matrix/matrix-js-sdk
1
0
Fork 0
mirror of https://github.com/matrix-org/matrix-js-sdk.git synced 2025-11-26 17:03:12 +03:00
Code Activity

Log query parameters on HTTP requests (#3591)

Browse Source 
* Log query parameters on HTTP requests

Follow-up to https://github.com/matrix-org/matrix-js-sdk/pull/3485

* Only stringify once

See https://github.com/matrix-org/matrix-js-sdk/pull/3591#discussion_r1261300323
This commit is contained in:
Eric Eastwood
2023-07-13 08:07:01 -05:00
committed by GitHub
parent d92936fba5
commit 8ef2e848b9
2 changed files with 14 additions and 8 deletions
Download Patch File Download Diff File Expand all files Collapse all files

16
src/http-api/fetch.ts
View File

@@ -224,7 +224,7 @@ export class FetchHttpApi<O extends IHttpOpts> {
body?: Body,
opts: Pick<IRequestOpts, "headers" | "json" | "localTimeoutMs" | "keepAlive" | "abortSignal"> = {},
): Promise<ResponseType<T, O>> {
const urlForLogs = this.clearUrlParamsForLogs(url);
const urlForLogs = this.sanitizeUrlForLogs(url);
logger.debug(`FetchHttpApi: --> ${method} ${urlForLogs}`);
const headers = Object.assign({}, opts.headers || {});
@@ -299,7 +299,7 @@ export class FetchHttpApi<O extends IHttpOpts> {
return res as ResponseType<T, O>;
}
private clearUrlParamsForLogs(url: URL | string): string {
private sanitizeUrlForLogs(url: URL | string): string {
try {
let asUrl: URL;
if (typeof url === "string") {
@@ -307,9 +307,15 @@ export class FetchHttpApi<O extends IHttpOpts> {
} else {
asUrl = url;
}
// get just the path to remove any potential url param that could have
// some potential secrets
return asUrl.origin + asUrl.pathname;
// Remove the values of any URL params that could contain potential secrets
const sanitizedQs = new URLSearchParams();
for (const key of asUrl.searchParams.keys()) {
sanitizedQs.append(key, "xxx");
}
const sanitizedQsString = sanitizedQs.toString();
const sanitizedQsUrlPiece = sanitizedQsString ? `?${sanitizedQsString}` : "";
return asUrl.origin + asUrl.pathname + sanitizedQsUrlPiece;
} catch (error) {
// defensive coding for malformed url
return "??";