Sanitize only subset of bindings.

Author: kshyju

src/WebJobs.Script.WebHost/Extensions/FunctionMetadataExtensions.cs

@@ -176,7 +176,21 @@ private static async Task<JObject> GetFunctionConfig(FunctionMetadata metadata,
 
         private static async Task<JObject> GetFunctionConfigFromFile(string path)
         {
-            return JObject.Parse(Sanitizer.Sanitize(await FileUtility.ReadAsync(path)));
+            var fileContent = await FileUtility.ReadAsync(path);
+            var jObject = JObject.Parse(fileContent);
+
+            if (jObject.TryGetValue("bindings", StringComparison.OrdinalIgnoreCase, out JToken bindingsToken) && bindingsToken is JArray bindings)
+            {
+                var bindingObjects = bindings.OfType<JObject>().ToList();
+
+                foreach (var binding in bindingObjects)
+                {
+                    var sanitizedBinding = MetadataJsonHelper.CreateJObjectWithSanitizedPropertyValue(binding, ScriptConstants.SensitiveMetadataBindingPropertyNames);
+                    binding.Replace(sanitizedBinding);
+                }
+            }
+
+            return jObject;
         }
 
         private static JObject GetFunctionConfigFromMetadata(FunctionMetadata metadata)

src/WebJobs.Script/Host/HostFunctionMetadataProvider.cs

@@ -9,7 +9,6 @@
 using System.IO.Abstractions;
 using System.Linq;
 using System.Threading.Tasks;
-using Microsoft.Azure.WebJobs.Logging;
 using Microsoft.Azure.WebJobs.Script.Configuration;
 using Microsoft.Azure.WebJobs.Script.Description;
 using Microsoft.Azure.WebJobs.Script.Diagnostics;
@@ -136,9 +135,7 @@ internal static FunctionMetadata ParseFunctionMetadata(string functionName, JObj
             {
                 foreach (JObject binding in bindingArray)
                 {
-                    // Sanitize the binding JSON to remove any sensitive information before creating BindingMetadata
-                    var sanitizedBindingJson = Sanitizer.Sanitize(binding.ToString(Newtonsoft.Json.Formatting.None));
-                    var sanitizedJObject = JObject.Parse(sanitizedBindingJson);
+                    var sanitizedJObject = MetadataJsonHelper.CreateJObjectWithSanitizedPropertyValue(binding, ScriptConstants.SensitiveMetadataBindingPropertyNames);
 
                     BindingMetadata bindingMetadata = BindingMetadata.Create(sanitizedJObject);
                     functionMetadata.Bindings.Add(bindingMetadata);

src/WebJobs.Script/Host/MetadataJsonHelper.cs

@@ -0,0 +1,76 @@
+// Copyright (c) .NET Foundation. All rights reserved.
+// Licensed under the MIT License. See License.txt in the project root for license information.
+
+using System;
+using System.Collections.Generic;
+using System.Linq;
+using Microsoft.Azure.WebJobs.Logging;
+using Newtonsoft.Json.Linq;
+
+namespace Microsoft.Azure.WebJobs.Script
+{
+    internal static class MetadataJsonHelper
+    {
+        /// <summary>
+        /// Sanitizes the values of top-level properties in the specified <see cref="JObject"/>
+        /// whose names match any in the provided collection, using case-insensitive comparison.
+        /// The original property casing is preserved.
+        /// </summary>
+        /// <param name="jsonObject">The <see cref="JObject"/> to sanitize.</param>
+        /// <param name="propertyNames">A collection of top-level property names to sanitize.</param>
+        /// <returns>
+        /// A <see cref="JObject"/> with the specified properties' values sanitized if found.
+        /// </returns>
+        /// <exception cref="ArgumentNullException">
+        /// Thrown if <paramref name="jsonObject"/> or <paramref name="propertyNames"/> is <c>null</c>.
+        /// </exception>
+        public static JObject CreateJObjectWithSanitizedPropertyValue(JObject jsonObject, IEnumerable<string> propertyNames)
+        {
+            ArgumentNullException.ThrowIfNull(jsonObject, nameof(jsonObject));
+            ArgumentNullException.ThrowIfNull(propertyNames, nameof(propertyNames));
+
+            foreach (var prop in jsonObject.Properties())
+            {
+                if (propertyNames.Contains(prop.Name, StringComparer.OrdinalIgnoreCase))
+                {
+                    jsonObject[prop.Name] = Sanitizer.Sanitize(prop.Value.ToString());
+                }
+            }
+
+            return jsonObject;
+        }
+
+        /// <summary>
+        /// Parses the input JSON string into a <see cref="JObject"/> and sanitizes the values of top-level properties
+        /// whose names match any in the provided collection, using case-insensitive comparison.
+        /// The original property casing is preserved.
+        /// </summary>
+        /// <param name="json">The JSON string to parse and sanitize.</param>
+        /// <param name="propertyNames">A collection of top-level property names to sanitize.</param>
+        /// <returns>
+        /// A <see cref="JObject"/> representing the parsed JSON, with the specified properties' values sanitized if found.
+        /// </returns>
+        /// <exception cref="ArgumentException">
+        /// Thrown if <paramref name="json"/> is <c>null</c> or empty.
+        /// </exception>
+        /// <exception cref="ArgumentNullException">
+        /// Thrown if <paramref name="propertyNames"/> is <c>null</c>.
+        /// </exception>
+        /// <exception cref="JsonReaderException">
+        /// Thrown if <paramref name="json"/> is not a valid JSON string.
+        /// </exception>
+        public static JObject CreateJObjectWithSanitizedPropertyValue(string json, IEnumerable<string> propertyNames)
+        {
+            if (string.IsNullOrWhiteSpace(json))
+            {
+                throw new ArgumentException("Input JSON cannot be null or empty.", nameof(json));
+            }
+
+            ArgumentNullException.ThrowIfNull(propertyNames, nameof(propertyNames));
+
+            var jsonObject = JObject.Parse(json);
+
+            return CreateJObjectWithSanitizedPropertyValue(jsonObject, propertyNames);
+        }
+    }
+}

src/WebJobs.Script/Host/WorkerFunctionMetadataProvider.cs

@@ -258,8 +258,8 @@ internal FunctionMetadata ValidateBindings(IEnumerable<string> rawBindings, Func
 
             foreach (string binding in rawBindings)
             {
-                var deserializedObj = JsonConvert.DeserializeObject<JObject>(Sanitizer.Sanitize(binding), _dateTimeSerializerSettings);
-                var functionBinding = BindingMetadata.Create(deserializedObj);
+                var sanitizedBinding = MetadataJsonHelper.CreateJObjectWithSanitizedPropertyValue(binding, ScriptConstants.SensitiveMetadataBindingPropertyNames);
+                var functionBinding = BindingMetadata.Create(sanitizedBinding);
 
                 Utility.ValidateBinding(functionBinding);
 

src/WebJobs.Script/ScriptConstants.cs

@@ -269,5 +269,7 @@ public static class ScriptConstants
         public static readonly string CancellationTokenRegistration = "CancellationTokenRegistration";
 
         internal const string MasterKeyName = "_master";
+
+        public static readonly ImmutableArray<string> SensitiveMetadataBindingPropertyNames = ["connection"];
     }
 }

test/WebJobs.Script.Tests/MetadataJsonHelperTests.cs

@@ -0,0 +1,99 @@
+// Copyright (c) .NET Foundation. All rights reserved.
+// Licensed under the MIT License. See License.txt in the project root for license information.
+
+using System;
+using System.Collections.Generic;
+using Newtonsoft.Json.Linq;
+using Xunit;
+
+namespace Microsoft.Azure.WebJobs.Script.Tests
+{
+    public sealed class MetadataJsonHelperTests
+    {
+        [Fact]
+        public void CreateJObjectWithSanitizedPropertyValue_NullJsonObject_ThrowsArgumentNullException()
+        {
+            JObject jsonObject = null;
+            var propertyNames = new[] { "sensitiveProperty" };
+
+            Assert.Throws<ArgumentNullException>(() => MetadataJsonHelper.CreateJObjectWithSanitizedPropertyValue(jsonObject, propertyNames));
+        }
+
+        [Fact]
+        public void CreateJObjectWithSanitizedPropertyValue_NullPropertyNames_ThrowsArgumentNullException()
+        {
+            var jsonObject = new JObject();
+            IEnumerable<string> propertyNames = null;
+
+            Assert.Throws<ArgumentNullException>(() => MetadataJsonHelper.CreateJObjectWithSanitizedPropertyValue(jsonObject, propertyNames));
+        }
+
+        [Fact]
+        public void CreateJObjectWithSanitizedPropertyValue_ValidInput_SanitizesMatchingProperties()
+        {
+            var jsonObject = new JObject
+            {
+                { "sensitiveProperty1", "AccountKey=foo" },
+                { "sensitiveProperty2", "MyConnection" },
+                { "SENSITIVEPROPERTY3", "AccountKey=bar" },
+                { "otherProperty", "value2" }
+            };
+            var sensitiveBindingPropertyNames = new[] { "sensitiveProperty1", "sensitiveproperty2", "sensitiveproperty3" };
+
+            var result = MetadataJsonHelper.CreateJObjectWithSanitizedPropertyValue(jsonObject, sensitiveBindingPropertyNames);
+
+            Assert.Equal("[Hidden Credential]", result["sensitiveProperty1"].ToString());
+            Assert.Equal("MyConnection", result["sensitiveProperty2"].ToString());
+            Assert.Equal("[Hidden Credential]", result["SENSITIVEPROPERTY3"].ToString());
+            Assert.Equal("value2", result["otherProperty"].ToString());
+        }
+
+        [Fact]
+        public void CreateJObjectWithSanitizedPropertyValue_NoMatchingProperties_DoesNotSanitize()
+        {
+            var jsonObject = new JObject
+            {
+                { "otherProperty1", "value1" },
+                { "otherProperty2", "value2" },
+                { "otherProperty3", "AccountKey=foo" }
+            };
+            var sensitiveBindingPropertyNames = new[] { "sensitiveProperty" };
+
+            var result = MetadataJsonHelper.CreateJObjectWithSanitizedPropertyValue(jsonObject, sensitiveBindingPropertyNames);
+
+            Assert.Equal("value1", result["otherProperty1"].ToString());
+            Assert.Equal("value2", result["otherProperty2"].ToString());
+            Assert.Equal("AccountKey=foo", result["otherProperty3"].ToString());
+        }
+
+        [Fact]
+        public void CreateJObjectWithSanitizedPropertyValue_StringInput_NullOrEmptyJson_ThrowsArgumentException()
+        {
+            string json = null;
+            var propertyNames = new[] { "sensitiveProperty" };
+
+            Assert.Throws<ArgumentException>(() => MetadataJsonHelper.CreateJObjectWithSanitizedPropertyValue(json, propertyNames));
+        }
+
+        [Fact]
+        public void CreateJObjectWithSanitizedPropertyValue_StringInput_InvalidJson_ThrowsJsonReaderException()
+        {
+            var json = "invalid json";
+            var propertyNames = new[] { "sensitiveProperty" };
+
+            Assert.Throws<Newtonsoft.Json.JsonReaderException>(() => MetadataJsonHelper.CreateJObjectWithSanitizedPropertyValue(json, propertyNames));
+        }
+
+        [Fact]
+        public void CreateJObjectWithSanitizedPropertyValue_StringInput_ValidJson_SanitizesMatchingProperties()
+        {
+            var json = "{ \"SensitiveProperty\": \"pwd=12345\", \"otherProperty\": \"value2\" }";
+            var propertyNames = new[] { "sensitiveproperty" };
+
+            var result = MetadataJsonHelper.CreateJObjectWithSanitizedPropertyValue(json, propertyNames);
+
+            Assert.Equal("[Hidden Credential]", result["SensitiveProperty"].ToString());
+            Assert.Equal("value2", result["otherProperty"].ToString());
+        }
+    }
+}

test/WebJobs.Script.Tests/SanitizerTests.cs

@@ -41,9 +41,6 @@ public class SanitizerTests
         [InlineData("test,aaa://aaa:[email protected]:1111,test", "test,[Hidden Credential],test")]
         [InlineData(@"some text abc://abc:[email protected]:1111 some text abc://abc:[email protected]:1111 text", @"some text [Hidden Credential] some text [Hidden Credential] text")]
         [InlineData(@"some text abc://abc:[email protected]:1111 some text AccountKey=heyyyyyyy text", @"some text [Hidden Credential] some text [Hidden Credential]")]
-        [InlineData("""{"queueName":"my-q-items","connection":"MyConnection","type":"queueTrigger","name":"qTrigger1","direction":"in"}""", "{\"queueName\":\"my-q-items\",\"connection\":\"MyConnection\",\"type\":\"queueTrigger\",\"name\":\"qTrigger1\",\"direction\":\"in\"}")]
-        [InlineData("""{"queueName":"my-q-items","connection":"DefaultEndpointsProtocol=https;AccountName=a;AccountKey=b/c==;EndpointSuffix=core.windows.net","type":"queueTrigger","name":"queueTrigger1","direction":"in"}""", "{\"queueName\":\"my-q-items\",\"connection\":\"[Hidden Credential]\",\"type\":\"queueTrigger\",\"name\":\"queueTrigger1\",\"direction\":\"in\"}")]
-        [InlineData("""{"name":"message","type":"queueTrigger","direction":"In","properties":{"supportsDeferredBinding":"True"},"queueName":"myqueue-items2","connection":"key:setting"}""", """{"name":"message","type":"queueTrigger","direction":"In","properties":{"supportsDeferredBinding":"True"},"queueName":"myqueue-items2","connection":"key:setting"}""")]
         public void SanitizeString(string input, string expectedOutput)
         {
             var sanitized = Sanitizer.Sanitize(input);