Function maskPasswordFieldsInGQL

audit/interceptor.go:248–294

password fields are accessible only via /admin endpoint hence, this will be only called with /admin endpoint

(req string)

// password fields are accessible only via /admin endpoint hence,
// this will be only called with /admin endpoint
func maskPasswordFieldsInGQL(req string) string {
	var gqlReq schema.Request
	err := json.Unmarshal([]byte(req), &gqlReq)
	if err != nil {
		glog.Errorf("unable to unmarshal gql request %v", err)
		return req
	}
	query, gErr := parser.ParseQuery(&ast.Source{
		Input: gqlReq.Query,
	})
	if gErr != nil {
		glog.Errorf("unable to parse gql request %+v", gErr)
		return req
	}
	if len(query.Operations) == 0 {
		return req
	}
	var variableName string
	for _, op := range query.Operations {
		if op.Operation != ast.Mutation || len(op.SelectionSet) == 0 {
			continue
		}

		for _, ss := range op.SelectionSet {
			if f, ok := ss.(*ast.Field); ok && len(f.Arguments) > 0 {
				variableName = getMaskedFieldVarName(f)
			}
		}
	}

	// no variable present
	if variableName == "" {
		regex, err := regexp.Compile(
			`password[\s]?(.*?)[\s]?:[\s]?(.*?)[\s]?"[\s]?(.*?)[\s]?"`)
		if err != nil {
			return req
		}
		return regex.ReplaceAllString(req, "*******")
	}
	regex, err := regexp.Compile(
		fmt.Sprintf(`"%s[\s]?(.*?)[\s]?"[\s]?(.*?)[\s]?:[\s]?(.*?)[\s]?"[\s]?(.*?)[\s]?"`,
			variableName[1:]))
	if err != nil {
		return req
	}
	return regex.ReplaceAllString(req, "*******")
}

func getMaskedFieldVarName(f *ast.Field) string {
	switch f.Name {