fix: Mask the password parameter and print it to the log

NaverCloudPlatform · Jan 6, 2025 · 6a3d316 · 6a3d316
1 parent e9d2b3e
commit 6a3d316
Show file tree

Hide file tree

Showing 2 changed files with 11 additions and 4 deletions.
diff --git a/internal/common/json.go b/internal/common/json.go
@@ -2,6 +2,7 @@ package common
 
 import (
 	"encoding/json"
+	"fmt"
 	"regexp"
 )
 
@@ -20,3 +21,10 @@ func ReplaceNull(s string) string {
 	re := regexp.MustCompile(`:<null>`)
 	return re.ReplaceAllString(s, ":null")
 }
+
+func MaskString(value interface{}, target string) string {
+	s := MarshalUncheckedString(value)
+	pattern := fmt.Sprintf(`"%s":"[^"]*"`, target)
+	replace := fmt.Sprintf(`"%s":"***"`, target)
+	return regexp.MustCompile(pattern).ReplaceAllString(s, replace)
+}
diff --git a/internal/service/mongodb/mongodb_users.go b/internal/service/mongodb/mongodb_users.go
@@ -151,8 +151,7 @@ func (r *mongodbUsersResource) Create(ctx context.Context, req resource.CreateRe
 		CloudMongoDbInstanceNo: plan.ID.ValueStringPointer(),
 		CloudMongoDbUserList:   convertToAddOrChangeParameters(plan.MongoDbUserSet),
 	}
-
-	tflog.Info(ctx, "CreateMongodbUserList reqParams="+common.MarshalUncheckedString(reqParams))
+	tflog.Info(ctx, "CreateMongodbUserList reqParams="+common.MaskString(reqParams, "password"))
 
 	response, err := r.config.Client.Vmongodb.V2Api.AddCloudMongoDbUserList(reqParams)
 	if err != nil {
@@ -437,7 +436,7 @@ func addOrChangeUserList(ctx context.Context, config *conn.ProviderConfig, id *s
 			CloudMongoDbInstanceNo: id,
 			CloudMongoDbUserList:   changeParameters,
 		}
-		tflog.Info(ctx, "ChangeCloudMongoDbUserList reqParams="+common.MarshalUncheckedString(reqParams))
+		tflog.Info(ctx, "ChangeCloudMongoDbUserList reqParams="+common.MaskString(reqParams, "password"))
 
 		response, err := config.Client.Vmongodb.V2Api.ChangeCloudMongoDbUserList(reqParams)
 		if err != nil {
@@ -461,7 +460,7 @@ func addOrChangeUserList(ctx context.Context, config *conn.ProviderConfig, id *s
 			CloudMongoDbInstanceNo: id,
 			CloudMongoDbUserList:   addParameters,
 		}
-		tflog.Info(ctx, "AddCloudMongoDbUserList reqParams="+common.MarshalUncheckedString(reqParams))
+		tflog.Info(ctx, "AddCloudMongoDbUserList reqParams="+common.MaskString(reqParams, "password"))
 
 		response, err := config.Client.Vmongodb.V2Api.AddCloudMongoDbUserList(reqParams)
 		if err != nil {