Commit d0239bf5 authored by Sean McGivern's avatar Sean McGivern

Remove Sidekiq jobstr from logs and Sentry

When an exception happens in Sidekiq, Sentry gets a hash of the job
details, and then the same hash as a JSON-encoded string. That could be
useful if we had issues decoding the JSON, but that is very rare.
Sending this has a couple of problems:

1. It's wasteful.
2. It makes it hard to process any sensitive information out of the job,
   as we'd have to do so in both the hash and the string.

By removing the string, we only have to remove sensitive information
from the hash.
parent bcbb02dd
......@@ -26,6 +26,7 @@ module Gitlab
# Sanitize fields based on those sanitized from Rails.
config.sanitize_fields = Rails.application.config.filter_parameters.map(&:to_s)
config.processors << ::Gitlab::ErrorTracking::Processor::SidekiqProcessor
# Sanitize authentication headers
config.sanitize_http_headers = %w[Authorization Private-Token]
config.tags = { program: Gitlab.process_name }
......
# frozen_string_literal: true
module Gitlab
module ErrorTracking
module Processor
class SidekiqProcessor < ::Raven::Processor
def process(value, key = nil)
sidekiq = value.dig(:extra, :sidekiq)
return value unless sidekiq
sidekiq = sidekiq.dup
sidekiq.delete(:jobstr)
value[:extra][:sidekiq] = sidekiq
value
end
end
end
end
end
......@@ -18,6 +18,9 @@ module Gitlab
when String
output[:message] = data
when Hash
# jobstr is redundant and can include information we wanted to
# exclude (like arguments)
data.delete(:jobstr)
convert_to_iso8601!(data)
convert_retry_to_integer!(data)
stringify_args!(data)
......
# frozen_string_literal: true
require 'fast_spec_helper'
require 'rspec-parameterized'
require 'raven'
RSpec.describe Gitlab::ErrorTracking::Processor::SidekiqProcessor do
describe '#process' do
context 'when there is Sidekiq data' do
it 'removes a jobstr field if present' do
value = {
job: { 'args' => [1] },
jobstr: { 'args' => [1] }.to_json
}
expect(subject.process(extra_sidekiq(value)))
.to eq(extra_sidekiq(value.except(:jobstr)))
end
it 'does nothing with no jobstr' do
value = { job: { 'args' => [1] } }
expect(subject.process(extra_sidekiq(value)))
.to eq(extra_sidekiq(value))
end
end
context 'when there is no Sidekiq data' do
it 'does nothing' do
value = {
request: {
method: 'POST',
data: { 'key' => 'value' }
}
}
expect(subject.process(value)).to eq(value)
end
end
def extra_sidekiq(hash)
{ extra: { sidekiq: hash } }
end
end
end
......@@ -42,6 +42,12 @@ describe Gitlab::SidekiqLogging::JSONFormatter do
expect(subject).to eq(expected_output)
end
it 'removes jobstr from the hash' do
hash_input[:jobstr] = 'job string'
expect(subject).not_to include('jobstr')
end
context 'when the job args are bigger than the maximum allowed' do
it 'keeps args from the front until they exceed the limit' do
half_limit = Gitlab::Utils::LogLimitedArray::MAXIMUM_ARRAY_LENGTH / 2
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment