Easily censor certain values?

[JAForbes]

Is there a built-in way to mark some specific strings as censored, so if they appear in the logs they are replaced with ******.

Thinking something like this:

import { $ } from 'zx'

$.log.censor(new URL(process.env.DATABASE_URL).password)

await $`psql ${process.env.DATABASE_URL} -c 'select 1+1'`

This would output to stdout:

$`psql postgres://example:*************@production.com:5432/example`

You could also use this same feature to just censor any process.env value:

Object.values(process.env).map($.log.censor)

And then have confidence no secrets are being logged.

[agammann]

In zx 8.8.4, the default logger exposes log.output, so you can filter what it writes. There isn't a $.log.censor() method in that version. Here is a small example using a dummy value:

import { $, log } from 'zx';

const valuesToHide = ['example-password'];
const redact = text => valuesToHide.filter(Boolean).reduce(
  (result, value) => result.split(value).join('******'), text,
);

log.output = {
  write(chunk) {
    process.stderr.write(redact(String(chunk)));
  },
};

$.verbose = true;
await $`printf '%s\n' ${valuesToHide[0]}`;

I tested the actual command and its output with zx 8.8.4: the default logger's command display and stdout display contained ******, with no occurrence of the dummy password in the captured log.

This masks exact strings in individual logger writes. It is not a guarantee against every form of disclosure: output split across writes, shell escaping/encoding, directly inherited stdio, your own console.log, and printed ProcessOutput errors are outside this simple filter. The original process output and command arguments are unchanged. Avoid logging secret-bearing errors/output separately, and do not treat masking all environment values as a complete secret-handling strategy. zx logger.