DEV Community: Sang Au

Prevent sensitive data exposure in log with Serilog

Sang Au — Fri, 29 Jul 2022 08:38:40 +0000

1. Problem

Writing log when developing the application will help the developer to easy debugging and tracing. But writing a good log is not enough, because some sensitive data maybe exposed in log such as: password, account number or something like that.

2. Idea

To prevent this issue, we need to replace all sensitive words to any mask character.
The purpose of this article is help you implement the simple Sensitive data destructing policy with Serilog - one of common logger extension in .NET Core. By applying this policy you can prevent the sensitive data exposure in you log. It's enough, let's go through the code...

3. Implementation

3.1. Tech stack

.NET Core (on this article, I use .NET 6.0)
Serilog

3.2 Show the code

To implement the Destructing Policy we need to implement the interface IDestructuringPolicy from namespace Serilog.Core

public class SensitiveDataDestructuringPolicy : IDestructuringPolicy
{
    public bool TryDestructure(object value, ILogEventPropertyValueFactory propertyValueFactory, out LogEventPropertyValue result)
    {
        throw new NotImplementedException();
    }
}

Now, we need to define a mask value (such as * character) and list of sensitive keywords

var mask = "******";
var sensitiveKeywords = new List<string> {
    "Password", "NewPassword",
};

Actually, we should define the list of sensitive keywords some where such as Configuration file.

We will lookup all Log Event Properties, if we found any sensitive keyword in the log object, we will create a new Log Event Property with the mask value and add the new this property to the new list of Log Event Properties, for non sensitive keyword, we also create a new Log Event Property, but keep the original value. After that, just return the result.

Bellow is complete code.

using Microsoft.Extensions.Configuration;
using Serilog.Core;
using Serilog.Events;
using System.Reflection;

namespace Microsoft.Extensions.Logging;

public class SensitiveDataDestructuringPolicy : IDestructuringPolicy
{
    private const string DEFAULT_MASK_VALUE = "******";
    private const string SENSITIVE_KEYWORDS_SECTION = "Logging:SensitiveData:Keywords";
    private const string MASK_VALUE = "Logging:SensitiveData:Mask";

    private readonly IConfiguration _configuration;

    public SensitiveDataDestructuringPolicy(IConfiguration configuration)
    {
        _configuration = configuration ?? throw new ArgumentNullException(nameof(configuration));
    }

    public bool TryDestructure(object value, ILogEventPropertyValueFactory propertyValueFactory, out LogEventPropertyValue result)
    {
        var sensitiveKeywords = _configuration.GetValue<string[]>(SENSITIVE_KEYWORDS_SECTION) ?? Array.Empty<string>();
        var maskValue = _configuration.GetValue<string>(MASK_VALUE) ?? DEFAULT_MASK_VALUE;

        if (!sensitiveKeywords.Any())
        {
            result = new StructureValue(new LogEventProperty[] { });

            return false;
        }

        var props = value.GetType().GetTypeInfo().DeclaredProperties;
        var logEventProperties = new List<LogEventProperty>();

        foreach (var propertyInfo in props)
        {
            if (sensitiveKeywords.Any(x => x.Equals(propertyInfo.Name, StringComparison.InvariantCultureIgnoreCase)))
            {
                logEventProperties.Add(new LogEventProperty(propertyInfo.Name, propertyValueFactory.CreatePropertyValue(maskValue)));
            }
            else
            {
                logEventProperties.Add(new LogEventProperty(propertyInfo.Name, propertyValueFactory.CreatePropertyValue(propertyInfo.GetValue(value))));
            }
        }

        result = new StructureValue(logEventProperties);

        return true;
    }
}

Finally, add the SensitiveDataDestructuringPolicy to the loggerConfiguration as below:

# Rest of code
.UseSerilog((context, services, configuration) =>
{
    var loggerConfiguration = configuration
        .ReadFrom.Configuration(context.Configuration)
        .Enrich.FromLogContext()
        .Enrich.WithProperty("Application", context.HostingEnvironment.ApplicationName)
        .Enrich.WithProperty("Environment", context.HostingEnvironment.EnvironmentName)
        .MinimumLevel.Information();

    loggerConfiguration.Destructure.With<SensitiveDataDestructuringPolicy>();
});

4. Concluding

By applying the SensitiveDataDestructuringPolicy, you will make the log safer, that help to prevent the sensitive data exposing while tracing log.

Notes: The sample above just a very simple example, and you can modify, optimize to fit with your project.

This article was originally published at: https://sangau.me/prevent-sensitive-data-exposure-in-log-with-serilog

The first Github Actions

Sang Au — Thu, 05 Sep 2019 00:41:15 +0000

1. Introduction

GitHub Actions makes it easy to automate all your software workflows, now with world-class CI/CD. Build, test, and deploy your code right from GitHub. Make code reviews, branch management, and issue triaging work the way you want.

To get more details about Github Actions you can see About GitHub Actions

2. Let's start

Make sure that you had to register Github Actions beta program and also receive the approval email from Github like "You’re in! Get started with GitHub Actions beta"...

In this tutorial, I use my repository called React Starter Kit.

Don't talk any more, go go go...

Step 1: Go to your repository and click on the "Actions" tab

Step 2: Click the button "Set up a workflow yourself"

You will see the template like bellow:

name: CI

on: [push]

jobs:
  build:

    runs-on: ubuntu-latest

    steps:
    - uses: actions/checkout@v1
    - name: Run a one-line script
      run: echo Hello, world!
    - name: Run a multi-line script
      run: |
        echo Add other actions to build,
        echo test, and deploy your project.

Step 3: Edit the template

Following the Workflow syntax for GitHub Actions
and Set up your GitHub Actions workflow with a specific version of node.js

I edit my first actions like bellow:

name: CI

on: [push]

jobs:
  build:
    name: Build
    runs-on: ubuntu-18.04
    strategy:
      matrix:
        node_version: [10, 12]

    steps:
    - uses: actions/checkout@v1
    - name: Use Node.js ${{ matrix.node_version }}
      uses: actions/setup-node@v1
      with:
        version: ${{ matrix.node_version }}

    - name: yarn install, yarn lint, yarn test, yarn build
      run: |
        yarn install
        yarn lint
        yarn test
        yarn build

Explanation:
In the configuration above

Github Actions will trigger on push event on any branch
It will use Ubuntu 18.04 runs-on: ubuntu-18.04
It will run 2 times on 2 node versions: node_version: [10, 12]
It will use yarn to run instead of npm
It will run yarn install, yarn lint, yarn test, yarn build

For further command please refer to the Workflow syntax for GitHub Actions

Step 4: Waiting and getting the result!

It works fine!!!

3. In conclusion

So easy to create the simple pipeline with Github Actions. It will help you build your project without using any external CI/CD like Circle CI or something like that.

My simple site - sangau.me

Sang Au — Wed, 01 May 2019 04:55:56 +0000

This is my personal site and, I use the following technology to built it:

React
Typescript
Material-UI
GitHub pages
Travis CI

Could you give me some ideas about it!

Repo: GitHub