Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

chore: resolve security findings #1282

Merged
merged 3 commits into from
Feb 5, 2025
Merged

chore: resolve security findings #1282

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
5b5ebe6
chore: resolve security findings
fabianburth Feb 5, 2025
905c5f1
chore: remove header information log
fabianburth Feb 5, 2025
92dbf9e
chore: adjust redacted header test
fabianburth Feb 5, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
10 changes: 5 additions & 5 deletions api/credentials/internal/consumers.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -117,7 +117,7 @@ func (c *_consumer) GetCredentials() CredentialsSource {
return c.credentials
}

////////////////////////////////////////////////////////////////////////////////
// //////////////////////////////////////////////////////////////////////////////
morri-son marked this conversation as resolved.
Show resolved Hide resolved

type consumerPrio struct {
ConsumerProvider
Expand All @@ -135,7 +135,7 @@ func WithPriority(p ConsumerProvider, prio int) ConsumerProvider {
}
}

////////////////////////////////////////////////////////////////////////////////
// //////////////////////////////////////////////////////////////////////////////

type PriorityProvider interface {
GetPriority() int
Expand Down Expand Up @@ -244,13 +244,13 @@ func (p *consumerProviderRegistry) catchedMatch(ectx EvaluationContext, sub Cons
cs = nil
ci = cur
}, exception.ByPrototypes(&UnwindStack{}))
log.Trace("pattern: {{pattern}}\ncontext: {{context}}\nprovider: {{provider}}",
"pattern", pattern, "context", ectx, "provider", sub)
log.Trace("pattern: {{pattern}}\ncontext: {{context}}",
"pattern", pattern, "context", ectx)
ectx, useprov, _ := p.checkHandleProvider(ectx, sub, pattern)
if !useprov {
return nil, cur
}
log.Trace("attempt match with provider: {{provider}}", "provider", sub)
log.Trace("attempt match with provider")
return sub.Match(ectx, pattern, cur, m)
}

Expand Down
8 changes: 0 additions & 8 deletions api/utils/logging/roundtripper.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -20,17 +20,9 @@ type RoundTripper struct {
}

func (t *RoundTripper) RoundTrip(req *http.Request) (*http.Response, error) {
// Redact the Authorization header to make sure it doesn't get logged at any point.
header := req.Header
if key := "Authorization"; req.Header.Get(key) != "" {
header = header.Clone()
header.Set(key, "***")
}

t.logger.Trace("roundtrip",
"url", req.URL,
"method", req.Method,
"header", header,
)
return t.RoundTripper.RoundTrip(req)
}
11 changes: 5 additions & 6 deletions api/utils/logging/roundtripper_test.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -34,7 +34,7 @@ var _ = Describe("RoundTripper", func() {
}
})

It("redacts Authorization header", func() {
It("does not log header information", func() {
r := logcfg.ConditionalRule("trace")
cfg := &logcfg.Config{
Rules: []logcfg.Rule{r},
Expand All @@ -51,15 +51,14 @@ var _ = Describe("RoundTripper", func() {
req, err := http.NewRequest("GET", server.URL, nil)
Expect(err).NotTo(HaveOccurred())
req.Header.Set("Authorization", "this should be redacted")
req.Header.Set("Cookie", "my secret session token")
req.Header.Set("MyArbitraryHeader", "some secret information")

_, err = client.Do(req)
Expect(err).NotTo(HaveOccurred())

Expect(buf.String()).To(ContainSubstring("roundtrip"))
Expect(buf.String()).To(ContainSubstring("url"))
Expect(buf.String()).To(ContainSubstring("method"))
Expect(buf.String()).To(ContainSubstring("header"))
Expect(buf.String()).To(ContainSubstring("***"))
Expect(buf.String()).NotTo(ContainSubstring("this should be redacted"))
Expect(buf.String()).NotTo(ContainSubstring("my secret session token"))
Expect(buf.String()).NotTo(ContainSubstring("some secret information"))
})
})
Loading