Download the PHP package yorcreative/laravel-scrubber without Composer

Laravel Scrubber

A Laravel package to scrub sensitive information that breaks operational security policies from being leaked on accident or not by developers.

Installation

install the package via composer:

Publish the packages assets.

Configuration

Adjust the configuration file to suite your application, located in /config/scrubber.php.

Usage

The scrubber can be utilized in two ways, the first one being a Log scrubber. A tap is added to detect and sanitize any sensitive information from hitting a log file. The second way is to integrate into your application and utilize the Scrubber directly. This way is particular useful if you, for example, would like to detect and sanitize any messages on a messaging platform.

Logging Detection & Sanitization

Direct Usage for Detection & Sanitization

Log Channel Opt-in

This package provides you the ability to define through the configuration file what channels you want to scrub specifically. By default, this package ships with a wildcard value and opts in to scrub all the log channels in your application.

Defining Log Channel Opt-in

To opt in to one or more channels, list the channel(s) name into the tap_channels array in the config.

To disable tap logging functionality and use the package independently and not tap your Laravel application logging, modify the config file by setting the tap_channels field as follows:

Regex Class Opt-in

You have the ability through the configuration file to define what regex classes you want loaded into the application when it is bootstrapped. By default, this package ships with a wildcard value.

Regex Collection & Defining Opt-in

To opt in, utilize the static properties on the RegexCollection class.

Opting Into Custom Extended Classes

To create custom scrubbers, see the Extending the Scrubber section.

The regex_loader array takes strings, not objects. To opt in to specific custom extended regex classes, define the class name as a string.

For example if I have a custom extended class as such:

The regex_loader array should be defined as such:

About the Scrubber

This package provides the ability to pull in secrets from external sources. Providing the ability to detect information leakage, and sanitize secrets without needing an exact regex pattern to detect it.

Encryption

For enhanced application security, all secrets pulled, from any provider, are encrypted and only decrypted to run the detection. You can see this in action here.

Gitlab Integration

To utilize the Gitlab Integration, you will need to enable the secret_manager and the gitlab provider in the Configuration file. If you are looking for information on how to add secrets in Gitlab. There is an article on adding project variables.

Extending the Scrubber

Creating new Scrubber Detection Classes

This command will create a stubbed out class in App\Scrubber\RegexCollection. The Scrubber package will autoload everything from the App\Scrubber\RegexCollection folder with the wildcard value on the regex_loader array in the scrubber config file. You will need to provide a Regex Pattern and a Testable String for the class and you may also provide a Replacement Value if you want to replace the detected value with something other than the default value in the config file.

Testing

Credits

• Yorda
• Whizboy-Arnold
• majchrosoft
• Lucaxue
• AlexGodbehere
• All Contributors