Private/Protect-SIALogValue.ps1
|
function Protect-SIALogValue { <# Redacts sensitive values before they reach Write-Verbose, Write-Debug, or an exception message. Called on every header collection and request/response body before it is logged anywhere. #> [CmdletBinding()] [OutputType([string])] param( [Parameter(Mandatory, ValueFromPipeline)] [AllowEmptyString()] [string]$InputObject ) process { $redacted = $InputObject $sensitiveNames = 'Authorization|Bearer|access_token|refresh_token|client_secret|password|secret|cookie|private_key|token' # Must run before the generic key/value pattern below - otherwise "Authorization: Bearer <token>" # matches the generic pattern first, which redacts only the word "Bearer" and leaves the token itself exposed. $redacted = $redacted -replace '(?i)(Bearer\s+)[A-Za-z0-9\-_\.]+', '$1***REDACTED***' # Matches "Name": "value" / Name=value / Name: value across JSON, form, and header-style text. $redacted = $redacted -replace "(?i)(""?(?:$sensitiveNames)""?\s*[:=]\s*""?)([^""&,}\s]+)", '$1***REDACTED***' $redacted } } |