tenth version

internal/logging/logging.go

@@ -54,10 +54,16 @@ func (l SDKLogger) Fatalf(template string, args ...any) {
 
 var sensitiveStringPatterns = []*regexp.Regexp{
 	regexp.MustCompile(`(?i)((?:account[_-]?id|token)\s*[:=]\s*)("[^"]+"|'[^']+'|[^\s,}]+)`),
-	regexp.MustCompile(`(?i)("(?:accountId|account_id|token)"\s*:\s*)("[^"]*"|null)`),
+	regexp.MustCompile(`(?i)("(?:accountID|accountId|account_id|token)"\s*:\s*)("[^"]*"|null)`),
 }
 
+var sensitiveAttrKeyPattern = regexp.MustCompile(`(?i)^(account[_-]?id|accountID|accountId|token)$`)
+
 func redactAttr(_ []string, attr slog.Attr) slog.Attr {
+	if sensitiveAttrKeyPattern.MatchString(attr.Key) {
+		attr.Value = slog.StringValue("[REDACTED]")
+		return attr
+	}
 	if attr.Value.Kind() == slog.KindString {
 		attr.Value = slog.StringValue(RedactString(attr.Value.String()))
 	}

internal/logging/logging_test.go

@@ -0,0 +1,36 @@
+package logging
+
+import (
+	"bytes"
+	"strings"
+	"testing"
+)
+
+func TestRedactStringCoversAccountIDSpellings(t *testing.T) {
+	secret := "plain-account-id"
+	raw := strings.Join([]string{
+		`accountID=plain-account-id`,
+		`account_id: plain-account-id`,
+		`{"accountId":"plain-account-id"}`,
+		`{"accountID":"plain-account-id"}`,
+	}, "\n")
+	got := RedactString(raw)
+	if strings.Contains(got, secret) {
+		t.Fatalf("redacted string leaked account id: %s", got)
+	}
+}
+
+func TestSlogRedactsSensitiveAccountIDAttributes(t *testing.T) {
+	var buf bytes.Buffer
+	logger := New("info", &buf)
+	logger.Info("submit", "account_id", "plain-account-id", "accountID", "other-account-id", "accountId", "third-account-id")
+	got := buf.String()
+	for _, secret := range []string{"plain-account-id", "other-account-id", "third-account-id"} {
+		if strings.Contains(got, secret) {
+			t.Fatalf("log leaked account id %q: %s", secret, got)
+		}
+	}
+	if strings.Count(got, "[REDACTED]") < 3 {
+		t.Fatalf("log did not redact account ids: %s", got)
+	}
+}