fix: mask serialized multiline secrets

Author: shirkevich

pkg/io/masker.go

@@ -183,6 +183,8 @@ func (m *masker) Mask(input string) string {
 	// Replace literals in order (longest first).
 	for _, literal := range literals {
 		masked = strings.ReplaceAll(masked, literal, m.replacement)
+		masked = maskIndentedMultilineLiteral(masked, literal, m.replacement)
+		masked = maskFoldedLiteral(masked, literal, m.replacement)
 	}
 
 	// Mask regex patterns.
@@ -195,6 +197,55 @@ func (m *masker) Mask(input string) string {
 	return masked
 }
 
+// maskFoldedLiteral masks long scalar values after a YAML emitter folds an ordinary space into
+// a newline plus indentation. All non-whitespace bytes must still match exactly.
+func maskFoldedLiteral(input, literal, replacement string) string {
+	if len(literal) < 32 || !strings.ContainsAny(literal, " \t") {
+		return input
+	}
+
+	parts := strings.FieldsFunc(literal, func(r rune) bool { return r == ' ' || r == '\t' })
+	if len(parts) < 2 {
+		return input
+	}
+
+	var pattern strings.Builder
+	for i, part := range parts {
+		if i > 0 {
+			pattern.WriteString(`(?:[ \t]+|\r?\n[ \t]+)`)
+		}
+		pattern.WriteString(regexp.QuoteMeta(part))
+	}
+
+	re := regexp.MustCompile(pattern.String())
+	quotedReplacement := strings.ReplaceAll(replacement, "$", "$$")
+	return re.ReplaceAllString(input, quotedReplacement)
+}
+
+// maskIndentedMultilineLiteral masks a registered multiline value after serializers such as
+// YAML have indented its continuation lines. The payload lines must still match exactly; only
+// indentation introduced after a newline is ignored.
+func maskIndentedMultilineLiteral(input, literal, replacement string) string {
+	normalized := strings.ReplaceAll(literal, "\r\n", "\n")
+	normalized = strings.TrimRight(normalized, "\n")
+	if !strings.Contains(normalized, "\n") {
+		return input
+	}
+
+	lines := strings.Split(normalized, "\n")
+	var pattern strings.Builder
+	for i, line := range lines {
+		if i > 0 {
+			pattern.WriteString(`\r?\n[ \t]*`)
+		}
+		pattern.WriteString(regexp.QuoteMeta(line))
+	}
+
+	re := regexp.MustCompile(pattern.String())
+	quotedReplacement := strings.ReplaceAll(replacement, "$", "$$")
+	return re.ReplaceAllString(input, quotedReplacement)
+}
+
 // ContainsSecret reports whether value contains any registered secret literal as a
 // substring. This deliberately ignores the enabled flag (unlike Mask): callers use it
 // to prevent secrets from being written to disk (e.g. Terraform varfiles) even when

pkg/io/masker_test.go

@@ -8,6 +8,8 @@ import (
 	"strings"
 	"testing"
 
+	"github.com/stretchr/testify/assert"
+
 	"github.com/cloudposse/atmos/pkg/schema"
 )
 
@@ -266,6 +268,38 @@ func TestMasker_Mask(t *testing.T) {
 	}
 }
 
+func TestMasker_MasksIndentedMultilineLiteral(t *testing.T) {
+	const secret = "-----BEGIN PRIVATE KEY-----\nAAAA\nBBBB\n-----END PRIVATE KEY-----"
+
+	for _, spaces := range []int{2, 4, 6} {
+		t.Run(fmt.Sprintf("%d spaces", spaces), func(t *testing.T) {
+			m := newMasker(nil)
+			m.RegisterValue(secret)
+			indent := strings.Repeat(" ", spaces)
+			input := "value: |-\n" + indent + strings.ReplaceAll(secret, "\n", "\n"+indent) + "\n"
+
+			masked := m.Mask(input)
+			assert.NotContains(t, masked, "BEGIN PRIVATE KEY")
+			assert.NotContains(t, masked, "AAAA")
+			assert.NotContains(t, masked, "BBBB")
+			assert.Contains(t, masked, MaskReplacement)
+		})
+	}
+}
+
+func TestMasker_MasksFoldedLongLiteral(t *testing.T) {
+	const secret = "alpha bravo charlie delta echo foxtrot golf hotel"
+
+	m := newMasker(nil)
+	m.RegisterValue(secret)
+	input := "value: >-\n  alpha bravo charlie delta\n  echo foxtrot golf hotel\n"
+
+	masked := m.Mask(input)
+	assert.NotContains(t, masked, "alpha bravo")
+	assert.NotContains(t, masked, "echo foxtrot")
+	assert.Contains(t, masked, MaskReplacement)
+}
+
 func TestMasker_Clear(t *testing.T) {
 	cfg := &Config{DisableMasking: false}
 	m := newMasker(cfg)