[eas-cli] Escape Apple credentials before scrubbing them from metadata telemetry

[dennytosp]

Why

makeDataScrubberAsync in src/metadata/utils/telemetry.ts redacts the Apple app ID, username, password, token, team ID and provider ID from the request and response data that eas metadata:push / eas metadata:pull send to analytics. It builds those patterns by passing the value straight to new RegExp, but every one of them is chosen by the user, so they routinely contain characters that mean something in a pattern.

That breaks the redaction in both directions:

'my p+ssw0rd here'.replace(new RegExp('p+ssw0rd', 'gi'), '{APPLE_PASSWORD}')
// -> 'my p+ssw0rd here'          the password is sent verbatim

('login ' + 'user+eas@icloud.com').replace(new RegExp('user+eas@icloud.com', 'gi'), '{APPLE_USERNAME}')
// -> 'login user+eas@icloud.com'  plus-addressed Apple IDs are never redacted

new RegExp('S3cret(1', 'gi')
// -> SyntaxError: Invalid regular expression: /S3cret(1/gi: Unterminated group

'my passXword'.replace(new RegExp('pass.word', 'gi'), '{APPLE_PASSWORD}')
// -> 'my {APPLE_PASSWORD}'        unrelated text is redacted instead

So a credential with +, . or * in it is the one thing the scrubber is there to catch and the one thing it lets through, and a credential with an unbalanced ( or [ throws out of subscribeTelemetryAsync before the first request is made.

An empty app.id has the same shape of problem: new RegExp('', 'gi') matches at every position, so {APPLE_APP_ID} would be spliced between every character of the payload.

How

The values are escaped before they become patterns, through a new escapeRegExp in src/utils/expodash, matching how @expo/build-tools already handles this with lodash/escapeRegExp (eas-cli does not depend on lodash, and expodash is where the package keeps its lodash replacements).

The six patterns now go through one literalPattern helper, which also skips empty values so a missing app ID cannot produce a match-everything pattern.

Test Plan

yarn test, yarn typecheck, yarn lint and yarn fmt:check all pass.

Two cases were added to telemetry.test.ts: one asserting that a user+eas@icloud.com / S3cret(1) pair is redacted, and one asserting that a password of a.c no longer redacts the unrelated text abc. Both fail on main. escapeRegExp has its own unit tests, including a round-trip check that the escaped pattern matches the value itself and nothing else.

[github-actions]

Subscribed to pull request

File Patterns	Mentions
packages/eas-cli/**	@douglowder
packages/eas-cli/src/metadata/**	@byCedric

Generated by CodeMention

Warning: The preamble and epilogue options in commentConfiguration are deprecated. Use template instead.