Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

fix(server): don't log invalid token in release builds #112

Merged
merged 2 commits into from
Aug 14, 2023

Conversation

tessus
Copy link
Collaborator

@tessus tessus commented Aug 13, 2023

Description

The server logs a sent token, if the token is not valid:

e.g.: rpaste -a invalid_token -V

[2023-08-13T19:24:30Z WARN  rustypaste::auth] authorization failure for a.b.c.d (header: invalid_token)

This change prints the token only in debug mode. In release mode the log entry will look like this:

[2023-08-13T19:24:30Z WARN  rustypaste::auth] authorization failure for a.b.c.d

Motivation and Context

fixes #111

Let's say you use rpaste with the token in the config file (or curl with the auth_token as env var or in a file), but use different rustypaste servers. If you forget only once to add the -a flag (or add the header to curl), a production token for another instance will be logged.

How Has This Been Tested?

  • cargo test
  • fixtures
  • manual testing

Changelog Entry

### Fixed

- Don't log invalid token in release builds

Types of Changes

  • Bug fix (non-breaking change which fixes an issue)
  • New feature (non-breaking change which adds functionality)
  • Breaking change (fix or feature that would cause existing functionality to change)
  • Documentation (no code change)
  • Refactor (refactoring production code)
  • Other

Checklist:

  • My code follows the code style of this project.
  • I have updated the documentation accordingly.
  • I have formatted the code with rustfmt.
  • I checked the lints with clippy.
  • I have added tests to cover my changes.
  • All new and existing tests passed.

@tessus tessus requested a review from orhun as a code owner August 13, 2023 20:23
@codecov-commenter
Copy link

codecov-commenter commented Aug 13, 2023

Codecov Report

Patch and project coverage have no change.

Comparison is base (77f0e42) 69.47% compared to head (8d6618e) 69.47%.
Report is 2 commits behind head on master.

❗ Your organization is not using the GitHub App Integration. As a result you may experience degraded service beginning May 15th. Please install the Github App Integration for your organization. Read more.

Additional details and impacted files
@@           Coverage Diff           @@
##           master     #112   +/-   ##
=======================================
  Coverage   69.47%   69.47%           
=======================================
  Files          11       11           
  Lines         557      557           
=======================================
  Hits          387      387           
  Misses        170      170           
Flag Coverage Δ
unit-tests 69.47% <ø> (ø)

Flags with carried forward coverage won't be shown. Click here to find out more.

Files Changed Coverage Δ
src/auth.rs 90.90% <ø> (ø)

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

Copy link
Owner

@orhun orhun left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Neat 💯

@orhun orhun merged commit 9145c46 into orhun:master Aug 14, 2023
8 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

server logs token, when wrong token is sent
3 participants