sjs/grape_logging
1
0
Fork 0
mirror of https://github.com/samsonjs/grape_logging.git synced 2026-04-27 14:57:40 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions

Merge pull request #54 from abicky/scrub-invalid-byte-sequence-keys

Browse source 
Convert parameter keys to ASCII-8BIT before filtering
This commit is contained in:
Sami Samhuri 2025-06-27 08:42:15 -04:00 committed by GitHub
commit 0d70063ae5
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
2 changed files with 48 additions and 28 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

18
lib/grape_logging/loggers/filter_parameters.rb
View file

@ -29,7 +29,23 @@ module GrapeLogging
end end
def clean_parameters(parameters) def clean_parameters(parameters)
parameter_filter.filter(parameters).reject{ |key, _value| @exceptions.include?(key) } original_encoding_map = build_encoding_map(parameters)
params = transform_key_encoding(parameters, Hash.new{ |h, _| [Encoding::ASCII_8BIT, h] })
cleaned_params = parameter_filter.filter(params).reject{ |key, _value| @exceptions.include?(key) }
transform_key_encoding(cleaned_params, original_encoding_map)
end
def build_encoding_map(parameters)
parameters.each_with_object({}) do |(k, v), h|
h[k.dup.force_encoding(Encoding::ASCII_8BIT)] = [k.encoding, v.is_a?(Hash) ? build_encoding_map(v) : nil]
end
end
def transform_key_encoding(parameters, encoding_map)
parameters.each_with_object({}) do |(k, v), h|
encoding, children_encoding_map = encoding_map[k]
h[k.dup.force_encoding(encoding)] = v.is_a?(Hash) ? transform_key_encoding(v, children_encoding_map) : v
end
end end
end end
end end

58
spec/lib/grape_logging/loggers/filter_parameters_spec.rb
View file

@ -7,11 +7,12 @@ describe GrapeLogging::Loggers::FilterParameters do
let(:mock_request) do let(:mock_request) do
OpenStruct.new(params: { OpenStruct.new(params: {
this_one: 'this one', 'this_one' => 'this one',
that_one: 'one', 'that_one' => 'one',
two: 'two', 'two' => 'two',
three: 'three', 'three' => 'three',
four: 'four' 'four' => 'four',
"\xff" => 'invalid utf8',
}) })
end end
@ -19,8 +20,8 @@ describe GrapeLogging::Loggers::FilterParameters do
deep_clone = lambda { Marshal.load Marshal.dump mock_request.params } deep_clone = lambda { Marshal.load Marshal.dump mock_request.params }
OpenStruct.new( OpenStruct.new(
params: deep_clone.call.merge( params: deep_clone.call.merge(
five: deep_clone.call.merge( 'five' => deep_clone.call.merge(
deep_clone.call.merge({six: {seven: 'seven', eight: 'eight', one: 'another one'}}) deep_clone.call.merge({'six' => {'seven' => 'seven', 'eight' => 'eight', 'one' => 'another one'}})
) )
) )
) )
@ -35,31 +36,34 @@ describe GrapeLogging::Loggers::FilterParameters do
shared_examples 'filtering' do shared_examples 'filtering' do
it 'filters out sensitive parameters' do it 'filters out sensitive parameters' do
expect(subject.parameters(mock_request, nil)).to eq(params: { expect(subject.parameters(mock_request, nil)).to eq(params: {
this_one: subject.instance_variable_get('@replacement'), 'this_one' => subject.instance_variable_get('@replacement'),
that_one: subject.instance_variable_get('@replacement'), 'that_one' => subject.instance_variable_get('@replacement'),
two: 'two', 'two' => 'two',
three: 'three', 'three' => 'three',
four: subject.instance_variable_get('@replacement'), 'four' => subject.instance_variable_get('@replacement'),
"\xff" => 'invalid utf8',
}) })
end end
it 'deeply filters out sensitive parameters' do it 'deeply filters out sensitive parameters' do
expect(subject.parameters(mock_request_with_deep_nesting, nil)).to eq(params: { expect(subject.parameters(mock_request_with_deep_nesting, nil)).to eq(params: {
this_one: subject.instance_variable_get('@replacement'), 'this_one' => subject.instance_variable_get('@replacement'),
that_one: subject.instance_variable_get('@replacement'), 'that_one' => subject.instance_variable_get('@replacement'),
two: 'two', 'two' => 'two',
three: 'three', 'three' => 'three',
four: subject.instance_variable_get('@replacement'), 'four' => subject.instance_variable_get('@replacement'),
five: { "\xff" => 'invalid utf8',
this_one: subject.instance_variable_get('@replacement'), 'five' => {
that_one: subject.instance_variable_get('@replacement'), 'this_one' => subject.instance_variable_get('@replacement'),
two: 'two', 'that_one' => subject.instance_variable_get('@replacement'),
three: 'three', 'two' => 'two',
four: subject.instance_variable_get('@replacement'), 'three' => 'three',
six: { 'four' => subject.instance_variable_get('@replacement'),
seven: 'seven', "\xff" => 'invalid utf8',
eight: 'eight', 'six' => {
one: subject.instance_variable_get('@replacement'), 'seven' => 'seven',
'eight' => 'eight',
'one' => subject.instance_variable_get('@replacement'),
}, },
}, },
}) })