myronmarston/vcr — Issue #141: Sensitive data filter regular expressions
Author: mtjhax
Created: 2012-03-02 18:07:44+00:00
State: open

This is just an idea so feel free to close the issue and save/not save this elsewhere...

Sometimes there is sensitive data that is different in every interaction. Session keys, auth tokens, etc. It would be nice if I could do a gsub with regexps on sensitive data, i.e.:

c.filter_sensitive_data('\1') { /(access_token=)\w+(?=[^\w]*)/ }

In which case, "blah&access_token=12345&blah" would be replaced with "blah&access_token=&blah".

Of course, the problem is that since the matched pattern was not a predictable value, it can't be put back into the interaction at playback. Personally, I would be happy if this was just a one-way filter and you needed to be careful how you used it (I just need to replace the sensitive values and it's okay if the playback includes my replacements), but that just doesn't "feel" right.

Just spitballing here... what if there was a method that could be provided with a block that handles saving and restoring matched values? Sort of a dynamic filter_sensitive_data:

c.dynamic_filter(/replace_this/, "with_this") do |with_this, value|
if value
# save value somewhere safe using with_this as a key
else
# retrieve the saved value to plug back in on replay
end
end

To implement this you would need something like gsub but with a callback that is executed for each replacement. I would love to take a stab at writing something and see what you think, but unfortunately I'm not able to set aside the time at the moment.