httpigeon 2.4.2 → 2.4.4

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 634475756f1a58d6586feccfcd2dd7bc9fcbf02fce50a3a9eca04b79d3cc5380
-  data.tar.gz: b762c69ed489b18e50b818dea741c2584c15d409e5e61af51c5155a6a226bc41
+  metadata.gz: 0b8d669487635648819946f6e0dc0397d455a8c9e94f3910237f87b44ba83baa
+  data.tar.gz: c8d74069ffcbc45b04fbbce70fd773fe61de28ca0653c36373f22b025ed0616d
 SHA512:
-  metadata.gz: 101f7f013bb4a0d0ef22139027e69b6778419afc0c6ab4ab415e5a8e20873b9814ecd25f25da3932207acf29f531dd76f22ddddbf11f94e675a3c15b6367d2e9
-  data.tar.gz: 4dcdaedcb617d073dfc75ce7ef1c80a1199f78bb7cf0d244c87cb48ecaccba3170123311cb1b5667b1db20adcecab3921e5d67403ae6b815a9221b82c104c24c
+  metadata.gz: c1310fd845d9e301ef72f653f92d90df00c59437f8bd930ca028a30ba63901399ebe474acf107e4d120051e5d972b2dc8fa1c77be707a692ac3f6376465766b6
+  data.tar.gz: f32e7f66c863a1bec098504328e6321d4b41d3a3276517169c7735b6547c50fc26cb43ff802b6c4a6b180c0dce95139ccac335bb4dd55dad8f3527109c427329

data/CHANGELOG.md

@@ -1,5 +1,19 @@
 # Changelog
 
+## [2.4.4](https://github.com/dailypay/httpigeon/compare/v2.4.3...v2.4.4) (2026-07-17)
+
+
+### Bug Fixes
+
+* **ASV-4361:** close five log-redaction and dispatch findings ([#64](https://github.com/dailypay/httpigeon/issues/64)) ([ef56054](https://github.com/dailypay/httpigeon/commit/ef5605465787d5cea1cce6f39ffd96763502a968))
+
+## [2.4.3](https://github.com/dailypay/httpigeon/compare/v2.4.2...v2.4.3) (2026-05-01)
+
+
+### Bug Fixes
+
+* **ASV-4003:** Fix default filter regex patterns ([#61](https://github.com/dailypay/httpigeon/issues/61)) ([8cb6d37](https://github.com/dailypay/httpigeon/commit/8cb6d37c0d441507f0c18b19ea1b406fca2b5d6b))
+
 ## [2.4.2](https://github.com/dailypay/httpigeon/compare/v2.4.1...v2.4.2) (2026-02-18)
 
 

data/lib/httpigeon/log_redactor.rb

@@ -48,15 +48,21 @@ module HTTPigeon
 
         if filter.present?
           replacement = filter.split('::')[1].presence
-          v = replacement.present? ? replacement : redact_value(v)
-        end
-
-        if v.is_a?(Hash)
-          [k, redact_hash(v)]
-        elsif v.is_a?(Array)
-          [k, v.map { |val| redact(val) }]
-        else
+          # Replace collections wholesale; partial redaction leaks bytes of
+          # nested secrets.
+          v = if replacement.present?
+                replacement
+              elsif v.is_a?(Hash) || v.is_a?(Array)
+                HTTPigeon.redactor_string
+              else
+                redact_value(v)
+              end
           [k, v]
+        else
+          # Recurse through the dispatcher so nested values redact like
+          # top-level ones. This runs content/regex filters over string
+          # values too (e.g. secrets in JSON bodies).
+          [k, redact(v)]
         end
       end
     end
@@ -67,13 +73,23 @@ module HTTPigeon
 
         next unless pattern.match?(%r{^/.*/([guysim]*)$})
 
+        regex = regex_for(pattern)
+
         data = if replacement.present?
-                 data.gsub(regex_for(pattern), replacement)
+                 # Block form keeps the replacement literal; the string form
+                 # expands backreferences (\1, \&) and re-emits the secret.
+                 data.gsub(regex) { replacement }
                else
-                 data.gsub(regex_for(pattern)) do |sub|
-                   captures = sub.match(regex_for(pattern))&.captures
-
-                   captures.present? ? captures[0] + redact_value(captures[1]) : sub
+                 data.gsub(regex) do |sub|
+                   captures = Regexp.last_match&.captures
+
+                   # A zero-width capture yields nil; skip it rather than
+                   # concatenating nil and raising TypeError.
+                   if captures.present? && !captures[1].nil?
+                     captures[0] + redact_value(captures[1])
+                   else
+                     sub
+                   end
                  end
                end
       end

data/lib/httpigeon/request.rb

@@ -84,12 +84,12 @@ module HTTPigeon
 
       raw_response = if HTTPigeon.mount_circuit_breaker
                        fuse.execute(request_id: connection.headers[REQUEST_ID_HEADER]) do
-                         connection.send(method, path, payload) do |request|
+                         connection.send(sym_method, path, payload) do |request|
                            yield(request) if block_given?
                          end
                        end
                      else
-                       connection.send(method, path, payload) do |request|
+                       connection.send(sym_method, path, payload) do |request|
                          yield(request) if block_given?
                        end
                      end

data/lib/httpigeon/version.rb

@@ -1,3 +1,3 @@
 module HTTPigeon
-  VERSION = "2.4.2".freeze
+  VERSION = "2.4.4".freeze
 end

data/lib/httpigeon.rb

@@ -12,11 +12,11 @@ module HTTPigeon
   extend self
 
   module FilterPatterns
-    EMAIL = "/(?'key'(email_?(address|Address)?=))(?'value'(.*\\.[a-z]+))(&|$)/".freeze
-    PASSWORD = "/(?'key'(pass_?(w|W)?ord=))(?'value'([^&$])*)/".freeze
-    USERNAME = "/(?'key'(user_?(n|N)?ame=))(?'value'([^&$])*)/".freeze
-    CLIENT_ID = "/(?'key'(client_?(id|Id)?=))(?'value'([^&$])*)/".freeze
-    CLIENT_SECRET = "/(?'key'(client_?(s|S)?ecret=))(?'value'([^&$])*)/".freeze
+    EMAIL = "/(?'key'(email_?(address|Address)?=))(?'value'([^&\\n\\r]*\\.[a-z]+))(?=&|$)/".freeze
+    PASSWORD = "/(?'key'(pass_?(w|W)?ord=))(?'value'([^&\\n\\r])*)/".freeze
+    USERNAME = "/(?'key'(user_?(n|N)?ame=))(?'value'([^&\\n\\r])*)/".freeze
+    CLIENT_ID = "/(?'key'(client_?(id|Id)?=))(?'value'([^&\\n\\r])*)/".freeze
+    CLIENT_SECRET = "/(?'key'(client_?(s|S)?ecret=))(?'value'([^&\\n\\r])*)/".freeze
   end
 
   class InvalidConfigurationError < StandardError; end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: httpigeon
 version: !ruby/object:Gem::Version
-  version: 2.4.2
+  version: 2.4.4
 platform: ruby
 authors:
 - 2k-joker
 autorequire:
 bindir: exe
 cert_chain: []
-date: 2026-02-18 00:00:00.000000000 Z
+date: 2026-07-17 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: faraday