Mask the value of the Authorization header if debug is enabled#501
Merged
lgarber-akamai merged 4 commits intolinode:mainfrom May 14, 2024
Merged
Mask the value of the Authorization header if debug is enabled#501lgarber-akamai merged 4 commits intolinode:mainfrom
lgarber-akamai merged 4 commits intolinode:mainfrom
Conversation
Signed-off-by: Ross Kirkpatrick <rkirkpat@akamai.com> Signed-off-by: rosskirkpat <rosskirkpat@outlook.com>
Signed-off-by: Ross Kirkpatrick <rosskirkpat@outlook.com>
shanduur
approved these changes
May 8, 2024
jriddle-linode
approved these changes
May 8, 2024
Collaborator
jriddle-linode
left a comment
There was a problem hiding this comment.
Nice catch thank you.
yec-akamai
approved these changes
May 8, 2024
Contributor
yec-akamai
left a comment
There was a problem hiding this comment.
Thank you for your contribution! Everything looks great aside from @lgarber-akamai 's comment 👍
lgarber-akamai
approved these changes
May 8, 2024
Contributor
lgarber-akamai
left a comment
There was a problem hiding this comment.
I'll be out Thursday and Friday so I'll give this my preemptive approval for once my comment has been addressed. Thanks for the contribution!
Signed-off-by: Ross Kirkpatrick <rosskirkpat@outlook.com>
Contributor
Author
@lgarber-akamai When you have a minute, would I be able ant to get your sign-off on the latest commit? I believe this PR is ready to be merged now. |
lgarber-akamai
approved these changes
May 14, 2024
Contributor
lgarber-akamai
left a comment
There was a problem hiding this comment.
Looks perfect, thank you!
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
📝 Description
What does this PR do and why is this change necessary?
If
LINODE_DEBUGis enabled, the resty debug returns the plain-textAuthorizationheader value from the request. This PR ensures that theAuthorizationheader value will be sanitized/masked if debug mode is enabled.I also added a logger to the internal testutil package that is compliant with the resty.Logger interface.
✔️ How to Test
What are the steps to reproduce the issue or verify the changes?
Reproduce the issue: set
LINODE_DEBUGwhen using linodego and observe a plain-text token in the debug output from resty ie.Authorization: Bearer <LINODE_TOKEN_PLAIN_TEXT>Verify the changes: set
LINODE_DEBUGwhen using linodego and observe a masked token in the debug output from resty (see below).How do I run the relevant unit/integration tests?
I added a new test
TestDebugLogSanitizationrelating to these changes.