NAME

Log::Scrubber - Perl extension to avoid logging sensitive data

SYNOPSIS

            

              
              
use Log::Scrubber;             # Override warn() and die() and import scrubber_init()
use Log::Scrubber qw(:all);    # Override everything this module knows
use Log::Scrubber qw(:Carp);   # Only override Carp methods
use Log::Scrubber qw(:Syslog); # Only override syslog()
use Log::Scrubber qw(scrubber);# scrubber() for use on your own
use Log::Scrubber qw(+Custom::Method);# Override any perl method
use Log::Scrubber qw($SCRUBBER :Carp +My::Logs); # Or combine a few
Example:
  use Log::Scrubber;
  scrubber_init( { '4007000000027' => 'DELETED' } );
  warn "The card number is 4007000000027.\n";
Output:
  The card number is DELETED.
            
          

DESCRIPTION

As required by the PCI Security Standards Council, some data is not acceptable to send to log files. Most notably CVV data. However it is simply a matter of time before a developer accidentally (or on purpose) logs sensitive data to the error_log, or some other inappropriate location.

This module is a solution for this vulnerability. It allows you to create a single location for redaction. What it does is very simple: It replaces occurrences of the your sensitive data in the output of any common logging mechanism such as use warnings, warn, use Carp and die with an acceptable alternative provided by you.

It does so by overriding the functions with a safer alternative so that no code needs to be changed.

Note that in order for this protection to be effective, this module must be used as the last module (ie, after all the modules it can override) in order for proper method replacement to occur.

The protection can also be invoked by the scrubber method, which takes a list of arguments and returns the same list, with all data safely replaced. This method is provided so that you can call it by yourself.

Typically, you will want to issue an use Log::Scrubber qw(:all) after the last module is used in your code, to automatically benefit from the most common level of protection.

Note: If you are using $SIG{__WARN__} and $SIG{__DIE__} then you must call scrubber_init() or set $SCRUBBER=1 afterward to maintain full protection.

METHODS

Additional methods created by this package.

scrubber_init

            

              
              
Both adds scrubbers to your list, and enables Log::Scrubber
scrubber_init( { # Initialize the scrubber.
  $ereg1 => $replacementText,
  $ereg2 => $rep2,
  $key1  => sub { my ($key,$val) = @_; $val++; return $val; },
  $key2  => sub { my ($key,$val) = @_; $val =~ s/1/2/; return $val; },
  } )
            
          

scrubber_start

            

              
              
Enables scrubbing by overriding all configured methods/signals.
scrubber_start();
# or
$SCRUBBER = 1;
            
          

scrubber_stop

            

              
              
Disables scrubbing by removing the method/signal overrides.  When disabled your scripts should function exactly as if Log::Scrubber was never installed.
scrubber_stop();
# or
$SCRUBBER = 0;
            
          

scrubber_add_scrubber

            

              
              
Add a new regular expression, or coderef scrubber.  This follows the same format as init_scrubber()
scrubber_add_scrubber({$ereg=>$replaceTxt});
            
          

scrubber_remove_scrubber

            

              
              
Remove a previously added scrubber.
scrubber_remove_scrubber({$ereg=>$replaceTxt});
            
          

scrubber

            

              
              
Allows manual use of the scrubber
@clean = scrubber( @dirty );
$clean = scrubber $clean;
            
          

scrubber_enabled

            

              
              
if (scrubber_enabled()) { print "Yes it is\n"; }
# or
if ($SCRUBBER) { print "Yes it is\n"; }
            
          

scrubber_add_signal

scrubber_remove_signal

            

              
              
scrubber_add_signal('__WARN__');
            
          

scrubber_add_method

scrubber_remove_method

            

              
              
scrubber_add_method('Carp::croak');
            
          

scrubber_add_package

scrubber_remove_package

            

              
              
# Use with caution, it overrides EVERYTHING in the package.  It's usually better to override methods with scrubber_add_method.
scrubber_add_package('Carp');
            
          

LOCAL SCOPING

The scrubber can be locally modified.

            

              
              
use Log::Scrubber qw($SCRUBBER);
# setup the scrubber
{
  local $SCRUBBER;
  # modify scrubber as needed
}
# scrubber is now restored back to what it was
            
          

EXPORT

Many. The methods are exported or overridden according to this

            

              
              
$SIG{__WARN__}     - Always overridden
$SIG{__DIE__}      - Always overridden
warnings::warn()   - Always overridden
warnings::warnif() - Always overridden
Carp::croak()      - Only exported with :Carp or :all
Carp::carp()       - Only exported with :Carp or :all
Carp::confess()    - Only exported with :Carp or :all
Carp::cluck()      - Only exported with :Carp or :all
main::syslog()     - Only exported with :Syslog or :all
Custom::method()   - Custom methods can also be overridden.
            
          

AUTHOR

Jason Terry <oaxlin@cpan.org>

SEE ALSO

perl(1), Carp(3), warnings(3), Sys::Syslog(3), Unix::Syslog(3)