Skip to content

Filter out message param from logs.

Fred de Gierrequested to merge
547406-filter-message into master

What does this MR do and why?

Filter out param message from ending up in the logs as this might contain sensitive information. See issue: https://gitlab.com/gitlab-org/gitlab/-/issues/547406

References

Screenshots or screen recordings

Before After

How to set up and validate locally

  1. Start with the default branch, ensure Duo works for your GDK. Execute the following cURL:
curl -H "Private-Token: glpat-<redacted>" \
     -H "Content-Type: application/json" \
     -XPOST 'http://127.0.0.1:3000/api/v4/ai/duo_workflows/workflows/1/events' \
     -d '{
       "message": "hello_world",
       "event_type": "message"
       }'
  1. Then check the logs: tail log/api_json.log | grep message you should see something like this:
"params":[{"key":"message","value":"hello_world"}
  1. Now checkout this branch. And run the same cURL again followed by tail log/api_json.log | grep message you should see something like this:
"params":[{"key":"message","value":"[FILTERED]"}
  1. Notice the value is now filtered out.

MR acceptance checklist

Evaluate this MR against the MR acceptance checklist. It helps you analyze changes to reduce risks in quality, performance, reliability, security, and maintainability.

Related to #547406

Merge request reports