Commit d74fecac authored by Stan Hu's avatar Stan Hu

Filter additional secrets from Rails logs

Upon inspection of logs, there were a number of fields not filtered. For example:

* authenticity_token: CSRF token
* rss_token: Used for RSS feeds
* secret: Used with Projects::UploadController

Rails provides a way to match regexps, so we now filter:

* Any parameter ending with `_token`
* Any parameter containing `password`
* Any parameter containing `secret`
parent 172cb70d
---
title: Filter additional secrets from Rails logs
merge_request:
author:
type: security
......@@ -51,31 +51,24 @@ module Gitlab
# Configure sensitive parameters which will be filtered from the log file.
#
# Parameters filtered:
# - Password (:password, :password_confirmation)
# - Private tokens
# - Any parameter ending with `_token`
# - Any parameter containing `password`
# - Any parameter containing `secret`
# - Two-factor tokens (:otp_attempt)
# - Repo/Project Import URLs (:import_url)
# - Build variables (:variables)
# - GitLab Pages SSL cert/key info (:certificate, :encrypted_key)
# - Webhook URLs (:hook)
# - GitLab-shell secret token (:secret_token)
# - Sentry DSN (:sentry_dsn)
# - Deploy keys (:key)
config.filter_parameters += [/_token$/, /password/, /secret/]
config.filter_parameters += %i(
authentication_token
certificate
encrypted_key
hook
import_url
incoming_email_token
rss_token
key
otp_attempt
password
password_confirmation
private_token
runners_token
secret_token
sentry_dsn
variables
)
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment