Migrate logging obfuscation

Author: Avanatiker

agent/src/main/kotlin/com/teamscale/jacoco/agent/PreMain.kt

@@ -144,7 +144,7 @@ object PreMain {
 		if (!differentAgents.isEmpty()) {
 			delayedLogger.warn(
 				"Using multiple java agents could interfere with coverage recording: ${
-					differentAgents.joinToString()
+					AgentOptions.obfuscateAccessToken(differentAgents.joinToString())
 				}"
 			)
 		}

agent/src/main/kotlin/com/teamscale/jacoco/agent/options/AgentOptions.kt

@@ -44,6 +44,7 @@ import java.nio.file.Paths
 import java.time.LocalDateTime
 import java.time.format.DateTimeFormatter
 import java.util.*
+import java.util.regex.Matcher
 import java.util.regex.Pattern
 import kotlin.io.path.exists
 import kotlin.io.path.isReadable
@@ -231,26 +232,7 @@ open class AgentOptions(private val logger: ILogger) {
 	 * "config-file=jacocoagent.properties,teamscale-access-token=************mNHn"
 	 */
 	val obfuscatedOptionsString: String?
-		get() {
-			val original = originalOptionsString ?: return ""
-
-			val pattern = Pattern.compile("(.*-access-token=)([^,]+)(.*)")
-			val match = pattern.matcher(original)
-			if (match.find()) {
-				val apiKey = match.group(2)
-				val obfuscatedApiKey = "************${
-					apiKey.substring(
-						max(
-							0,
-							apiKey.length - 4
-						)
-					)
-				}"
-				return "${match.group(1)}$obfuscatedApiKey${match.group(3)}"
-			}
-
-			return originalOptionsString
-		}
+		get() = obfuscateAccessToken(originalOptionsString)
 
 	/**
 	 * Validates the options and returns a validator with all validation errors.
@@ -676,6 +658,39 @@ open class AgentOptions(private val logger: ILogger) {
 		val DATE_TIME_FORMATTER: DateTimeFormatter =
 			DateTimeFormatter.ofPattern("yyyy-MM-dd-HH-mm-ss.SSS", Locale.ENGLISH)
 
+		/**
+		 * Obfuscates any "*-access-token=..." value in the given options string for safe logging. Keeps only the
+		 * last 4 characters of each token. Returns an empty string for `null` input and the original string when no
+		 * token pattern matches.
+		 */
+		@JvmStatic
+		fun obfuscateAccessToken(optionsString: String?): String {
+			if (optionsString == null) {
+				return ""
+			}
+
+			val pattern = Pattern.compile("(-access-token=)([^,\\n\\r]+)")
+			val matcher = pattern.matcher(optionsString)
+			val obfuscated = StringBuffer()
+			var foundAny = false
+			while (matcher.find()) {
+				foundAny = true
+				val apiKey = matcher.group(2)
+				val obfuscatedApiKey = "************${
+					apiKey.substring(max(0, apiKey.length - 4))
+				}"
+				matcher.appendReplacement(
+					obfuscated,
+					Matcher.quoteReplacement(matcher.group(1) + obfuscatedApiKey)
+				)
+			}
+			if (!foundAny) {
+				return optionsString
+			}
+			matcher.appendTail(obfuscated)
+			return obfuscated.toString()
+		}
+
 		/**
 		 * The default excludes applied to JaCoCo. These are packages that should never be profiled. Excluding them makes
 		 * debugging traces easier and reduces trace size and warnings about unmatched classes in Teamscale.

agent/src/main/kotlin/com/teamscale/jacoco/agent/options/AgentOptionsParser.kt

@@ -59,7 +59,7 @@ class AgentOptionsParser @VisibleForTesting internal constructor(
 		if (optionsString == null) {
 			optionsString = ""
 		}
-		logger.debug("Parsing options: $optionsString")
+		logger.debug("Parsing options: ${AgentOptions.obfuscateAccessToken(optionsString)}")
 
 		val options = AgentOptions(logger)
 		options.originalOptionsString = optionsString
@@ -365,7 +365,11 @@ class AgentOptionsParser @VisibleForTesting internal constructor(
 			options.teamscaleServer.userAccessToken!!
 		)
 		options.configurationViaTeamscale = configuration
-		logger.debug("Received the following options from Teamscale: ${configuration.profilerConfiguration!!.configurationOptions}")
+		logger.debug(
+			"Received the following options from Teamscale: ${
+				AgentOptions.obfuscateAccessToken(configuration.profilerConfiguration!!.configurationOptions)
+			}"
+		)
 		readConfigFromString(options, configuration.profilerConfiguration!!.configurationOptions)
 	}
 

agent/src/test/kotlin/com/teamscale/jacoco/agent/options/AgentOptionsTest.kt

@@ -593,6 +593,52 @@ class AgentOptionsTest {
 			return AgentOptionsParser(CommandLineLogger(), null, null, credentials, null)
 		}
 
+		/** Tests that [AgentOptions.obfuscateAccessToken] hides the token in a comma-separated options string.  */
+		@Test
+		fun obfuscateAccessTokenHidesTokenInOptionsString() {
+			val input =
+				"config-file=jacocoagent.properties,teamscale-access-token=unlYgehaYYYhbPAegNWV3WgjOzxkmNHn,teamscale-partition=p"
+			Assertions.assertThat(AgentOptions.obfuscateAccessToken(input))
+				.isEqualTo("config-file=jacocoagent.properties,teamscale-access-token=************mNHn,teamscale-partition=p")
+		}
+
+		/** Tests that obfuscation also covers tokens in newline-separated input (the format Teamscale returns for config-id).  */
+		@Test
+		fun obfuscateAccessTokenHidesTokenInNewlineSeparatedString() {
+			val input = "teamscale-access-token=unlYgehaYYYhbPAegNWV3WgjOzxkmNHn\nteamscale-partition=p"
+			Assertions.assertThat(AgentOptions.obfuscateAccessToken(input))
+				.isEqualTo("teamscale-access-token=************mNHn\nteamscale-partition=p")
+		}
+
+		/** Tests that obfuscation hides every `*-access-token=` occurrence, not just the last one.  */
+		@Test
+		fun obfuscateAccessTokenHidesMultipleTokens() {
+			val input =
+				"teamscale-access-token=unlYgehaYYYhbPAegNWV3WgjOzxkmNHn,artifactory-access-token=anotherSecretAbcd"
+			Assertions.assertThat(AgentOptions.obfuscateAccessToken(input))
+				.isEqualTo("teamscale-access-token=************mNHn,artifactory-access-token=************Abcd")
+		}
+
+		/** Tests that strings without an access token are returned unchanged.  */
+		@Test
+		fun obfuscateAccessTokenReturnsInputUnchangedWhenNoTokenPresent() {
+			val input = "config-file=jacocoagent.properties,teamscale-partition=p"
+			Assertions.assertThat(AgentOptions.obfuscateAccessToken(input)).isEqualTo(input)
+		}
+
+		/** Tests the null-input contract used by [AgentOptions.obfuscatedOptionsString].  */
+		@Test
+		fun obfuscateAccessTokenReturnsEmptyStringForNullInput() {
+			Assertions.assertThat(AgentOptions.obfuscateAccessToken(null)).isEmpty()
+		}
+
+		/** Tests that a token shorter than 4 characters does not throw and is fully obfuscated.  */
+		@Test
+		fun obfuscateAccessTokenHandlesShortToken() {
+			Assertions.assertThat(AgentOptions.obfuscateAccessToken("teamscale-access-token=abc"))
+				.isEqualTo("teamscale-access-token=************abc")
+		}
+
 		/**
 		 * Delete created coverage folders
 		 */

common-system-test/src/main/kotlin/com/teamscale/test/commons/TeamscaleMockServer.kt

@@ -52,7 +52,7 @@ class TeamscaleMockServer(val port: Int) {
 
 	init {
 		service.port(port)
-		service.exception<Exception>(Exception::class.java) { exception, _, response ->
+		service.exception(Exception::class.java) { exception, _, response ->
 			response.status(HttpServletResponse.SC_INTERNAL_SERVER_ERROR)
 			response.body("Exception: " + exception!!.message)
 		}