Repository: kubernetes-csi/csi-driver-smb (go)

Issue:
password should not be exposed in logs
<!-- Please use this template while reporting a bug and provide as much info as possible. Not doing so may result in your bug not being addressed in a timely manner. Thanks!
-->


**What happened**:
password should not be exposed in logs:
```
 nodeserver.go:120] NodeStageVolume called with request {arbitrary-volumeid map[] /var/lib/kubelet/plugins/kubernetes.io/csi/pv/pv-smb/globalmount mount:<mount_flags:"dir_mode=0777" mount_flags:"file_mode=0777" mount_flags:"vers=3.0" > access_mode:<mode:MULTI_NODE_MULTI_WRITER >  map[password:..dYGisUKDE3axDL6x1KyEj9j9PrUp0Yd7U/WbZ0Ip1uluWQr8FSkFgQhIO6fhaCGKd+aJSCrnTgR3m99OMQ== username:f8471372a68594910913ed4] map[source://f8471372a68594910913ed4.file.core.windows.net/kubernetes-dynamic-pvc-687cfca7-4880-4dbc-9daa-be4bc39b8eaa] {} [] 0}
I0510 03:32:33.846897       1 nodeserver.go:169] targetPath(/var/lib/kubelet/plugins/kubernetes.io/csi/pv/pv-smb/globalmount) volumeID(arbitrary-volumeid) context(map[source://xxx.file.core.windows.net/kubernetes-dynamic-pvc-687cfca7-4880-4dbc-9daa-be4bc39b8eaa]) mountflags([dir_mode=0777 file_mode=0777 vers=3.0]) mountOptions([dir_mode=0777 file_mode=0777 username=f8471372a68594910913ed4,password=...YGisUKDE3axDL6x1KyEj9j9PrUp0Yd7U/WbZ0Ip1uluWQr8FSkFgQhIO6fhaCGKd+aJSCrnTgR3m99OMQ== vers=3.0])
```

https://github.com/csi-driver/csi-driver-smb/blob/bcd8d774b631d8a6281ed7184a357183c84fff29/deploy/example/logs/csi-smb-node.log#L39

similar to fix: https://github.com/kubernetes-sigs/azurefile-csi-driver/pull/64

related code:
https://github.com/csi-driver/csi-driver-smb/blob/bcd8d774b631d8a6281ed7184a357183c84fff29/pkg/csi-common/utils.go#L112

**What you expected to happen**:

**How to reproduce it**:

**Anything else we need to know?**:

**Environment**:
- CSI Driver version:
- Kubernetes version (use `kubectl version`):
- OS (e.g. from /etc/os-release):
- Kernel (e.g. `uname -a`):
- Install tools:
- Others:


Pull request:
Fix username and password exposed in logs
Signed-off-by: Animesh Kumar <animuz111@gmail.com>

<!--  Thanks for sending a pull request!  Here are some tips for you:

1. If this is your first time, please read our contributor guidelines: https://git.k8s.io/community/contributors/guide#your-first-contribution and developer guide https://git.k8s.io/community/contributors/devel/development.md#development-guide
2. Please label this pull request according to what type of issue you are addressing, especially if this is a release targeted pull request. For reference on required PR/issue labels, read here:
https://git.k8s.io/community/contributors/devel/release.md#issue-kind-label
3. Ensure you have added or ran the appropriate tests for your PR: https://git.k8s.io/community/contributors/devel/testing.md
4. If you want *faster* PR reviews, read how: https://git.k8s.io/community/contributors/guide/pull-requests.md#best-practices-for-faster-reviews
5. Follow the instructions for writing a release note: https://git.k8s.io/community/contributors/guide/release-notes.md
6. If the PR is unfinished, see how to mark it: https://git.k8s.io/community/contributors/guide/pull-requests.md#marking-unfinished-pull-requests
-->

**What type of PR is this?**
> Uncomment only one ` /kind <>` line, hit enter to put that in a new line, and remove leading whitespaces from that line:
>
> /kind api-change
> /kind bug
> /kind cleanup
> /kind design
> /kind documentation
> /kind test
> /kind failing-test
> /kind feature
> /kind flake

**What this PR does / why we need it**:

**Which issue(s) this PR fixes**:
<!-- 
*Automatically closes linked issue when PR is merged.
Usage: `Fixes #<issue number>`, or `Fixes (paste link of issue)`.
_If PR is about `failing-tests or flakes`, please post the related issues/tests in a comment and do not use `Fixes`_*
-->
Fixes #7 

**Special notes for your reviewer**:
A new test file has been created. The current test is specific to this Fix.
I will try and add a complete test file in another PR.

**Release note**:
```
Fixes password which get exposed in logs.
```


Patch:
diff --git a/pkg/smb/nodeserver.go b/pkg/smb/nodeserver.go
index 7f256bf06..51da00552 100644
--- a/pkg/smb/nodeserver.go
+++ b/pkg/smb/nodeserver.go
@@ -20,6 +20,7 @@ import (
 	"fmt"
 	"io/ioutil"
 	"os"
+	"regexp"
 	"runtime"
 	"strings"
 	"time"
@@ -117,7 +118,11 @@ func (d *Driver) NodeUnpublishVolume(ctx context.Context, req *csi.NodeUnpublish
 
 // NodeStageVolume mount the volume to a staging path
 func (d *Driver) NodeStageVolume(ctx context.Context, req *csi.NodeStageVolumeRequest) (*csi.NodeStageVolumeResponse, error) {
-	klog.V(2).Infof("NodeStageVolume called with request %v", *req)
+	// regex to mask username and password in log messages
+	var reqSecretsRegex, _ = regexp.Compile("map\\[password:.*? ")
+	s := fmt.Sprintf("NodeStageVolume called with request %v", *req)
+	klog.V(5).Info(reqSecretsRegex.ReplaceAllString(s, "map[password:**** "))
+
 	if len(req.GetVolumeId()) == 0 {
 		return nil, status.Error(codes.InvalidArgument, "Volume ID missing in request")
 	}


Test patch:
diff --git a/pkg/smb/nodeserver_test.go b/pkg/smb/nodeserver_test.go
new file mode 100644
index 000000000..b4cc1ba43
--- /dev/null
+++ b/pkg/smb/nodeserver_test.go
@@ -0,0 +1,82 @@
+/*
+Copyright 2020 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package smb
+
+import (
+	"bytes"
+	"context"
+	"flag"
+	"github.com/container-storage-interface/spec/lib/go/csi"
+	"github.com/stretchr/testify/assert"
+	"k8s.io/klog"
+	"testing"
+)
+
+func TestNodeStageVolume(t *testing.T) {
+
+	klog.InitFlags(nil)
+	if e := flag.Set("logtostderr", "false"); e != nil {
+		t.Error(e)
+	}
+	if e := flag.Set("alsologtostderr", "false"); e != nil {
+		t.Error(e)
+	}
+	if e := flag.Set("v", "100"); e != nil {
+		t.Error(e)
+	}
+	flag.Parse()
+
+	buf := new(bytes.Buffer)
+	klog.SetOutput(buf)
+
+	d := NewFakeDriver()
+
+	tests := []struct {
+		name   string
+		req    *csi.NodeStageVolumeRequest
+		expStr string
+	}{
+		{
+			"with secrets",
+			&csi.NodeStageVolumeRequest{
+				VolumeId: "vol_1",
+				Secrets: map[string]string{
+					"password": "testpassword",
+					"username": "testuser",
+				},
+				VolumeCapability: &csi.VolumeCapability{},
+				XXX_sizecache:    100,
+			},
+			`NodeStageVolume called with request {vol_1 map[]   map[password:**** username:testuser] map[] {} [] 100}`,
+		},
+	}
+
+	for _, test := range tests {
+		t.Run(test.name, func(t *testing.T) {
+			// EXECUTE
+			_, _ = d.NodeStageVolume(context.Background(), test.req)
+			klog.Flush()
+
+			//ASSERT
+			assert.Contains(t, buf.String(), test.expStr)
+
+			// CLEANUP
+			buf.Reset()
+		})
+	}
+
+}
diff --git a/pkg/smb/smb_test.go b/pkg/smb/smb_test.go
index 7b81802d4..77c0e618a 100644
--- a/pkg/smb/smb_test.go
+++ b/pkg/smb/smb_test.go
@@ -17,14 +17,30 @@ limitations under the License.
 package smb
 
 import (
+	"github.com/stretchr/testify/assert"
 	"io/ioutil"
 	"os"
 	"path/filepath"
 	"testing"
+)
 
-	"github.com/stretchr/testify/assert"
+const (
+	fakeNodeID = "fakeNodeID"
 )
 
+func NewFakeDriver() *Driver {
+
+	driver := NewDriver(fakeNodeID)
+
+	return driver
+}
+
+func TestNewFakeDriver(t *testing.T) {
+	// Test New fake driver.
+	d := NewDriver(fakeNodeID)
+	assert.NotNil(t, d)
+}
+
 func TestIsCorruptedDir(t *testing.T) {
 	existingMountPath, err := ioutil.TempDir(os.TempDir(), "csi-mount-test")
 	if err != nil {