From 075cf4c800063e3cc65c3d41a9c23222e8ebb554 Mon Sep 17 00:00:00 2001
From: Alexandre Alapetite <alexandre@alapetite.fr>
Date: Wed, 11 Jan 2023 23:27:14 +0100
Subject: API avoid logging passwords (#5001)

* API avoid logging passwords
* Strip passwords and tokens from API logs
* Only log failed requests information when in debug mode

* Remove debug SHA

* Clean also Apache logs

* Better comments

* Redact also token parameters

* shfmt

* Simplify whitespace

* redacted
---
 lib/lib_rss.php | 25 +++++++++++++++++++++++++
 1 file changed, 25 insertions(+)

(limited to 'lib')

diff --git a/lib/lib_rss.php b/lib/lib_rss.php
index d0e819d98..cbdfff773 100644
--- a/lib/lib_rss.php
+++ b/lib/lib_rss.php
@@ -223,6 +223,31 @@ function html_only_entity_decode($text): string {
 	return $text == '' ? '' : strtr($text, $htmlEntitiesOnly);
 }
 
+/**
+ * Remove passwords in FreshRSS logs.
+ * See also ../cli/sensitive-log.sh for Web server logs.
+ * @param array<string,mixed>|string $log
+ * @return array<string,mixed>|string
+ */
+function sensitive_log($log) {
+	if (is_array($log)) {
+		foreach ($log as $k => $v) {
+			if (in_array($k, ['api_key', 'Passwd', 'T'])) {
+				$log[$k] = '██';
+			} else {
+				$log[$k] = sensitive_log($v);
+			}
+		}
+	} elseif (is_string($log)) {
+		$log = preg_replace([
+				'/\b(auth=.*?\/)[^&]+/i',
+				'/\b(Passwd=)[^&]+/i',
+				'/\b(Authorization)[^&]+/i',
+			], '$1█', $log);
+	}
+	return $log;
+}
+
 /**
  * @param array<string,mixed> $attributes
  */
-- 
cgit v1.2.3