testing.T) {