From 4d7d147b73372af59869c12b5ac710b7d9e47651 Mon Sep 17 00:00:00 2001
From: vergiLgood1 <diyoanggara149@gmail.com>
Date: Fri, 9 Oct 2026 18:11:42 +0800
Subject: [PATCH] fix: do not log raw json value in json validator error

The raw value could contain sensitive data (API keys, tokens, service
credentials) and would end up in logs via the error output. Follows
1f67e8d, which made the same change for the url validator.
---
 src/validators.ts        |  5 +++--
 tests/validators.test.ts | 10 ++++++++++
 2 files changed, 13 insertions(+), 2 deletions(-)

diff --git a/src/validators.ts b/src/validators.ts
index 03981eb..ca0b767 100644
--- a/src/validators.ts
+++ b/src/validators.ts
@@ -112,7 +112,8 @@ export const url = makeValidator<string>((x: string) => {
 export const json = makeStructuredValidator((x: string) => {
   try {
     return JSON.parse(x)
-  } catch (e) {
-    throw new EnvError(`Invalid json: "${x}"`)
+  } catch {
+    // Not logging the json value as it could contain sensitive data
+    throw new EnvError(`Invalid json`)
   }
 })
diff --git a/tests/validators.test.ts b/tests/validators.test.ts
index 1ea1d14..6a15e4b 100644
--- a/tests/validators.test.ts
+++ b/tests/validators.test.ts
@@ -123,6 +123,16 @@ test('json()', () => {
 
   expect(() => cleanEnv({ FOO: 'abc' }, { FOO: json() }, makeSilent)).toThrow()
 
+  // The error message should not include the raw value, as it could contain sensitive data
+  let thrownError: unknown
+  try {
+    cleanEnv({ FOO: '{"password": "hunter2"' }, { FOO: json() }, makeSilent)
+  } catch (e) {
+    thrownError = e
+  }
+  expect((thrownError as Error).message).toBe('Invalid json')
+  expect((thrownError as Error).message).not.toContain('hunter2')
+
   // default value should be passed through without running through JSON.parse()
   expect(
     cleanEnv(