yuanbiao
/
emqx
1
0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

fix: redact all headers from logs 

Fixes https://emqx.atlassian.net/browse/EMQX-11904

Since headers are usually used for authentication and the headers used for that are very
flexible, we redact all headers from logs to avoid leaking anything.
This commit is contained in:
Thales Macedo Garitezi 2024-02-26 17:21:03 -03:00
parent a3e81c5039
commit d8032f47ca
3 changed files with 6 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
apps/emqx_audit/test/emqx_audit_api_SUITE.erl
View File

@ -88,7 +88,7 @@ t_http_api(_) ->
<<"method">> := <<"put">>, <<"method">> := <<"put">>,
<<"body">> := #{<<"mqtt">> := #{<<"max_qos_allowed">> := 1}}, <<"body">> := #{<<"mqtt">> := #{<<"max_qos_allowed">> := 1}},
<<"bindings">> := _, <<"bindings">> := _,
<<"headers">> := #{<<"authorization">> := <<"******">>} <<"headers">> := "******"
}, },
<<"http_status_code">> := 200, <<"http_status_code">> := 200,
<<"operation_result">> := <<"success">>, <<"operation_result">> := <<"success">>,

2
apps/emqx_utils/src/emqx_utils.app.src
View File

@ -2,7 +2,7 @@
{application, emqx_utils, [ {application, emqx_utils, [
{description, "Miscellaneous utilities for EMQX apps"}, {description, "Miscellaneous utilities for EMQX apps"},
% strict semver, bump manually! % strict semver, bump manually!
{vsn, "5.0.15"}, {vsn, "5.0.16"},
{modules, [ {modules, [
emqx_utils, emqx_utils,
emqx_utils_api, emqx_utils_api,

4
apps/emqx_utils/src/emqx_utils.erl
View File

@ -717,6 +717,9 @@ is_sensitive_key(<<"jwt">>) -> true;
is_sensitive_key(authorization) -> true; is_sensitive_key(authorization) -> true;
is_sensitive_key("authorization") -> true; is_sensitive_key("authorization") -> true;
is_sensitive_key(<<"authorization">>) -> true; is_sensitive_key(<<"authorization">>) -> true;
is_sensitive_key(headers) -> true;
is_sensitive_key("headers") -> true;
is_sensitive_key(<<"headers">>) -> true;
is_sensitive_key(bind_password) -> true; is_sensitive_key(bind_password) -> true;
is_sensitive_key("bind_password") -> true; is_sensitive_key("bind_password") -> true;
is_sensitive_key(<<"bind_password">>) -> true; is_sensitive_key(<<"bind_password">>) -> true;
@ -879,6 +882,7 @@ redact_test_() ->
secret_key, secret_key,
secret_access_key, secret_access_key,
security_token, security_token,
headers,
token, token,
bind_password bind_password
], ],