Private/Protect-SCASecret.ps1
|
function Protect-SCASecret { <# .SYNOPSIS Masks sensitive values before they reach Verbose, Debug, or error output. .DESCRIPTION Accepts a string or a hashtable (typically HTTP headers or a request/response body) and returns a copy with values belonging to sensitive keys replaced with a fixed redaction marker. Matching is case-insensitive and matches on key substrings, since services vary header casing and naming (Authorization, X-Auth-Token, ClientSecret, refresh_token, ...). .PARAMETER InputObject The string or hashtable/dictionary to redact. .EXAMPLE Protect-SCASecret -InputObject @{ Authorization = 'Bearer eyJ...'; Accept = 'application/json' } Returns a copy of the hashtable with Authorization replaced by '***REDACTED***'. .OUTPUTS System.String or System.Collections.Hashtable, matching the input type. #> [CmdletBinding()] [OutputType([string], [hashtable])] param( [Parameter(Mandatory, Position = 0)] [AllowNull()] [object]$InputObject ) $sensitiveKeyPattern = 'authorization|bearer|token|clientsecret|client_secret|password|secret|cookie|credential|privatekey|private_key' if ($null -eq $InputObject) { return $InputObject } if ($InputObject -is [System.Collections.IDictionary]) { $redacted = @{} foreach ($key in $InputObject.Keys) { if ($key -match $sensitiveKeyPattern) { $redacted[$key] = '***REDACTED***' } else { $redacted[$key] = $InputObject[$key] } } return $redacted } if ($InputObject -is [string]) { $text = $InputObject $text = $text -replace '(?i)("(?:access_token|refresh_token|client_secret|password|secret)"\s*:\s*)"[^"]*"', '$1"***REDACTED***"' $text = $text -replace '(?i)(Bearer\s+)[A-Za-z0-9\-\._~\+/]+=*', '$1***REDACTED***' $text = $text -replace '(?i)(Basic\s+)[A-Za-z0-9\+/]+=*', '$1***REDACTED***' return $text } return $InputObject } |