Function Library — Masking

C.Mask covers redaction and hashing for JavaScript scripts — the operations that remove sensitive values from an event before it reaches a target, or replace them with a stable identifier.

For rule-driven redaction across many fields, prefer the Mask and Redact processors. These functions are for the cases those do not cover.

Function	Signature	Returns
`REDACTED`	—	The string `REDACTED`
`isCC`	`(value)`	`true` where the value passes the Luhn check
`isIMEI`	`(value)`	`true` where the value passes the Luhn check
`CC`	`(value, unmasked, maskChar)`	The value with its digits masked
`IMEI`	`(value, unmasked, maskChar)`	The value with its digits masked
`luhn`	`(value, unmasked, maskChar)`	The value with its digits masked
`luhnChecksum`	`(value, mod)`	The Luhn checksum
`crc32`	`(value)`	An eight-character hexadecimal checksum
`md5`	`(value, len, encoding)`	A hexadecimal digest
`sha1`	`(value, len, encoding)`	A hexadecimal digest
`sha256`	`(value, len, encoding)`	A hexadecimal digest
`sha512`	`(value, len, encoding)`	A hexadecimal digest
`sha3_256`	`(value, len, encoding)`	A hexadecimal digest
`sha3_512`	`(value, len, encoding)`	A hexadecimal digest
`random`	`(len)`	An alphanumeric random string
`repeat`	`(len, char)`	A repeated string

C.Crypto.createHmac belongs with these and is documented below.

Details

Masking Digits

The three masking functions share one mechanism. They mask the digits in a value while leaving every other character — spaces, hyphens, the formatting of a card number — in place and uncounted.

The second argument controls how many digits survive:

`unmasked`	Effect
Negative (default `-4`)	Keep that many digits at the end
Positive	Keep that many digits at the start
`0`	Mask every digit

The third argument sets the masking character, defaulting to X.

CC(), IMEI() and luhn() are one function under three names — the three bodies are identical, down to the same defaults. All three mask only where the value passes the Luhn check and return it completely unchanged otherwise, with no error and no partial masking.

None of them masks unconditionally. Reaching for luhn() expecting that gives you a silently unmasked value on every field that is not Luhn-valid. Where masking has to happen regardless, check the value yourself and fall back to repeat() or REDACTED.

Redact a card number, keeping the last four digits...	`{ "card": "4992-7398-716" }` `- script: lang: js source: \| __e.card = C.Mask.CC(__e.card);`
Formatting characters are preserved, and the four kept digits are counted in DIGIT space — so the `8` ending the middle group survives, not the whole `716` group...	`{ "card": "XXXX-XXX8-716" }`

warning

isIMEI() and IMEI() apply the same Luhn check as isCC() and CC(). They do not validate the IMEI type-allocation code or length, so a value that is not an IMEI but happens to satisfy Luhn will pass. Treat them as aliases with a clearer name at the call site, not as IMEI validation.

luhnChecksum() returns the checksum itself rather than a pass/fail. Passing 0 as the modulus returns the unreduced sum.

Digests

The six digest functions take the same three arguments and return lowercase hexadecimal.

The second argument truncates the result: a positive number keeps that many characters from the left, a negative number from the right, and 0 or no value returns the full digest. Passing a string truncates to that string's length, which is how a digest is made the same width as the value it replaces.

The third argument describes the encoding of the input, not the output — utf-8 by default, or base64, hex or binary where the field holds encoded bytes. A value that will not decode as the stated encoding is hashed as literal text rather than failing.

Replace a username with a stable pseudonym...

- script:
    lang: js
    source: |
        if (__e.user) {
          __e.user_id = C.Mask.sha256(__e.user, 16);
          __e.user = C.Mask.REDACTED;
        }

note

A digest of a low-cardinality value can be reversed by trying every candidate. Where the value set is small — usernames, internal hostnames, account numbers — combine it with a secret using C.Crypto.createHmac() instead of hashing it directly.

Signing

C.Crypto.createHmac(value, secret, algorithm, outputFormat) produces a keyed hash. The algorithm defaults to sha256 and accepts the usual digest names — md5, sha1, sha224, sha256, sha384, sha512, sha3-256, sha3-512, ripemd160 and blake2b512 among them. The output format defaults to hex and also accepts base64 and latin1.

An unrecognized algorithm or output format returns the input value unchanged rather than throwing — check the result before relying on it.

Keep the secret in the Vault and reference it through params rather than writing it into the pipeline.

Filling and Padding

random() returns an alphanumeric string. Only a positive number sets its length. Passing a string uses that string's length; passing nothing, or 0, returns twelve characters; passing a negative number returns its absolute value, so random(-8) gives eight.

repeat() repeats its second argument — a whole string, not a single character — the requested number of times, defaulting to X.

Both refuse to build a result beyond an internal size limit, returning an empty string instead.

Details​

Masking Digits​

Digests​

Signing​

Filling and Padding​

Details

Masking Digits

Digests

Signing

Filling and Padding