fix(security): scrub secrets in lists and stop over-redacting benign keys

scrubSensitiveValues now recurses through List values (not just Maps), so
secrets nested inside a list of connection maps are redacted too. isSensitiveKey
now matches whole tokens (split on separators and camelCase) plus a compound
allowlist, instead of substring containment — so benign keys like keyspace,
sortkey and author are no longer redacted while api_key/apiKey/client_secret/
account_info_json still are. Adds unit tests for both behaviors.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Author: jymaire

src/main/java/io/kestra/plugin/soda/Scan.java

@@ -2,7 +2,9 @@
 
 import java.io.IOException;
 import java.nio.file.Path;
+import java.util.ArrayList;
 import java.util.LinkedHashMap;
+import java.util.List;
 import java.util.Map;
 import java.util.Optional;
 import java.util.Set;
@@ -107,19 +109,30 @@
 public class Scan extends AbstractSoda implements RunnableTask<Scan.Output> {
     private static final String REDACTED = "******";
 
-    private static final Set<String> SENSITIVE_KEY_PATTERNS = Set.of(
+    /**
+     * Whole-token markers: a key is sensitive when one of its tokens (split on separators and
+     * camelCase boundaries) exactly equals one of these. Matching on tokens rather than substrings
+     * avoids over-redacting benign keys such as {@code keyspace}, {@code sortkey} or {@code author}.
+     * Note {@code key} as a token already covers {@code api_key}, {@code access_key},
+     * {@code private_key}, {@code apiKey}, etc.
+     */
+    private static final Set<String> SENSITIVE_KEY_TOKENS = Set.of(
         "password", "passwd", "pwd",
-        "secret",
-        "token",
-        "key",
+        "secret", "secrets",
+        "token", "tokens",
+        "key", "keys",
         "credential", "credentials",
-        "account_info_json",
-        "private_key",
-        "api_key", "apikey",
-        "access_key",
         "auth"
     );
 
+    /**
+     * Compound key names matched against the fully normalized (alphanumeric-only, lowercased) key,
+     * for sensitive keys whose individual tokens are not themselves secret markers.
+     */
+    private static final Set<String> SENSITIVE_NORMALIZED_KEYS = Set.of(
+        "accountinfojson"
+    );
+
     @Schema(
         title = "SodaCL checks definition",
         description = "Required map rendered to `checks.yml` and executed against the `kestra` data source. Follow SodaCL syntax; failing checks mark the task accordingly."
@@ -216,31 +229,77 @@ private static Map<String, Object> scrubSensitiveValues(Map<String, Object> map)
 
             if (isSensitiveKey(key)) {
                 scrubbed.put(key, REDACTED);
-            } else if (value instanceof Map) {
-                scrubbed.put(key, scrubSensitiveValues((Map<String, Object>) value));
             } else {
-                scrubbed.put(key, value);
+                scrubbed.put(key, scrubValue(value));
             }
         }
 
         return scrubbed;
     }
 
+    /**
+     * Recurses through container values so sensitive keys nested inside maps <em>or lists</em>
+     * (e.g. a list of connection maps) are scrubbed too; scalar values are returned unchanged.
+     */
+    @SuppressWarnings("unchecked")
+    private static Object scrubValue(Object value) {
+        if (value instanceof Map) {
+            return scrubSensitiveValues((Map<String, Object>) value);
+        }
+
+        if (value instanceof List) {
+            List<Object> scrubbedList = new ArrayList<>();
+            for (Object element : (List<Object>) value) {
+                scrubbedList.add(scrubValue(element));
+            }
+            return scrubbedList;
+        }
+
+        return value;
+    }
+
     private static boolean isSensitiveKey(String key) {
         if (key == null) {
             return false;
         }
 
         String normalized = key.toLowerCase().replaceAll("[^a-z0-9]", "");
-        for (String pattern : SENSITIVE_KEY_PATTERNS) {
-            if (normalized.contains(pattern.replaceAll("[^a-z0-9]", ""))) {
+        if (SENSITIVE_NORMALIZED_KEYS.contains(normalized)) {
+            return true;
+        }
+
+        for (String token : tokenize(key)) {
+            if (SENSITIVE_KEY_TOKENS.contains(token)) {
                 return true;
             }
         }
 
         return false;
     }
 
+    /**
+     * Splits a key into lowercase tokens on non-alphanumeric separators and camelCase boundaries,
+     * so {@code account_info_json}, {@code apiKey} and {@code APIKey} all yield word-level tokens.
+     */
+    private static List<String> tokenize(String key) {
+        String spaced = key
+            .replaceAll("([A-Z]+)([A-Z][a-z])", "$1 $2")
+            .replaceAll("([a-z0-9])([A-Z])", "$1 $2")
+            .replaceAll("[^a-zA-Z0-9]+", " ")
+            .trim();
+
+        List<String> tokens = new ArrayList<>();
+        if (spaced.isEmpty()) {
+            return tokens;
+        }
+
+        for (String token : spaced.split("\\s+")) {
+            tokens.add(token.toLowerCase());
+        }
+
+        return tokens;
+    }
+
     protected ScanResult parseResult(RunContext runContext, ScriptOutput output) throws IOException {
         ScanResult scanResult = JacksonMapper.ofJson(false).readValue(
             runContext.storage().getFile(output.getOutputFiles().get("result.json")),

src/test/java/io/kestra/plugin/soda/SecurityHardeningTest.java

@@ -1,7 +1,9 @@
 package io.kestra.plugin.soda;
 
 import java.lang.reflect.Method;
+import java.util.ArrayList;
 import java.util.LinkedHashMap;
+import java.util.List;
 import java.util.Map;
 
 import org.junit.jupiter.api.Test;
@@ -104,15 +106,60 @@ void scrub_recursesIntoNestedMaps() throws Exception {
     void scrub_redactsSecretKeyVariants() throws Exception {
         Map<String, Object> input = new LinkedHashMap<>();
         input.put("api_key", "abc");
+        input.put("apiKey", "abc");
         input.put("token", "xyz");
         input.put("account_info_json", "{...}");
+        input.put("client_secret", "shh");
         input.put("type", "postgres");
 
         Map<String, Object> result = scrub(input);
 
         assertThat(result.get("api_key"), is("******"));
+        assertThat(result.get("apiKey"), is("******"));
         assertThat(result.get("token"), is("******"));
         assertThat(result.get("account_info_json"), is("******"));
+        assertThat(result.get("client_secret"), is("******"));
         assertThat(result.get("type"), is("postgres"));
     }
+
+    @Test
+    void scrub_recursesIntoLists() throws Exception {
+        // A non-sensitive key whose value is a list of maps: secrets nested in list elements
+        // must still be redacted (the recursion used to stop at Map values only).
+        Map<String, Object> node1 = new LinkedHashMap<>();
+        node1.put("host", "db1");
+        node1.put("password", "s1");
+        Map<String, Object> node2 = new LinkedHashMap<>();
+        node2.put("host", "db2");
+        node2.put("token", "t2");
+
+        Map<String, Object> input = new LinkedHashMap<>();
+        input.put("nodes", new ArrayList<>(List.of(node1, node2)));
+
+        Map<String, Object> result = scrub(input);
+
+        @SuppressWarnings("unchecked")
+        List<Map<String, Object>> nodes = (List<Map<String, Object>>) result.get("nodes");
+        assertThat(nodes, hasSize(2));
+        assertThat(nodes.get(0).get("password"), is("******"));
+        assertThat(nodes.get(0).get("host"), is("db1"));
+        assertThat(nodes.get(1).get("token"), is("******"));
+        assertThat(nodes.get(1).get("host"), is("db2"));
+    }
+
+    @Test
+    void scrub_doesNotOverRedactBenignKeys() throws Exception {
+        // These all contain a sensitive pattern as a substring but no sensitive whole token,
+        // so their values must be preserved.
+        Map<String, Object> input = new LinkedHashMap<>();
+        input.put("keyspace", "analytics");   // contains "key"
+        input.put("sortkey", "created_at");    // contains "key"
+        input.put("author", "alice");          // contains "auth"
+
+        Map<String, Object> result = scrub(input);
+
+        assertThat(result.get("keyspace"), is("analytics"));
+        assertThat(result.get("sortkey"), is("created_at"));
+        assertThat(result.get("author"), is("alice"));
+    }
 }