From d74fecac031df1c3b4e817f49f7bafe2b175be11 Mon Sep 17 00:00:00 2001
From: Stan Hu <stanhu@gmail.com>
Date: Wed, 30 Aug 2017 21:14:29 -0700
Subject: [PATCH] Filter additional secrets from Rails logs
Upon inspection of logs, there were a number of fields not filtered. For example:
* authenticity_token: CSRF token
* rss_token: Used for RSS feeds
* secret: Used with Projects::UploadController
Rails provides a way to match regexps, so we now filter:
* Any parameter ending with `_token`
* Any parameter containing `password`
* Any parameter containing `secret`
---
changelogs/unreleased/sh-filter-csrf-params.yml | 5 +++++
config/application.rb | 15 ++++-----------
2 files changed, 9 insertions(+), 11 deletions(-)
create mode 100644 changelogs/unreleased/sh-filter-csrf-params.yml
diff --git a/changelogs/unreleased/sh-filter-csrf-params.yml b/changelogs/unreleased/sh-filter-csrf-params.yml
new file mode 100644
index 0000000000000..70eb3321e77d5
--- /dev/null
+++ b/changelogs/unreleased/sh-filter-csrf-params.yml
@@ -0,0 +1,5 @@
+---
+title: Filter additional secrets from Rails logs
+merge_request:
+author:
+type: security
diff --git a/config/application.rb b/config/application.rb
index f69dab4de3988..32a290f200272 100644
--- a/config/application.rb
+++ b/config/application.rb
@@ -51,31 +51,24 @@ class Application < Rails::Application
# Configure sensitive parameters which will be filtered from the log file.
#
# Parameters filtered:
- # - Password (:password, :password_confirmation)
- # - Private tokens
+ # - Any parameter ending with `_token`
+ # - Any parameter containing `password`
+ # - Any parameter containing `secret`
# - Two-factor tokens (:otp_attempt)
# - Repo/Project Import URLs (:import_url)
# - Build variables (:variables)
# - GitLab Pages SSL cert/key info (:certificate, :encrypted_key)
# - Webhook URLs (:hook)
- # - GitLab-shell secret token (:secret_token)
# - Sentry DSN (:sentry_dsn)
# - Deploy keys (:key)
+ config.filter_parameters += [/_token$/, /password/, /secret/]
config.filter_parameters += %i(
- authentication_token
certificate
encrypted_key
hook
import_url
- incoming_email_token
- rss_token
key
otp_attempt
- password
- password_confirmation
- private_token
- runners_token
- secret_token
sentry_dsn
variables
)
--
GitLab