split/join rather than a regular expression: building a RegExp from a
secret means escaping it correctly, and an escaping bug on this path is a
secret that reaches the log. There is nothing to escape in a split.
Parameters
text: string
untrusted text about to be recorded.
secret: string|null
the value resolved for this request, or null when there was none.
Remove every occurrence of
secretfromtext.split/joinrather than a regular expression: building aRegExpfrom a secret means escaping it correctly, and an escaping bug on this path is a secret that reaches the log. There is nothing to escape in a split.