NAVAND-5786 Obfuscate token for shields logs (#9719)

* NAVAND-5786 Obfuscate token for shields logs

GitOrigin-RevId: d2a225e5595be543001a14daf0092f64f760ddf2

Author: yuryybk

tripdata/build.gradle

@@ -45,6 +45,7 @@ dependencies {
     implementation dependenciesList.androidXAppCompat
     implementation dependenciesList.kotlinStdLib
     implementation dependenciesList.coroutinesAndroid
+    implementation(project(':utils'))
 
     apply from: "../gradle/unit-testing-dependencies.gradle"
     testImplementation(project(':libtesting-utils'))

tripdata/src/main/java/com/mapbox/navigation/tripdata/shield/model/RouteShield.kt

@@ -6,6 +6,7 @@ import android.util.TypedValue
 import com.mapbox.api.directions.v5.models.MapboxShield
 import com.mapbox.api.directions.v5.models.ShieldSprite
 import com.mapbox.navigation.ui.utils.internal.SvgUtil
+import com.mapbox.navigation.utils.internal.obfuscateAccessToken
 import java.io.ByteArrayInputStream
 
 /**
@@ -74,9 +75,9 @@ sealed class RouteShield(
          */
         override fun toString(): String {
             return "MapboxLegacyShield(" +
-                "url='$url', " +
+                "url='${url.obfuscateAccessToken()}', " +
                 "byteArray=${byteArray.contentToString()}, " +
-                "initialUrl=$initialUrl" +
+                "initialUrl=${initialUrl.obfuscateAccessToken()}" +
                 ")"
         }
 
@@ -155,7 +156,7 @@ sealed class RouteShield(
          */
         override fun toString(): String {
             return "MapboxDesignedShield(" +
-                "url='$url', " +
+                "url='${url.obfuscateAccessToken()}', " +
                 "byteArray=${byteArray.contentToString()}, " +
                 "mapboxShield=$mapboxShield, " +
                 "shieldSprite=$shieldSprite" +

utils/src/main/java/com/mapbox/navigation/utils/internal/ObfuscateTokenUtil.kt

@@ -0,0 +1,9 @@
+package com.mapbox.navigation.utils.internal
+
+private val ACCESS_TOKEN_REGEX = "access_token=([^\\s\\n&?]+)".toRegex()
+
+fun String.obfuscateAccessToken() = ACCESS_TOKEN_REGEX.replace(this) { matchResult ->
+    val token = matchResult.groupValues[1]
+    val redactedToken = "****" + token.takeLast(4)
+    "access_token=$redactedToken"
+}

utils/src/test/java/com/mapbox/navigation/utils/internal/ObfuscateTokenUtilTest.kt

@@ -0,0 +1,92 @@
+package com.mapbox.navigation.utils.internal
+
+import org.junit.Assert.assertEquals
+import org.junit.Test
+
+class ObfuscateTokenUtilTest {
+
+    @Test
+    fun `obfuscateAccessToken should redact the token in a simple url`() {
+        val url = "https://api.mapbox.com/directions/v5/mapbox/driving/" +
+            "-73.989,40.733;-74,40.733?access_token=pk.1234567890"
+        val expected = "https://api.mapbox.com/directions/v5/mapbox/driving/" +
+            "-73.989,40.733;-74,40.733?access_token=****7890"
+        assertEquals(expected, url.obfuscateAccessToken())
+    }
+
+    @Test
+    fun `obfuscateAccessToken should work when token is the only parameter`() {
+        val url = "https://api.mapbox.com?access_token=pk.1234567890"
+        val expected = "https://api.mapbox.com?access_token=****7890"
+        assertEquals(expected, url.obfuscateAccessToken())
+    }
+
+    @Test
+    fun `obfuscateAccessToken should work with other query parameters`() {
+        val url = "https://api.mapbox.com/directions/v5/mapbox/driving?" +
+            "geometries=polyline&access_token=pk.1234567890&voice_instructions=true"
+        val expected = "https://api.mapbox.com/directions/v5/mapbox/driving?" +
+            "geometries=polyline&access_token=****7890&voice_instructions=true"
+        assertEquals(expected, url.obfuscateAccessToken())
+    }
+
+    @Test
+    fun `obfuscateAccessToken should not change string without access token`() {
+        val url = "https://api.mapbox.com/directions/v5/mapbox/driving"
+        assertEquals(url, url.obfuscateAccessToken())
+    }
+
+    @Test
+    fun `obfuscateAccessToken should handle empty access token`() {
+        val url = "https://api.mapbox.com/directions/v5/mapbox/driving?access_token="
+        assertEquals(url, url.obfuscateAccessToken())
+    }
+
+    @Test
+    fun `obfuscateAccessToken should handle multiple access tokens`() {
+        val url = "https://api.mapbox.com?access_token=pk.first&param=1&access_token=pk.second"
+        val expected = "https://api.mapbox.com?access_token=****irst&param=1&access_token=****cond"
+        assertEquals(expected, url.obfuscateAccessToken())
+    }
+
+    @Test
+    fun `obfuscateAccessToken should handle empty string`() {
+        val url = ""
+        assertEquals(url, url.obfuscateAccessToken())
+    }
+
+    @Test
+    fun `obfuscateAccessToken should handle token shorter than 4 chars`() {
+        val url = "https://api.mapbox.com?access_token=123"
+        val expected = "https://api.mapbox.com?access_token=****123"
+        assertEquals(expected, url.obfuscateAccessToken())
+    }
+
+    @Test
+    fun `obfuscateAccessToken should handle token with exactly 4 chars`() {
+        val url = "https://api.mapbox.com?access_token=1234"
+        val expected = "https://api.mapbox.com?access_token=****1234"
+        assertEquals(expected, url.obfuscateAccessToken())
+    }
+
+    @Test
+    fun `obfuscateAccessToken should handle token with more than 4 chars`() {
+        val url = "https://api.mapbox.com?access_token=12345"
+        val expected = "https://api.mapbox.com?access_token=****2345"
+        assertEquals(expected, url.obfuscateAccessToken())
+    }
+
+    @Test
+    fun `obfuscateAccessToken should handle token ending with newline`() {
+        val url = "https://api.mapbox.com?access_token=pk.1234567890\n"
+        val expected = "https://api.mapbox.com?access_token=****7890\n"
+        assertEquals(expected, url.obfuscateAccessToken())
+    }
+
+    @Test
+    fun `obfuscateAccessToken should handle token followed by ampersand`() {
+        val url = "https://api.mapbox.com?access_token=pk.1234567890&other=param"
+        val expected = "https://api.mapbox.com?access_token=****7890&other=param"
+        assertEquals(expected, url.obfuscateAccessToken())
+    }
+}