Skip to content

Commit

Permalink
Strip query string from the log for Location headers
Browse files Browse the repository at this point in the history
The Location URL may contain sensitive information, so just like the path
we should remove the query string.

Closes roidrage#229
  • Loading branch information
stanhu committed Mar 20, 2018
1 parent 3b61c61 commit aefae1e
Show file tree
Hide file tree
Showing 2 changed files with 6 additions and 2 deletions.
6 changes: 5 additions & 1 deletion lib/lograge/log_subscriber.rb
Original file line number Diff line number Diff line change
Expand Up @@ -53,6 +53,10 @@ def initial_data(payload)

def extract_path(payload)
path = payload[:path]
strip_query_string(path)
end

def strip_query_string(path)
index = path.index('?')
index ? path[0, index] : path
end
Expand Down Expand Up @@ -104,7 +108,7 @@ def extract_location
return {} unless location

RequestStore.store[:lograge_location] = nil
{ location: location }
{ location: strip_query_string(location) }
end

def extract_unpermitted_params
Expand Down
2 changes: 1 addition & 1 deletion spec/lograge_logsubscriber_spec.rb
Original file line number Diff line number Diff line change
Expand Up @@ -167,7 +167,7 @@

context 'with a redirect' do
before do
RequestStore.store[:lograge_location] = 'http://www.example.com'
RequestStore.store[:lograge_location] = 'http://www.example.com?key=value'
end

it 'adds the location to the log line' do
Expand Down

0 comments on commit aefae1e

Please sign in to comment.