Log::Scrubber - Perl extension to avoid logging sensitive data
use Log::Scrubber; # Override warn() and die() and import scrubber_init() use Log::Scrubber qw(:all); # Override everything this module knows use Log::Scrubber qw(:Carp); # Only override Carp methods use Log::Scrubber qw(:Syslog); # Only override syslog() use Log::Scrubber qw(scrubber);# scrubber() for use on your own use Log::Scrubber qw(+Custom::Method);# Override any perl method use Log::Scrubber qw($SCRUBBER :Carp +My::Logs); # Or combine a few Example: use Log::Scrubber; scrubber_init( { '4007000000027' => 'DELETED' } ); warn "The card number is 4007000000027.\n"; Output: The card number is DELETED.
As required by the PCI Security Standards Council, some data is not acceptable to send to log files. Most notably CVV data. However it is simply a matter of time before a developer accidentally (or on purpose) logs sensitive data to the error_log, or some other inappropriate location.
This module is a solution for this vulnerability. It allows you to create a single location for redaction. What it does is very simple: It replaces occurrences of the your sensitive data in the output of any common logging mechanism such as use warnings, warn, use Carp and die with an acceptable alternative provided by you.
use warnings
warn
use Carp
die
It does so by overriding the functions with a safer alternative so that no code needs to be changed.
Note that in order for this protection to be effective, this module must be used as the last module (ie, after all the modules it can override) in order for proper method replacement to occur.
use
The protection can also be invoked by the scrubber method, which takes a list of arguments and returns the same list, with all data safely replaced. This method is provided so that you can call it by yourself.
scrubber
Typically, you will want to issue an use Log::Scrubber qw(:all) after the last module is used in your code, to automatically benefit from the most common level of protection.
use Log::Scrubber qw(:all)
Note: If you are using $SIG{__WARN__} and $SIG{__DIE__} then you must call scrubber_init() or set $SCRUBBER=1 afterward to maintain full protection.
Additional methods created by this package.
Both adds scrubbers to your list, and enables Log::Scrubber scrubber_init( { # Initialize the scrubber. $ereg1 => $replacementText, $ereg2 => $rep2, $key1 => sub { my ($key,$val) = @_; $val++; return $val; }, $key2 => sub { my ($key,$val) = @_; $val =~ s/1/2/; return $val; }, } )
Enables scrubbing by overriding all configured methods/signals. scrubber_start(); # or $SCRUBBER = 1;
Disables scrubbing by removing the method/signal overrides. When disabled your scripts should function exactly as if Log::Scrubber was never installed. scrubber_stop(); # or $SCRUBBER = 0;
Add a new regular expression, or coderef scrubber. This follows the same format as init_scrubber() scrubber_add_scrubber({$ereg=>$replaceTxt});
Remove a previously added scrubber. scrubber_remove_scrubber({$ereg=>$replaceTxt});
Allows manual use of the scrubber @clean = scrubber( @dirty ); $clean = scrubber $clean;
if (scrubber_enabled()) { print "Yes it is\n"; } # or if ($SCRUBBER) { print "Yes it is\n"; }
scrubber_add_signal('__WARN__');
scrubber_add_method('Carp::croak');
# Use with caution, it overrides EVERYTHING in the package. It's usually better to override methods with scrubber_add_method. scrubber_add_package('Carp');
The scrubber can be locally modified.
use Log::Scrubber qw($SCRUBBER); # setup the scrubber { local $SCRUBBER; # modify scrubber as needed } # scrubber is now restored back to what it was
Many. The methods are exported or overridden according to this
$SIG{__WARN__} - Always overridden $SIG{__DIE__} - Always overridden warnings::warn() - Always overridden warnings::warnif() - Always overridden Carp::croak() - Only exported with :Carp or :all Carp::carp() - Only exported with :Carp or :all Carp::confess() - Only exported with :Carp or :all Carp::cluck() - Only exported with :Carp or :all main::syslog() - Only exported with :Syslog or :all Custom::method() - Custom methods can also be overridden.
Jason Terry <oaxlin@cpan.org>
perl(1), Carp(3), warnings(3), Sys::Syslog(3), Unix::Syslog(3)
To install Log::Scrubber, copy and paste the appropriate command in to your terminal.
cpanm
cpanm Log::Scrubber
CPAN shell
perl -MCPAN -e shell install Log::Scrubber
For more information on module installation, please visit the detailed CPAN module installation guide.