+/**
+ * Scrub sensitive data from context.
+ * @param {object} data data
+ * @param {boolean} sanitize do sanitize
+ * @returns {boolean} did/would sanitize
+ */
+function sanitizeContext(data, sanitize = true) {
+ let unclean = false;
+
+ // hide keys
+ [
+ 'otpKey',
+ 'otpConfirmKey',
+ ].forEach((k) => {
+ const secretLength = data?.ctx?.[k]?.length; // eslint-disable-line security/detect-object-injection
+ const kUnclean = !! secretLength;
+ unclean |= kUnclean;
+ if (kUnclean && sanitize) {
+ data.ctx[k] = '*'.repeat(secretLength); // eslint-disable-line security/detect-object-injection
+ }
+ });
+
+ // shorten mystery boxes
+ [
+ 'otpConfirmBox',
+ 'otpState',
+ ].forEach((k) => {
+ const mysteryLength = data?.ctx?.[k]?.length; // eslint-disable-line security/detect-object-injection
+ const mUnclean = !! mysteryLength;
+ unclean |= mUnclean;
+ if (mUnclean && sanitize) {
+ data.ctx[k] = `[scrubbed ${mysteryLength} bytes]`; // eslint-disable-line security/detect-object-injection
+ }
+ });
+
+ const cookieLength = data?.ctx?.cookie?.squeepSession?.length;
+ if (cookieLength) {
+ unclean |= true;
+ if (sanitize) {
+ data.ctx.cookie.squeepSession = `[scrubbed ${cookieLength} bytes]`;
+ }
+ }
+
+ return !! unclean;
+}
+
+