Library designed to clean sensitive data out of HAR files.
Built for, and used in Securely for Jira. Securely will automatically scrub sensitive data out of HAR files attached to Jira and help users scrub files before ever uploading them to Jira.
If you want to use this as a standalone web app check out Securely for Web by Abrega. This is deployed from the web
subdirectory in this repository to Cloudflare Pages.
Zero dependencies.
Import the library into your code:
import { sanitizeHar } from "har-cleaner";
Call the function with whatever options you want:
scrubbedHar = sanitizeHar(harObject, {
scrubAllCookies: options.scrubAllCookies,
scrubSpecificCookie: options.scrubSpecificCookie,
scrubAllRequestHeaders: options.scrubAllRequestHeaders,
scrubSpecificHeader: options.scrubSpecificHeader,
scrubAllResponseHeaders: options.scrubAllResponseHeaders,
scrubSpecificResponseHeader: options.scrubSpecificResponseHeader,
scrubAllQueryParams: options.scrubAllQueryParams,
scrubSpecificQueryParam: options.scrubSpecificQueryParam,
scrubAllPostParams: options.scrubAllPostParams,
scrubSpecificPostParam: options.scrubSpecificPostParam,
scrubAllBodyContents: options.scrubAllBodyContents,
scrubSpecificMimeTypes: options.scrubSpecificMimeTypes
});
If you don't specify an option, then the library will use the relevant default value. Default values are defined in this block:
const effectiveOptions = {
scrubAllRequestHeaders: options?.scrubAllRequestHeaders || false,
scrubAllCookies: options?.scrubAllCookies || false,
scrubAllQueryParams: options?.scrubAllQueryParams || false,
scrubAllPostParams: options?.scrubAllPostParams || false,
scrubAllResponseHeaders: options?.scrubAllResponseHeaders || false,
scrubAllBodyContents: options?.scrubAllBodyContents || false,
scrubSpecificMimeTypes: options?.scrubSpecificMimeTypes || defaultMimeTypesList,
scrubSpecificHeader: options?.scrubSpecificHeader || defaultRequestHeadersList,
scrubSpecificCookie: options?.scrubSpecificCookie || defaultCookiesList,
scrubSpecificQueryParam: options?.scrubSpecificQueryParam || defaultQueryPostParamsList,
scrubSpecificPostParam: options?.scrubSpecificPostParam || defaultQueryPostParamsList,
scrubSpecificResponseHeader: options?.scrubSpecificResponseHeader || defaultResponseHeadersList,
};
The various default word lists are defined in the file itself. These lists are based on Cloudflare's har-sanitizer library. However, we hope to evolve them to be option specific for clarity and performance reasons.
Default lists are exported so you can access them in other parts of your code easily via:
import { defaultMimeTypesList, defaultRequestHeadersList } from 'har-cleaner';
This likely needs some better terminology and explanation, but the logic within the code allows for any given object to act in either allow or denylist mode. Let's walk through an example to make this easy to understand:
- You have a HAR file with a request header called Example.
- If you set
scrubAllRequestHeaders
to true, and leave everything else alone, the Example header will be removed. - If you set
scrubAllRequestHeaders
to true, and setscrubSpecificHeader
to['Example']
then everything other than Example will be removed. - If you set
scrubAllRequestHeaders
to false, and leave everything else alone, the Example header will be left in place. - If you set
scrubAllRequestHeaders
to false, and setscrubSpecificHeader
to['Example']
then only the Example header will be removed.
The same thing applies to the other matched options:
- scrubAllRequestHeaders <> scrubSpecificHeader
- scrubAllCookies <> scrubSpecificCookie
- scrubAllQueryParams <> scrubSpecificQueryParam
- scrubAllPostParams <> scrubSpecificPostParam
- scrubAllResponseHeaders <> scrubSpecificResponseHeader
- scrubAllBodyContents <> scrubSpecificMimeTypes
This software is dual licensed under an AGPL license plus a commercial license. If you would like to use this in your software without complying with the AGPL license please contact us.
Since this software is dual licensed under AGPL and a commercial license, any external contributions will be asked to sign a CLA.
This is our first time releasing a library and we're still learning how to do this. Please be kind and provide constructive criticism.