Sanitize Pimlico Errors (#60)

src/lib/bundler.ts

@@ -129,20 +129,19 @@ async function handleRequest<T>(clientMethod: () => Promise<T>): Promise<T> {
   try {
     return await clientMethod();
   } catch (error) {
+    const message = stripApiKey(error);
     if (error instanceof HttpRequestError) {
       if (error.status === 401) {
-        throw new Error("Unauthorized request. Please check your API key.");
-      } else {
-        console.error(
-          `Request failed with status ${error.status}: ${error.message}`
+        throw new Error(
+          "Unauthorized request. Please check your Pimlico API key."
         );
+      } else {
+        throw new Error(`Pimlico: ${message}`);
       }
     } else if (error instanceof RpcError) {
-      throw new Error(`Failed to send user op with: ${error.message}`);
+      throw new Error(`Failed to send user op with: ${message}`);
     }
-    throw new Error(
-      `Unexpected error ${error instanceof Error ? error.message : String(error)}`
-    );
+    throw new Error(`Bundler Request: ${message}`);
   }
 }
 
@@ -154,3 +153,13 @@ const defaultPaymasterData = (safeNotDeployed: boolean): PaymasterData => {
     preVerificationGas: toHex(100000),
   };
 };
+
+export function stripApiKey(error: unknown): string {
+  const message = error instanceof Error ? error.message : String(error);
+  return message.replace(/(apikey=)[^\s&]+/, "$1***");
+  // Could also do this with slicing.
+  // const keyStart = message.indexOf("apikey=") + 7;
+  // // If no apikey in the message, return it as is.
+  // if (keyStart === -1) return message;
+  // return `${message.slice(0, keyStart)}***${message.slice(keyStart + 36)}`;
+}

tests/lib/bundler.spec.ts

@@ -1,15 +1,27 @@
-import { Erc4337Bundler } from "../../src/lib/bundler";
+import { Erc4337Bundler, stripApiKey } from "../../src/lib/bundler";
+
 describe("Safe Pack", () => {
   const entryPoint = "0x0000000071727De22E5E9d8BAf0edAc6f37da032";
-
   it("Unauthorized Requests Failure", async () => {
     const unauthorizedBundler = new Erc4337Bundler(
       entryPoint,
-      "invalidAPI key",
+      "invalid API key",
       11155111
     );
     await expect(() => unauthorizedBundler.getGasPrice()).rejects.toThrow(
-      "Unauthorized request. Please check your API key."
+      "Unauthorized request. Please check your Pimlico API key."
+    );
+  });
+
+  it.only("Strips API Key from error message", () => {
+    const apiKey = "any-thirty-six-character-long-string";
+    const message = (x: string): string => `Unexpected Error
+    URL: https://api.pimlico.io/v2/11155111/rpc?apikey=${x}
+    Additional Error Context`;
+    expect(stripApiKey(new Error(message(apiKey)))).toEqual(message("***"));
+
+    expect(stripApiKey(new Error(message("TopSecret")))).toEqual(
+      message("***")
     );
   });
 });