Add secret detector extension for OAuth

src/main/java/net/snowflake/client/util/SecretDetector.java

@@ -19,6 +19,7 @@
 import net.minidev.json.JSONArray;
 import net.minidev.json.JSONObject;
 import net.minidev.json.JSONStyle;
+import net.snowflake.client.core.SnowflakeJdbcInternalApi;
 
 /** Search for credentials in sql and/or other text */
 public class SecretDetector {
@@ -34,6 +35,14 @@ public class SecretDetector {
           "(accessToken|tempToken|keySecret)\"\\s*:\\s*\"([a-z0-9/+]{32,}={0,2})\"",
           Pattern.CASE_INSENSITIVE);
 
+  // Used for detecting OAuth tokens in serialized JSON
+  private static final Pattern OAUTH_JSON_PATTERN =
+      Pattern.compile(
+          "(access_token|refresh_token)\""
+              + "\\s*:\\s*"
+              + "\"([a-zA-Z0-9!\"#$%&'\\()*+,-./:;<=>?@\\[\\]^_`\\{|\\}~]{3,})\"",
+          Pattern.CASE_INSENSITIVE);
+
   // Signature added in the query string of a URL in SAS based authentication
   // for S3 or Azure Storage requests
   private static final Pattern SAS_TOKEN_PATTERN =
@@ -88,6 +97,10 @@ public class SecretDetector {
     "sig",
     "signature",
     "temptoken",
+    "oauthClientId",
+    "oauthClientSecret",
+    "accessToken",
+    "refreshToken"
   };
 
   private static Set<String> SENSITIVE_NAME_SET = new HashSet<>(Arrays.asList(SENSITIVE_NAMES));
@@ -113,7 +126,7 @@ public static boolean isSensitive(String name) {
   private static boolean isSensitiveParameter(String name) {
     Pattern PASSWORD_IN_NAME =
         Pattern.compile(
-            ".*?(password|pwd|token|proxyuser|privatekey|passcode|proxypassword|private_key_base).*?",
+            ".*?(password|pwd|token|proxyuser|privatekey|passcode|proxypassword|private_key_base|oauthClientSecret|oauthClientId).*?",
             Pattern.CASE_INSENSITIVE);
     Matcher matcher = PASSWORD_IN_NAME.matcher(name);
     return isSensitive(name) || matcher.matches();
@@ -208,7 +221,26 @@ public static String maskSASToken(String text) {
    */
   public static String maskSecrets(String text) {
     return filterAccessTokens(
-        filterConnectionTokens(filterPassword(filterSASTokens(filterAWSKeys(text)))));
+        filterConnectionTokens(
+            filterPassword(filterSASTokens(filterAWSKeys(filterOAuthTokens(text))))));
+  }
+
+  /**
+   * Masks any secrets present in the OAuth token request JSON response.
+   *
+   * @param text Text which may contain secrets
+   * @return Masked string
+   */
+  @SnowflakeJdbcInternalApi
+  public static String filterOAuthTokens(String text) {
+    Matcher matcher =
+        OAUTH_JSON_PATTERN.matcher(
+            text.length() <= MAX_LENGTH ? text : text.substring(0, MAX_LENGTH));
+
+    if (matcher.find()) {
+      return matcher.replaceAll("$1\":\"****\"");
+    }
+    return text;
   }
 
   /**

src/test/java/net/snowflake/client/util/SecretDetectorTest.java

@@ -214,6 +214,8 @@ public void testMaskParameterValue() {
     testParametersMasked.put("password", "test");
     testParametersMasked.put("sessionToken", "test");
     testParametersMasked.put("token", "test");
+    testParametersMasked.put("oauthClientId", "test");
+    testParametersMasked.put("oauthClientSecret", "test");
 
     Map<String, String> testParametersUnmasked = new HashMap<>();
     testParametersUnmasked.put("oktausername", "test");
@@ -249,6 +251,37 @@ public void testMaskconnectionToken() {
         maskedConnectionToken.equals(SecretDetector.maskSecrets(connectionToken)));
   }
 
+  @Test
+  public void testMaskOAuthSecrets() {
+    String tokenResponseJson =
+        "{\n"
+            + "  \"access_token\" : \"some:FAKE_token123\",\n"
+            + "  \"refresh_token\" : \"some:FAKE_token123\",\n"
+            + "  \"token_type\" : \"Bearer\",\n"
+            + "  \"username\" : \"OAUTH_TEST_AUTH_CODE\",\n"
+            + "  \"scope\" : \"refresh_token session:role:ANALYST\",\n"
+            + "  \"expires_in\" : 600,\n"
+            + "  \"refresh_token_expires_in\" : 86399,\n"
+            + "  \"idpInitiated\" : false\n"
+            + "}";
+
+    String maskedTokenResponseJson =
+        "{\n"
+            + "  \"access_token\":\"****\",\n"
+            + "  \"refresh_token\":\"****\",\n"
+            + "  \"token_type\" : \"Bearer\",\n"
+            + "  \"username\" : \"OAUTH_TEST_AUTH_CODE\",\n"
+            + "  \"scope\" : \"refresh_token session:role:ANALYST\",\n"
+            + "  \"expires_in\" : 600,\n"
+            + "  \"refresh_token_expires_in\" : 86399,\n"
+            + "  \"idpInitiated\" : false\n"
+            + "}";
+
+    assertThat(
+        "Text with OAuth tokens is not masked",
+        maskedTokenResponseJson.equals(SecretDetector.maskSecrets(tokenResponseJson)));
+  }
+
   private JSONObject generateJsonObject() {
     // a base json object
     JSONObject obj = new JSONObject();