feat: add regex pattern to mask API keys in sensitive information

[xiangsx]

Summary by CodeRabbit

• Bug Fixes
  • Enhanced sensitive information masking to cover API key patterns. The system now detects and obscures API keys formatted as 'api_key:xxx' or "api_key:xxx" in addition to existing masking for URLs, domains, and IP addresses. Surrounding quotes and formatting are preserved to maintain data integrity.

_{✏️ Tip: You can customize this high-level summary in your review settings.}

[coderabbitai]

Walkthrough

A new regex pattern was added to detect API key patterns (e.g., api_key:xxx) in strings. The MaskSensitiveInfo function was extended to mask API keys by replacing them with obscured values, applied alongside existing URL, domain, and IP masking logic.

Changes

Cohort / File(s)	Summary
API Key Pattern Masking common/str.go	Added maskApiKeyPattern regex to detect and mask API keys in format api_key:xxx with surrounding quotes preserved. Integrated masking logic into MaskSensitiveInfo function after existing masking routines.

Estimated code review effort

🎯 2 (Simple) | ⏱️ ~8 minutes

Possibly related PRs

• fix: regex repeat compile #2358: Modifies regex handling and MaskSensitiveInfo function in common/str.go with similar pattern-based masking enhancements.

Poem

🐰 A hop through the code, a pattern so keen,
To hide all the secrets that shouldn't be seen,
API keys masked with a flourish of care,
Protected and tucked in the rabbit's fair lair! 🔐

Pre-merge checks and finishing touches

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 50.00% which is insufficient. The required threshold is 80.00%.	You can run @coderabbitai generate docstrings to improve docstring coverage.

✅ Passed checks (2 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title 'feat: add regex pattern to mask API keys in sensitive information' accurately summarizes the main change in the pull request.

✨ Finishing touches

• 📝 Generate docstrings

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[coderabbitai]

Actionable comments posted: 0

🧹 Nitpick comments (1)

common/str.go (1)

19-20: Consider broadening the pattern and validating quote matching.

The current pattern has some limitations:

1. Mismatched quotes: The pattern doesn't enforce that opening and closing quotes match. For example, 'api_key:secret" would incorrectly match.
2. Narrow scope: Only matches the exact string api_key: (case-sensitive). Common variations like apiKey:, api-key:, API_KEY:, access_token:, secret_key:, etc., won't be caught.
3. Case sensitivity: API_KEY:xxx or Api_Key:xxx won't be masked.

🔎 Proposed improvements

Option 1: Enforce quote matching (minimal fix)

-	maskApiKeyPattern = regexp.MustCompile(`(['"]?)api_key:([^\s'"]+)(['"]?)`)
+	maskApiKeyPattern = regexp.MustCompile(`(['"]?)api_key:([^\s'"]+)\1`)

Using \1 as a backreference ensures the closing quote matches the opening quote.

Option 2: Broader pattern to catch more API key formats (recommended)

-	maskApiKeyPattern = regexp.MustCompile(`(['"]?)api_key:([^\s'"]+)(['"]?)`)
+	maskApiKeyPattern = regexp.MustCompile(`(?i)(['"]?)(?:api[_-]?key|access[_-]?token|secret[_-]?key)\s*:\s*([^\s'"]+)\1`)

This pattern:

• Uses (?i) for case-insensitive matching
• Matches common API key patterns: api_key, apikey, api-key, access_token, secret_key, etc.
• Allows optional whitespace around the colon
• Uses \1 to enforce matching quotes

You'll also need to adjust the replacement pattern:

-	str = maskApiKeyPattern.ReplaceAllString(str, "${1}api_key:***${3}")
+	str = maskApiKeyPattern.ReplaceAllString(str, "${1}***:***${1}")

📜 Review details

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

📥 Commits

Reviewing files that changed from the base of the PR and between ad61c0f and e13459f.

📒 Files selected for processing (1)

• common/str.go

🧰 Additional context used

🪛 Gitleaks (8.30.0)

common/str.go

[high] 240-240: Uncovered a GCP API key, which could lead to unauthorized access to Google Cloud services and data breaches.

(gcp-api-key)

🔇 Additional comments (1)

common/str.go (1)

240-242: The replacement logic looks correct, and the static analysis warning is a false positive.

The replacement pattern ${1}api_key:***${3} correctly preserves the opening and closing quotes while masking the API key value.

Regarding the Gitleaks warning: Line 240 contains an example API key in a comment for documentation purposes, not an actual secret. This is a false positive and can be safely ignored.

Note: If you implement the broader pattern suggested in the previous comment, remember to update the replacement pattern accordingly to avoid hardcoding api_key:.