debug_redaction added

src/GamUpdate.txt

@@ -1,3 +1,11 @@
+7.26.00
+
+Added `debug_redaction` Boolean variable to `gam.cfg`. When True, the default,
+sensitive data like access/refresh tokens, client secret and authorization codes
+are redacted from debug output. This allows you to post debug output without
+compromising your account information. Even with debug redaction,
+anything shared publicly should be double-checked for sensitive content. 
+
 7.25.01
 
 Fixed bug in `gam config timezone <String>` to handle timezone abbreviations correctly;

src/gam/__init__.py

@@ -25,7 +25,7 @@ https://github.com/GAM-team/GAM/wiki
 """
 
 __author__ = 'GAM Team <google-apps-manager@googlegroups.com>'
-__version__ = '7.25.01'
+__version__ = '7.26.00'
 __license__ = 'Apache License 2.0 (http://www.apache.org/licenses/LICENSE-2.0)'
 
 #pylint: disable=wrong-import-position
@@ -375,9 +375,7 @@ YUBIKEY_VALUE_ERROR_RC = 85
 YUBIKEY_MULTIPLE_CONNECTED_RC = 86
 YUBIKEY_NOT_FOUND_RC = 87
 
-def redact_sensitive_google_text(text):
+DEBUG_REDACTION_PATTERNS = [
-    replace_patterns = [
-
   # Positional patterns that redact sensitive credentials based on their location
   (r'(Bearer\s+)\S+', r'\1*****'), # access tokens and JWTs in auth header
   (r'([?&]refresh_token=)[^&]*', r'\1*****'), # refresh token URL parameter
@@ -385,7 +383,7 @@ def redact_sensitive_google_text(text):
   (r'([?&]key=)[^&]*', r'\1*****'), # API key URL parameter
   (r'([?&]code=)[^&]*', r'\1*****'), # auth code URL parameter
 
-            # pattern match patterns that redact sensitive credentials based on known credential pattern
+  # Pattern match patterns that redact sensitive credentials based on known credential pattern
   (r'ya29.[0-9A-Za-z-_]+', '*****'), # Access token
   (r'1%2F%2F[0-9A-Za-z-_]{100}|1%2F%2F[0-9A-Za-z-_]{64}|1%2F%2F[0-9A-Za-z-_]{43}', '*****'), # Refresh token
   (r'4/[0-9A-Za-z-_]+', '*****'), # Auth code
@@ -393,9 +391,6 @@ def redact_sensitive_google_text(text):
   (r'AIza[0-9A-Za-z-_]{35}', '*****'), # API key
   (r'eyJ[a-zA-Z0-9\-_]+\.eyJ[a-zA-Z0-9\-_]+\.[a-zA-Z0-9\-_]*', '*****'), # JWT
   ]
-    for pattern, replace in replace_patterns:
-      text = re.sub(pattern, replace, text)
-    return text
 
 def redactable_debug_print(*args):
   processed_args = []
@@ -406,7 +401,8 @@ def redactable_debug_print(*args):
       arg = sbytes.decode()
       arg = arg.replace('\\r\\n', "\n          ")
     if GC.Values[GC.DEBUG_REDACTION]:
-      arg = redact_sensitive_google_text(arg)
+      for pattern, replace in DEBUG_REDACTION_PATTERNS:
+        arg = re.sub(pattern, replace, arg)
     processed_args.append(arg)
   print(*processed_args)