From 3f48dcb5750011c4ab6db724988e170c1b2bb314 Mon Sep 17 00:00:00 2001
From: Andras Bacsai <5845193+andrasbacsai@users.noreply.github.com>
Date: Fri, 19 Sep 2025 15:54:44 +0200
Subject: [PATCH] feat(redaction): implement sensitive information redaction in
 logs and commands

---
 app/Models/ApplicationDeploymentQueue.php | 43 +++++++++++++++++++-
 app/Traits/ExecuteRemoteCommand.php       | 48 +++++++++++++++++++++--
 2 files changed, 86 insertions(+), 5 deletions(-)

diff --git a/app/Models/ApplicationDeploymentQueue.php b/app/Models/ApplicationDeploymentQueue.php
index 2a9bea67a..8df6877ab 100644
--- a/app/Models/ApplicationDeploymentQueue.php
+++ b/app/Models/ApplicationDeploymentQueue.php
@@ -85,6 +85,47 @@ class ApplicationDeploymentQueue extends Model
         return str($this->commit_message)->value();
     }
 
+    private function redactSensitiveInfo($text)
+    {
+        $text = remove_iip($text);
+
+        $app = $this->application;
+        if (! $app) {
+            return $text;
+        }
+
+        $lockedVars = collect([]);
+
+        if ($app->environment_variables) {
+            $lockedVars = $lockedVars->merge(
+                $app->environment_variables
+                    ->where('is_shown_once', true)
+                    ->pluck('real_value', 'key')
+                    ->filter()
+            );
+        }
+
+        if ($this->pull_request_id !== 0 && $app->environment_variables_preview) {
+            $lockedVars = $lockedVars->merge(
+                $app->environment_variables_preview
+                    ->where('is_shown_once', true)
+                    ->pluck('real_value', 'key')
+                    ->filter()
+            );
+        }
+
+        foreach ($lockedVars as $key => $value) {
+            $escapedValue = preg_quote($value, '/');
+            $text = preg_replace(
+                '/'.$escapedValue.'/',
+                REDACTED,
+                $text
+            );
+        }
+
+        return $text;
+    }
+
     public function addLogEntry(string $message, string $type = 'stdout', bool $hidden = false)
     {
         if ($type === 'error') {
@@ -96,7 +137,7 @@ class ApplicationDeploymentQueue extends Model
         }
         $newLogEntry = [
             'command' => null,
-            'output' => remove_iip($message),
+            'output' => $this->redactSensitiveInfo($message),
             'type' => $type,
             'timestamp' => Carbon::now('UTC'),
             'hidden' => $hidden,
diff --git a/app/Traits/ExecuteRemoteCommand.php b/app/Traits/ExecuteRemoteCommand.php
index 0c3414efe..f9df19c16 100644
--- a/app/Traits/ExecuteRemoteCommand.php
+++ b/app/Traits/ExecuteRemoteCommand.php
@@ -17,6 +17,46 @@ trait ExecuteRemoteCommand
 
     public static int $batch_counter = 0;
 
+    private function redact_sensitive_info($text)
+    {
+        $text = remove_iip($text);
+
+        if (! isset($this->application)) {
+            return $text;
+        }
+
+        $lockedVars = collect([]);
+
+        if (isset($this->application->environment_variables)) {
+            $lockedVars = $lockedVars->merge(
+                $this->application->environment_variables
+                    ->where('is_shown_once', true)
+                    ->pluck('real_value', 'key')
+                    ->filter()
+            );
+        }
+
+        if (isset($this->pull_request_id) && $this->pull_request_id !== 0 && isset($this->application->environment_variables_preview)) {
+            $lockedVars = $lockedVars->merge(
+                $this->application->environment_variables_preview
+                    ->where('is_shown_once', true)
+                    ->pluck('real_value', 'key')
+                    ->filter()
+            );
+        }
+
+        foreach ($lockedVars as $key => $value) {
+            $escapedValue = preg_quote($value, '/');
+            $text = preg_replace(
+                '/'.$escapedValue.'/',
+                REDACTED,
+                $text
+            );
+        }
+
+        return $text;
+    }
+
     public function execute_remote_command(...$commands)
     {
         static::$batch_counter++;
@@ -74,7 +114,7 @@ trait ExecuteRemoteCommand
                         // Track SSH retry event in Sentry
                         $this->trackSshRetryEvent($attempt, $maxRetries, $delay, $errorMessage, [
                             'server' => $this->server->name ?? $this->server->ip ?? 'unknown',
-                            'command' => remove_iip($command),
+                            'command' => $this->redact_sensitive_info($command),
                             'trait' => 'ExecuteRemoteCommand',
                         ]);
 
@@ -125,8 +165,8 @@ trait ExecuteRemoteCommand
             $sanitized_output = sanitize_utf8_text($output);
 
             $new_log_entry = [
-                'command' => remove_iip($command),
-                'output' => remove_iip($sanitized_output),
+                'command' => $this->redact_sensitive_info($command),
+                'output' => $this->redact_sensitive_info($sanitized_output),
                 'type' => $customType ?? $type === 'err' ? 'stderr' : 'stdout',
                 'timestamp' => Carbon::now('UTC'),
                 'hidden' => $hidden,
@@ -194,7 +234,7 @@ trait ExecuteRemoteCommand
         $retryMessage = "SSH connection failed. Retrying... (Attempt {$attempt}/{$maxRetries}, waiting {$delay}s)\nError: {$errorMessage}";
 
         $new_log_entry = [
-            'output' => remove_iip($retryMessage),
+            'output' => $this->redact_sensitive_info($retryMessage),
             'type' => 'stdout',
             'timestamp' => Carbon::now('UTC'),
             'hidden' => false,