Skip to content

Commit

Permalink
Add HTTP basic auth headers to default filters
Browse files Browse the repository at this point in the history
Technically only 'authorization' is used as a header, but PHP will
parse the username & password (or digest) — these aren't counted
as headers by PHP, but Symfony treats them as headers. Since a lot
of other projects use Symfony's HTTP foundation (e.g. Laravel), it
makes sense to add them as default filters too
  • Loading branch information
imjoehaines committed Sep 9, 2020
1 parent d33e643 commit 856f15c
Show file tree
Hide file tree
Showing 3 changed files with 30 additions and 5 deletions.
9 changes: 8 additions & 1 deletion src/Configuration.php
Original file line number Diff line number Diff line change
Expand Up @@ -45,7 +45,14 @@ class Configuration
*
* @var string[]
*/
protected $filters = ['password', 'cookie'];
protected $filters = [
'password',
'cookie',
'authorization',
'php-auth-user',
'php-auth-pw',
'php-auth-digest',
];

/**
* The project root regex.
Expand Down
3 changes: 3 additions & 0 deletions tests/ClientTest.php
Original file line number Diff line number Diff line change
Expand Up @@ -372,6 +372,7 @@ public function testItAddsADefaultSetOfMiddlewares()
$_SERVER['HTTP_COOKIE'] = 'tastes=delicious';
$_SERVER['HTTP_X_FORWARDED_FOR'] = '8.76.54.321';
$_SERVER['REQUEST_URI'] = '/abc/xyz?abc=1&xyz=2';
$_SERVER['HTTP_AUTHORIZATION'] = 'Basic YTpi';
$_GET['abc'] = '1';
$_GET['xyz'] = '2';
$_COOKIE['tastes'] = 'delicious';
Expand Down Expand Up @@ -408,6 +409,7 @@ function (Report $report) use (&$pipelineCompleted) {
'Host' => 'example.com',
'Cookie' => 'tastes=delicious',
'X-Forwarded-For' => '8.76.54.321',
'Authorization' => 'Basic YTpi',
],
],
'session' => [
Expand All @@ -426,6 +428,7 @@ function (Report $report) use (&$pipelineCompleted) {
'Host' => 'example.com',
'Cookie' => '[FILTERED]',
'X-Forwarded-For' => '8.76.54.321',
'Authorization' => '[FILTERED]',
],
$payload['metaData']['request']['headers']
);
Expand Down
23 changes: 19 additions & 4 deletions tests/ReportTest.php
Original file line number Diff line number Diff line change
Expand Up @@ -102,12 +102,27 @@ public function testUser()

public function testDefaultFilters()
{
$this->report->setMetaData([
'Testing' => ['password' => '123456', 'Cookie' => 'abc=xyz'],
]);
$metadata = array_reduce(
$this->config->getFilters(),
function ($metadata, $filter) {
$metadata[$filter] = "abc {$filter} xyz";

return $metadata;
},
[]
);

$this->report->setMetaData(['Testing' => $metadata]);

$this->assertSame(
['password' => '[FILTERED]', 'Cookie' => '[FILTERED]'],
[
'password' => '[FILTERED]',
'cookie' => '[FILTERED]',
'authorization' => '[FILTERED]',
'php-auth-user' => '[FILTERED]',
'php-auth-pw' => '[FILTERED]',
'php-auth-digest' => '[FILTERED]',
],
$this->report->toArray()['metaData']['Testing']
);
}
Expand Down

0 comments on commit 856f15c

Please sign in to comment.