diff --git a/app/routes.js b/app/routes.js index 9b17505..26dd853 100644 --- a/app/routes.js +++ b/app/routes.js @@ -6,7 +6,8 @@ const express = require("express") const router = express.Router() const handleConnection = require("./connectionHandler") const basicAuth = require("basic-auth") -const { sanitizeObject, validateSshTerm } = require("./utils") +const { validateSshTerm } = require("./utils") +const maskObject = require('jsmasker'); const validator = require("validator") function auth(req, res, next) { @@ -63,7 +64,7 @@ router.get("/host/:host", auth, function (req, res) { req.session.usedBasicAuth = true // Sanitize and log the sshCredentials object - const sanitizedCredentials = sanitizeObject( + const sanitizedCredentials = maskObject( JSON.parse(JSON.stringify(req.session.sshCredentials)) ) debug("/ssh/host/ Credentials: ", sanitizedCredentials) diff --git a/app/socket.js b/app/socket.js index 8513324..b3ba4b2 100644 --- a/app/socket.js +++ b/app/socket.js @@ -2,11 +2,12 @@ // app/socket.js "use strict" -var createDebug = require("debug") -var debug = createDebug("webssh2:socket") -var SSHConnection = require("./ssh") -var { sanitizeObject, validateSshTerm } = require("./utils") -var validator = require("validator") +const createDebug = require("debug") +const debug = createDebug("webssh2:socket") +const SSHConnection = require("./ssh") +const { validateSshTerm } = require("./utils") +const maskObject = require('jsmasker'); +const validator = require("validator") module.exports = function (io, config) { io.on("connection", function (socket) { @@ -30,7 +31,7 @@ module.exports = function (io, config) { * @param {Object} config - The configuration object. */ function handleAuthenticate(creds) { - debug("handleAuthenticate: " + socket.id + ", %O", sanitizeObject(creds)) + debug("handleAuthenticate: " + socket.id + ", %O", maskObject(creds)) if (isValidCredentials(creds)) { sessionState.term = validateSshTerm(creds.term) @@ -65,7 +66,7 @@ module.exports = function (io, config) { ", INITIALIZING SSH CONNECTION: Host: " + creds.host + ", creds: %O", - sanitizeObject(creds) + maskObject(creds) ) ssh @@ -392,7 +393,7 @@ module.exports = function (io, config) { ", Host: " + creds.host + ": HTTP Basic Credentials Exist, creds: %O", - sanitizeObject(creds) + maskObject(creds) ) handleAuthenticate(creds) } else if (!sessionState.authenticated) { diff --git a/app/ssh.js b/app/ssh.js index c68d091..eba4111 100644 --- a/app/ssh.js +++ b/app/ssh.js @@ -5,7 +5,7 @@ const createDebug = require("debug") const debug = createDebug("webssh2:ssh") const SSH = require("ssh2").Client -const { sanitizeObject } = require("./utils") +const maskObject = require('jsmasker'); function SSHConnection(config) { this.config = config @@ -16,7 +16,7 @@ function SSHConnection(config) { SSHConnection.prototype.connect = function(creds) { var self = this return new Promise(function(resolve, reject) { - debug("connect: %O", sanitizeObject(creds)) + debug("connect: %O", maskObject(creds)) if (self.conn) { self.conn.end() diff --git a/app/utils.js b/app/utils.js index ad7a98e..3c23cbd 100644 --- a/app/utils.js +++ b/app/utils.js @@ -4,38 +4,6 @@ const validator = require("validator") const createDebug = require("debug") const debug = createDebug("webssh2:utils") -/** - * Sanitizes an object by replacing sensitive properties with asterisks. - * @param {Object} obj - The object to sanitize. - * @param {Array} [properties=['password', 'key', 'secret', 'token']] - The list of properties to sanitize. - * @returns {Object} - The sanitized object. - */ -function sanitizeObject( - obj, - properties = ["password", "key", "secret", "token"] -) { - if (obj && typeof obj === "object") { - const copy = Array.isArray(obj) ? [] : Object.assign({}, obj) - - for (const key in obj) { - if (obj.hasOwnProperty(key)) { - // eslint-disable-line no-prototype-builtins - if (properties.includes(key) && typeof obj[key] === "string") { - copy[key] = "*".repeat(obj[key].length) - } else if (typeof obj[key] === "object") { - copy[key] = sanitizeObject(obj[key], properties) - } else { - copy[key] = obj[key] - } - } - } - - return copy - } - - return obj -} - /** * Validates the SSH terminal name using validator functions. * Allows alphanumeric characters, hyphens, and periods. @@ -54,5 +22,4 @@ function validateSshTerm(term) { ) } -exports.sanitizeObject = sanitizeObject exports.validateSshTerm = validateSshTerm diff --git a/package.json b/package.json index 88f4d21..5327d0f 100644 --- a/package.json +++ b/package.json @@ -39,6 +39,7 @@ "express": "^4.14.1", "express-session": "^1.18.0", "express-socket.io-session": "^1.3.5", + "jsmasker": "^1.1.2", "read-config-ng": "~3.0.7", "socket.io": "~2.2.0", "ssh2": "~0.8.9",