make the sanitization keys in mask_password dynamic

[Amrith Kumar]

Currently the only way to sanitize a string with a new key is to update strutils and have a dependency on the version of strutils. It would be good to make this dynamic.

[Doug Hellmann (doug-hellmann)]

Would it? I'm afraid we would have different apps passing different dynamic values in, which would give them different levels of security. If we identify a string that needs to be masked out, don't we want it masked everywhere, including if it passes over RPC to another service?

[Amrith Kumar (amrith)]

Doug, I'm only implementing a mechanism to add new patterns that can be masked, no provision is made to remove existing patterns.

[Matthew Van Dijk (mvandijk)]

Keep the hardcoded list for common password keys. Just be able to dynamically add new keys that are scoped locally. The use case here was for uncommon cases. In these cases I think it is reasonable to expect the caller to know what uncommon keys they need to handle.