log_sanitizer.h

Go to the documentation of this file.

// BSD 3-Clause License
// Copyright (c) 2021-2025, 🍀☀🌕🌥 🌊
// See the LICENSE file in the project root for full license information.
 
#pragma once
 
#include <string>
#include <string_view>
#include <vector>
#include <regex>
#include <memory>
#include <functional>
 
namespace kcenon::logger::security {
 
enum class sensitive_data_type {
    credit_card,     
    ssn,             
    api_key,         
    password,        
    email,           
    ip_address,      
    phone_number,    
    custom           
};
 
struct sanitization_rule {
    std::string name;           
    std::regex pattern;         
    std::string replacement;    
    bool preserve_partial;      
 
    sanitization_rule(std::string n, const std::string& p, std::string r, bool pp = false)
        : name(std::move(n))
        , pattern(p, std::regex::icase | std::regex::optimize)
        , replacement(std::move(r))
        , preserve_partial(pp) {}
};
 
class log_sanitizer {
public:
    log_sanitizer& add_pattern(sensitive_data_type type) {
        switch (type) {
            case sensitive_data_type::credit_card:
                add_credit_card_pattern();
                break;
            case sensitive_data_type::ssn:
                add_ssn_pattern();
                break;
            case sensitive_data_type::api_key:
                add_api_key_pattern();
                break;
            case sensitive_data_type::password:
                add_password_pattern();
                break;
            case sensitive_data_type::email:
                add_email_pattern();
                break;
            case sensitive_data_type::ip_address:
                add_ip_address_pattern();
                break;
            case sensitive_data_type::phone_number:
                add_phone_number_pattern();
                break;
            case sensitive_data_type::custom:
                // Custom patterns are added via add_custom_pattern()
                break;
        }
        return *this;
    }
 
    log_sanitizer& add_custom_pattern(
            std::string_view name,
            std::string_view regex_pattern,
            std::string_view replacement = "[REDACTED]",
            bool preserve_partial = false) {
        rules_.emplace_back(
            std::string(name),
            std::string(regex_pattern),
            std::string(replacement),
            preserve_partial);
        return *this;
    }
 
    log_sanitizer& remove_pattern(std::string_view name) {
        rules_.erase(
            std::remove_if(rules_.begin(), rules_.end(),
                [name](const sanitization_rule& rule) {
                    return rule.name == name;
                }),
            rules_.end());
        return *this;
    }
 
    std::string sanitize(std::string_view input) const {
        if (rules_.empty()) {
            return std::string(input);
        }
 
        std::string result(input);
        for (const auto& rule : rules_) {
            result = apply_rule(result, rule);
        }
        return result;
    }
 
    bool contains_sensitive_data(std::string_view input) const {
        for (const auto& rule : rules_) {
            if (std::regex_search(input.begin(), input.end(), rule.pattern)) {
                return true;
            }
        }
        return false;
    }
 
    std::vector<std::string> active_patterns() const {
        std::vector<std::string> names;
        names.reserve(rules_.size());
        for (const auto& rule : rules_) {
            names.push_back(rule.name);
        }
        return names;
    }
 
    log_sanitizer& clear() {
        rules_.clear();
        return *this;
    }
 
    log_sanitizer& add_common_patterns() {
        add_pattern(sensitive_data_type::credit_card);
        add_pattern(sensitive_data_type::ssn);
        add_pattern(sensitive_data_type::api_key);
        add_pattern(sensitive_data_type::password);
        add_pattern(sensitive_data_type::email);
        return *this;
    }
 
private:
    std::vector<sanitization_rule> rules_;
 
    void add_credit_card_pattern() {
        // Matches credit card numbers with or without separators
        // Preserves last 4 digits
        rules_.emplace_back(
            "credit_card",
            R"(\b(\d{4}[-\s]?\d{4}[-\s]?\d{4}[-\s]?)(\d{4})\b)",
            "****-****-****-$2",
            true);
    }
 
    void add_ssn_pattern() {
        // Matches SSN format XXX-XX-XXXX
        // Preserves last 4 digits
        rules_.emplace_back(
            "ssn",
            R"(\b(\d{3})[-\s]?(\d{2})[-\s]?(\d{4})\b)",
            "***-**-$3",
            true);
    }
 
    void add_api_key_pattern() {
        // Matches common API key formats
        rules_.emplace_back(
            "api_key",
            R"(\b(sk[-_]|api[-_]|key[-_]|token[-_]|bearer\s+)([a-zA-Z0-9]{16,})\b)",
            "$1[REDACTED]",
            false);
    }
 
    void add_password_pattern() {
        // Matches password=xxx, pwd=xxx, passwd=xxx patterns
        rules_.emplace_back(
            "password",
            R"(((?:password|passwd|pwd|secret|credential)[\s]*[=:]\s*)([^\s&]+))",
            "$1[REDACTED]",
            false);
    }
 
    void add_email_pattern() {
        // Matches email addresses, masks local part partially
        rules_.emplace_back(
            "email",
            R"(\b([a-zA-Z0-9._%+-])([a-zA-Z0-9._%+-]*)(@[a-zA-Z0-9.-]+\.[a-zA-Z]{2,})\b)",
            "$1***$3",
            true);
    }
 
    void add_ip_address_pattern() {
        // Matches IPv4 addresses, masks last two octets
        rules_.emplace_back(
            "ip_address",
            R"(\b(\d{1,3})\.(\d{1,3})\.(\d{1,3})\.(\d{1,3})\b)",
            "$1.$2.x.x",
            true);
    }
 
    void add_phone_number_pattern() {
        // Matches phone numbers in various formats
        rules_.emplace_back(
            "phone_number",
            R"(\b(\+?\d{1,3}[-.\s]?)(\d{3})[-.\s]?(\d{3})[-.\s]?(\d{4})\b)",
            "$1***-***-$4",
            true);
    }
 
    static std::string apply_rule(const std::string& input, const sanitization_rule& rule) {
        return std::regex_replace(input, rule.pattern, rule.replacement);
    }
};
 
inline log_sanitizer make_default_sanitizer() {
    log_sanitizer sanitizer;
    sanitizer.add_common_patterns();
    return sanitizer;
}
 
} // namespace kcenon::logger::security