feat: mask values

Author: ablaszkiewicz

posthog/exception_utils.py

@@ -54,6 +54,7 @@
     r"(?i).*privatekey.*",
     r"(?i).*private_key.*",
     r"(?i).*token.*",
+    r"(?i).*aws_secret_access_key.*",
 ]
 
 DEFAULT_CODE_VARIABLES_IGNORE_PATTERNS = [r"^__.*"]
@@ -1046,7 +1047,10 @@ def serialize_code_variables(
             serialized = _serialize_variable_value(value, limiter, max_length)
             if serialized is None:
                 break
-            result[name] = serialized
+            if isinstance(serialized, str) and _pattern_matches(serialized, compiled_mask):
+                result[name] = CODE_VARIABLES_REDACTED_VALUE
+            else:
+                result[name] = serialized
 
     return result
 

posthog/test/test_exception_capture.py

@@ -60,7 +60,8 @@ def trigger_error():
         my_bool = True
         my_dict = {"name": "test", "value": 123}
         my_obj = UnserializableObject()
-        my_password = "secret123"  # Should be masked by default
+        my_password = "secret123"  # Should be masked by default (name matches)
+        my_innocent_var = "contains_password_here"  # Should be masked by default (value matches)
         __should_be_ignored = "hidden"  # Should be ignored by default
         
         1/0  # Trigger exception
@@ -98,6 +99,7 @@ def process_data():
     assert b'"my_dict": "{\\"name\\": \\"test\\", \\"value\\": 123}"' in output
     assert b"<__main__.UnserializableObject object at" in output
     assert b"'my_password': '$$_posthog_redacted_based_on_masking_rules_$$'" in output
+    assert b"'my_innocent_var': '$$_posthog_redacted_based_on_masking_rules_$$'" in output
     assert b"'__should_be_ignored':" not in output
 
     # Variables from intermediate_function frame