mirror of
https://git.anonymousland.org/anonymousland/synapse.git
synced 2024-09-07 15:51:54 +00:00
Replace client_secret with <redacted> in server logs (#6158)
Replace `client_secret` query parameter values with `<redacted>` in the logs. Prevents a scenario where a MITM of server traffic can horde 3pids on their account.
This commit is contained in:
parent
aec1377d0b
commit
0f46bf5737
1
changelog.d/6158.bugfix
Normal file
1
changelog.d/6158.bugfix
Normal file
@ -0,0 +1 @@
|
|||||||
|
Redact `client_secret` in server logs.
|
@ -42,11 +42,13 @@ def cancelled_to_request_timed_out_error(value, timeout):
|
|||||||
|
|
||||||
|
|
||||||
ACCESS_TOKEN_RE = re.compile(r"(\?.*access(_|%5[Ff])token=)[^&]*(.*)$")
|
ACCESS_TOKEN_RE = re.compile(r"(\?.*access(_|%5[Ff])token=)[^&]*(.*)$")
|
||||||
|
CLIENT_SECRET_RE = re.compile(r"(\?.*client(_|%5[Ff])secret=)[^&]*(.*)$")
|
||||||
|
|
||||||
|
|
||||||
def redact_uri(uri):
|
def redact_uri(uri):
|
||||||
"""Strips access tokens from the uri replaces with <redacted>"""
|
"""Strips sensitive information from the uri replaces with <redacted>"""
|
||||||
return ACCESS_TOKEN_RE.sub(r"\1<redacted>\3", uri)
|
uri = ACCESS_TOKEN_RE.sub(r"\1<redacted>\3", uri)
|
||||||
|
return CLIENT_SECRET_RE.sub(r"\1<redacted>\3", uri)
|
||||||
|
|
||||||
|
|
||||||
class QuieterFileBodyProducer(FileBodyProducer):
|
class QuieterFileBodyProducer(FileBodyProducer):
|
||||||
|
Loading…
Reference in New Issue
Block a user