Apply mask on email address from user info MSALDisplayableUserIdKey

Author: Kai Song

IdentityCore/src/logger/MSIDMaskedLogParameter.m

@@ -116,7 +116,28 @@ - (NSString *)noMaskWithCondition
     if ([self.parameterValue isKindOfClass:[NSError class]])
     {
         NSError *errorParameter = (NSError *)self.parameterValue;
-        return [NSString stringWithFormat:@"MaskedError(%@, %ld)", errorParameter.domain, (long)errorParameter.code];
+        if (errorParameter.userInfo && errorParameter.userInfo.allKeys.count > 0)
+        {
+            NSString *emailRegex = @"[A-Z0-9a-z._%+-]+@[A-Za-z0-9.-]+\\.[A-Za-z]{2,64}";
+            NSPredicate *emailPredicate = [NSPredicate predicateWithFormat:@"SELF MATCHES %@", emailRegex];
+            BOOL maskedError = NO;
+            NSMutableDictionary *localUserInfo = [errorParameter.userInfo mutableCopy];
+            for (NSErrorUserInfoKey key in errorParameter.userInfo)
+            {
+                if ([errorParameter.userInfo[key] isKindOfClass:NSString.class])
+                {
+                    if ([emailPredicate evaluateWithObject:errorParameter.userInfo[key]])
+                    {
+                        localUserInfo[key] = _PII_NULLIFY(errorParameter.userInfo[key]);
+                        maskedError = YES;
+                    }
+                }
+            }
+            if (maskedError)
+            {
+                return [NSString stringWithFormat:@"MaskedError(%@, %ld, %@)", errorParameter.domain, (long)errorParameter.code, localUserInfo];
+            }
+        }
     }
 
     return [NSString stringWithFormat:@"%@", self.parameterValue]; // For a generic case, don't mask it

IdentityCore/tests/MSIDMaskedLogParameterTests.m

@@ -66,7 +66,7 @@ - (void)testDescription_whenPIIDisabled_andParameterOfErrorType_shouldReturnMask
     XCTAssertEqualObjects(description, @"MaskedError(MSIDErrorDomain, -10003)");
 }
 
-- (void)testDescription_whenPIIEnabled_andParameterOfErrorType_shouldReturnNonMaskedValue
+- (void)testDescription_whenPIIEnabled_andParameterOfErrorType_andWithoutUpn_shouldReturnNonMaskedValue
 {
     [MSIDLogger sharedLogger].logMaskingLevel = MSIDLogMaskingSettingsMaskSecretsOnly;
     NSError *error = MSIDCreateError(MSIDErrorDomain, -10003, @"test", @"invalid_grant", @"bad_token", nil, nil, nil, NO);
@@ -75,6 +75,23 @@ - (void)testDescription_whenPIIEnabled_andParameterOfErrorType_shouldReturnNonMa
     XCTAssertEqualObjects(description, @"Error Domain=MSIDErrorDomain Code=-10003 \"(null)\" UserInfo={MSIDOAuthErrorKey=invalid_grant, MSIDOAuthSubErrorKey=bad_token, MSIDErrorDescriptionKey=test}");
 }
 
+- (void)testDescription_whenPIIEnabled_andParameterOfErrorType_andWithUpn_shouldReturnNonMaskedValue_butUpnMasked
+{
+    [MSIDLogger sharedLogger].logMaskingLevel = MSIDLogMaskingSettingsMaskSecretsOnly;
+    NSError *error = MSIDCreateError(MSIDErrorDomain, -10003, @"test", @"invalid_grant", @"bad_token", nil, nil, @{@"MSALDisplayableUserIdKey":@"[email protected]"}, NO);
+    MSIDMaskedLogParameter *logParameter = [[MSIDMaskedLogParameter alloc] initWithParameterValue:error];
+    NSString *description = [logParameter description];
+    NSString *expectedDescription = [NSString stringWithFormat:
+        @"MaskedError(MSIDErrorDomain, -10003, {\n"
+        "    MSALDisplayableUserIdKey = \"%@\";\n"
+        "    MSIDErrorDescriptionKey = %@;\n"
+        "    MSIDOAuthErrorKey = \"%@\";\n"
+        "    MSIDOAuthSubErrorKey = \"%@\";\n"
+        "})",
+        @"(not-null)", @"test", @"invalid_grant", @"bad_token"];
+    XCTAssertEqualObjects(description, expectedDescription);
+}
+
 - (void)testDescription_whenPIIDisabled_andParameterOfNSNullType_shouldReturnMaskedValue
 {
     [MSIDLogger sharedLogger].logMaskingLevel = MSIDLogMaskingSettingsMaskAllPII;
@@ -109,4 +126,40 @@ - (void)testDescription_whenPIIEnabled_andNilParameter_shouldReturnMaskedValue
     XCTAssertEqualObjects(description, @"(null)");
 }
 
+- (void)testDescription_whenEuiiOnlyEnabled_andNotEuii_andParameterOfErrorType_andWithoutUpn_shouldReturnNonMaskedValue
+{
+    [MSIDLogger sharedLogger].logMaskingLevel = MSIDLogMaskingSettingsMaskEUIIOnly;
+    NSError *error = MSIDCreateError(MSIDErrorDomain, -10003, @"test", @"invalid_grant", @"bad_token", nil, nil, nil, NO);
+    MSIDMaskedLogParameter *logParameter = [[MSIDMaskedLogParameter alloc] initWithParameterValue:error];
+    NSString *description = [logParameter description];
+    XCTAssertEqualObjects(description, @"Error Domain=MSIDErrorDomain Code=-10003 \"(null)\" UserInfo={MSIDOAuthErrorKey=invalid_grant, MSIDOAuthSubErrorKey=bad_token, MSIDErrorDescriptionKey=test}");
+}
+
+- (void)testDescription_whenEuiiOnlyEnabled_andNotEuii_andParameterOfErrorType_andWitUpn_shouldReturnNonMaskedValue_butUpnMasked
+{
+    [MSIDLogger sharedLogger].logMaskingLevel = MSIDLogMaskingSettingsMaskEUIIOnly;
+    NSError *error = MSIDCreateError(MSIDErrorDomain, -10003, @"test", @"invalid_grant", @"bad_token", nil, nil, @{@"MSALDisplayableUserIdKey":@"[email protected]"}, NO);
+    MSIDMaskedLogParameter *logParameter = [[MSIDMaskedLogParameter alloc] initWithParameterValue:error];
+    NSString *description = [logParameter description];
+    NSString *expectedDescription = [NSString stringWithFormat:
+        @"MaskedError(MSIDErrorDomain, -10003, {\n"
+        "    MSALDisplayableUserIdKey = \"%@\";\n"
+        "    MSIDErrorDescriptionKey = %@;\n"
+        "    MSIDOAuthErrorKey = \"%@\";\n"
+        "    MSIDOAuthSubErrorKey = \"%@\";\n"
+        "})",
+        @"(not-null)", @"test", @"invalid_grant", @"bad_token"];
+    XCTAssertEqualObjects(description, expectedDescription);
+}
+
+- (void)testDescription_whenEuiiOnlyEnabled_andIsEuii_andParameterOfErrorType_andWitUpn_shouldReturnMaskedValue
+{
+    [MSIDLogger sharedLogger].logMaskingLevel = MSIDLogMaskingSettingsMaskEUIIOnly;
+    NSError *error = MSIDCreateError(MSIDErrorDomain, -10003, @"test", @"invalid_grant", @"bad_token", nil, nil, @{@"MSALDisplayableUserIdKey":@"[email protected]"}, NO);
+    MSIDMaskedLogParameter *logParameter = [[MSIDMaskedLogParameter alloc] initWithParameterValue:error isEUII:YES];
+    NSString *description = [logParameter description];
+    XCTAssertEqualObjects(description, @"MaskedError(MSIDErrorDomain, -10003)");
+
+}
+
 @end