From ca08437967e5ecbd41ae74de38cede0de1e6047c Mon Sep 17 00:00:00 2001 From: Joas Schilling Date: Thu, 28 Mar 2024 11:10:39 +0100 Subject: [PATCH] fix(logger): Make the handling of SensitiveParameters consistent Signed-off-by: Joas Schilling --- lib/private/Log/ExceptionSerializer.php | 4 +++- tests/lib/Log/ExceptionSerializerTest.php | 19 +++++++++++++++++++ 2 files changed, 22 insertions(+), 1 deletion(-) diff --git a/lib/private/Log/ExceptionSerializer.php b/lib/private/Log/ExceptionSerializer.php index 8b895bcb6be..da4c7224aa4 100644 --- a/lib/private/Log/ExceptionSerializer.php +++ b/lib/private/Log/ExceptionSerializer.php @@ -220,7 +220,9 @@ class ExceptionSerializer { private function removeValuesFromArgs($args, $values): array { $workArgs = []; foreach ($args as $arg) { - if (in_array($arg, $values, true)) { + if (isset($arg['__class__']) && $arg['__class__'] === \SensitiveParameterValue::class) { + $arg = self::SENSITIVE_VALUE_PLACEHOLDER; + } elseif (in_array($arg, $values, true)) { $arg = self::SENSITIVE_VALUE_PLACEHOLDER; } elseif (is_array($arg)) { $arg = $this->removeValuesFromArgs($arg, $values); diff --git a/tests/lib/Log/ExceptionSerializerTest.php b/tests/lib/Log/ExceptionSerializerTest.php index 209214a6832..6637c401ab1 100644 --- a/tests/lib/Log/ExceptionSerializerTest.php +++ b/tests/lib/Log/ExceptionSerializerTest.php @@ -52,6 +52,14 @@ class ExceptionSerializerTest extends TestCase { throw new \Exception('expected custom auth exception'); } + private function usingSensitiveParameterAttribute( + string $login, + #[\SensitiveParameter] + string $parole, + ): void { + throw new \Exception('SensitiveParameter attribute'); + } + /** * this test ensures that the serializer does not overwrite referenced * variables. It is crafted after a scenario we experienced: the DAV server @@ -81,4 +89,15 @@ class ExceptionSerializerTest extends TestCase { $this->assertFalse(isset($serializedData['Trace'][0]['args'][1])); } } + + public function testSensitiveParameterAttribute(): void { + try { + $this->usingSensitiveParameterAttribute('u57474', 'Secret'); + } catch (\Exception $e) { + $serializedData = $this->serializer->serializeException($e); + $this->assertSame('usingSensitiveParameterAttribute', $serializedData['Trace'][0]['function']); + $this->assertSame('u57474', $serializedData['Trace'][0]['args'][0]); + $this->assertSame('*** sensitive parameters replaced ***', $serializedData['Trace'][0]['args'][1]); + } + } }