Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

new relic license key is printed in debug logs #353

Closed
pete911 opened this issue Jul 28, 2021 · 1 comment · Fixed by #374
Closed

new relic license key is printed in debug logs #353

pete911 opened this issue Jul 28, 2021 · 1 comment · Fixed by #374

Comments

@pete911
Copy link

pete911 commented Jul 28, 2021

New relic license key is logged in debug.

Summary

License key should be masked (or we should just print if it is set or not) and not printed in logs. We don't know who has access to logs (intern in a company can have only view privileges, but can see and potentially misuse the token, token is longed lived and only thing required to send logs/metrics).

This can be misused e.g. increasing company cost, running out of quote etc.

Desired Behaviour

License key (and all sensitive data) should be removed from logs, or masked, or just logged as being set.
TIP: # ( Do NOT give us access or passwords to your New Relic account or API keys! )

Possible Solution

url is built in collector.go rpmURL(...) and then logged in collector.go collector_request(...)

One option could be to return url struct from rpmULR instead of string, so we have access to just the host, path and the scheme (for debug log), but also to url.String() for the url with query.

Additional context

@pete911
Copy link
Author

pete911 commented Jul 28, 2021

Added possible solution as pull request -> #354
implementation -> #362

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

Successfully merging a pull request may close this issue.

2 participants