Function sanitizeErrorMessage

speedlink/speedlink.ts:119–153

(error: string, server?: ServerConfig)

    child.on("close", () => { clearTimeout(timer); });
  });
}

// --- Sanitize sensitive information from error messages ---
function sanitizeErrorMessage(error: string, server?: ServerConfig): string {
  let sanitized = error;
  
  // Remove passwords
  sanitized = sanitized.replace(/sshpass -p '[^']*'/gi, "sshpass -p '***'");
  sanitized = sanitized.replace(/password[:\s]+\S+/gi, "password: ***");
  
  // Mask IP addresses (full mask)
  sanitized = sanitized.replace(/\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}/g, '***.***.***.***');
  
  // Mask IPv6 addresses (more aggressive)
  sanitized = sanitized.replace(/([0-9a-fA-F]{1,4}:){2,}[0-9a-fA-F:.]+/g, '***:***:***:***');
  
  // Remove SSH key paths
  sanitized = sanitized.replace(/ssh -i [^\s]+/gi, "ssh -i ***");
  
  // Remove usernames in connection strings
  sanitized = sanitized.replace(/\b[a-zA-Z0-9_-]+@/g, "***@");
  
  // If server config is provided, also remove specific server details
  if (server) {
    sanitized = sanitized.replace(new RegExp(server.host, 'g'), '***');
    sanitized = sanitized.replace(new RegExp(server.username, 'g'), '***');
    if (server.auth_method === 'password') {
      try {
        const password = decrypt(server.credentials);
        sanitized = sanitized.replace(new RegExp(password, 'g'), '***');
      } catch (e) {
        // Ignore decryption errors
      }
    }
  }
  
  return sanitized;
}