mirror of
https://github.com/pewdiepie-archdaemon/odysseus.git
synced 2026-06-22 20:55:29 -04:00
nopoz
7e5db9a3c6
* fix(security): redact credential-bearing URLs and PII from logs Several log statements emitted sensitive data in clear text: - model_routes / chat_routes / contacts_routes logged endpoint URLs raw. Admin-configured URLs can embed credentials in userinfo or query (e.g. https://user:pass@host, ?api_key=...). Route them through a shared core.log_safety.redact_url() that drops userinfo/query/fragment. - note_routes / task_scheduler logged operator email addresses (smtp_user, recipient). Replaced with presence booleans, which keeps the diagnostic ("why didn't this send") without writing PII to logs. model_routes already had a local redactor on its HTTPStatusError branch; the generic except branch was missed, so reuse the existing helper there. Clears CodeQL py/clear-text-logging-sensitive-data alerts 264, 317, 324, 325, 343, 344, 528. * fix(security): re-bracket IPv6 hosts and single-source the URL redactor Address review on #4750: - redact_url now re-brackets IPv6 literals so host:port stays unambiguous (https://[2001:db8::1]:8443/v1, not the bracket-less ambiguous form). - point model_routes._redact_url_for_log at the shared helper so the two redactors are single-sourced (also picks up the IPv6 fix).
28 lines
1.0 KiB
Python
28 lines
1.0 KiB
Python
"""Helpers for keeping sensitive data out of logs.
|
|
|
|
Endpoint URLs configured by admins can embed credentials in the userinfo
|
|
(``https://user:pass@host``) or query string (``?api_key=...``). Logging them
|
|
raw leaks those secrets, so route/diagnostic logs run URLs through
|
|
``redact_url`` first. Reconstructing the URL without userinfo/query/fragment
|
|
also doubles as a sanitizer barrier for CodeQL's clear-text-logging query.
|
|
"""
|
|
|
|
from urllib.parse import urlparse, urlunparse
|
|
|
|
|
|
def redact_url(url: str) -> str:
|
|
"""Return a URL safe for logs by removing userinfo and query/fragment.
|
|
|
|
Keeps scheme, host, port and path so logs stay useful for debugging.
|
|
"""
|
|
try:
|
|
parsed = urlparse(url or "")
|
|
host = parsed.hostname or ""
|
|
if ":" in host: # IPv6 literal — re-bracket so host:port stays unambiguous
|
|
host = f"[{host}]"
|
|
if parsed.port:
|
|
host = f"{host}:{parsed.port}"
|
|
return urlunparse((parsed.scheme, host, parsed.path, "", "", ""))
|
|
except Exception:
|
|
return "<endpoint>"
|