Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Redact api and app keys from errors #124

Merged
merged 2 commits into from
Nov 13, 2017
Merged

Redact api and app keys from errors #124

merged 2 commits into from
Nov 13, 2017

Conversation

nyanshak
Copy link
Collaborator

@nyanshak nyanshak commented Oct 24, 2017

Fix #76.

I don't know if this is the right way to fix this but I took a stab at it.

Copy link
Collaborator

@ojongerius ojongerius left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Kudos for taking this on!

request.go Outdated
func (client *Client) doJsonRequest(method, api string,
reqbody, out interface{}) error {
err := client.doJsonRequestUnsafe(method, api, reqbody, out)
Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

A nit picking alternative would be:

   if err := client.doJsonRequestUnsafe(method, api, reqbody, out) ; err != nil {
        errString := strings.Replace(err.Error(), client.apiKey, "redacted", -1)
        errString = strings.Replace(errString, client.appKey, "redacted", -1)
        return fmt.Errorf(errString)
    }

Copy link
Collaborator Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Will update this ^

request.go Outdated

// doJsonRequestUnsafe is the simplest type of request: a method on a URI that returns
// some JSON result which we unmarshal into the passed interface.
func (client *Client) doJsonRequestUnsafe(method, api string,
Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Would doJsonRequestUnredacted be a more informative name?

Copy link
Collaborator

@ojongerius ojongerius left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I know this works, but it would be awesome to have a test to make sure there is no regression later on.

@ojongerius
Copy link
Collaborator

ojongerius commented Nov 12, 2017

@nyanshak do you have time to add a test to make sure this issue does not regress? Making this change would be a good time to add it.

Approved the PR, and if @nyanshak does not have time to write a test I suggest we merge this and close of #76

* Unset api / app keys resulted in redacted being inserted between each
letter of the error string. This will ensure only actually set (rather
than empty string) api / app keys are redacted.
@nyanshak
Copy link
Collaborator Author

Rebased off master to resolve conflicts, also added the tests you mentioned @ojongerius. What do you think? :)

@zorkian zorkian merged commit 338f165 into zorkian:master Nov 13, 2017
@zorkian
Copy link
Owner

zorkian commented Nov 13, 2017

Awesome, thanks for adding the tests! LGTM!

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

POST errors leak credentials
3 participants