noticed 3.1.0 → 3.1.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 5a62b2258520a1d287a6ab2ff9b73288e37ebd7d4b18994c0b13bcfb591e9440
-  data.tar.gz: ecf9a251b05942f6b32c3730b923d59e16e4eb9de169e361b1ce0cb2989750f1
+  metadata.gz: ecc868a3bd5a4a148807346b8098f98adc8c3d5eb32a06ae715ae3ba2cca97fc
+  data.tar.gz: 49d58efb90e42b62307fb7935d742d18e6e55819eabf3ba8cc6b8aad194e325b
 SHA512:
-  metadata.gz: 75edf989bdb4bc2fd7ee445f2852107fdfd629696affeae51d7e3d407ebdd97669b5d11bf8bbc79d92c4dc22dfde7bddcdd528c6f52c0230e1b169ef716d95cb
-  data.tar.gz: d34cdd0a3e905188d6efe9852b1b199148e9b4e02e0677d446fbf48ab94fb98d6bc87bf9b7917280649b6182f5e7ef9e9d64af0cd43ef1db4ea45b23d4517225
+  metadata.gz: 423d351810b3aa6105f911986c4fcd3f8984e54f5590673d02045062ca5af82e7bb67e33496d9375fd536efae423d1c377a9c903ec467fe37bdf212b418c60bf
+  data.tar.gz: 31ee2de6daa6e33026411b94cccf9eeb3af002f9e55be727b910c773b5c50c22a9d37043e57264f59c5948d1782f7bbee861032bedd10cc5604bc1ab80a5b25e

data/lib/noticed/api_client.rb

@@ -4,6 +4,18 @@ module Noticed
   module ApiClient
     extend ActiveSupport::Concern
 
+    # Webhook URLs whose path carries the credential. The first group is kept and the second is
+    # replaced with [FILTERED] in logs and error messages.
+    #
+    #   Discord          https://discord.com/api/webhooks/{id}/{token}[/slack|/github]
+    #   Slack            https://hooks.slack.com/services/T000/B000/{token}
+    #   Microsoft Teams  https://{tenant}.webhook.office.com/webhookb2/{group}@{tenant}/IncomingWebhook/... (everything after is filtered)
+    CREDENTIAL_PATHS = [
+      %r{(discord(?:app)?\.com/api/(?:v\d+/)?webhooks/\d+/)([^/]+)},
+      %r{(hooks\.slack\.com/(?:services/)?T[^/]+/B[^/]+/)([^/]+)},
+      %r{(/webhookb2/[^/]+/IncomingWebhook/)(.+)}
+    ]
+
     # Helper method for making POST requests from delivery methods
     #
     # Usage:
@@ -34,7 +46,7 @@ module Noticed
       end
 
       # Bodies aren't logged since they can contain credentials and access tokens
-      logger.debug("POST #{url}")
+      logger.debug("POST #{ApiClient.filtered_url(url)}")
       response = http.request(request)
       logger.debug("Response: #{response.code}")
 
@@ -42,5 +54,23 @@ module Noticed
 
       response
     end
+
+    # Returns the URL with credentials replaced by [FILTERED], like Rails does for request parameters
+    #
+    #   Noticed::ApiClient.filtered_url("https://discord.com/api/webhooks/123/abc?wait=true")
+    #   # => "https://discord.com/api/webhooks/123/[FILTERED]?wait=true"
+    def self.filtered_url(url)
+      path, query = url.to_s.split("?", 2)
+      CREDENTIAL_PATHS.each { |pattern| path = path.sub(pattern) { "#{$1}[FILTERED]" } }
+
+      if query
+        # Application's filter_parameters plus sig, the secret of Microsoft Teams Workflows URLs:
+        # https://prod-00.westus.logic.azure.com/workflows/{id}/triggers/manual/paths/invoke?api-version=...&sp=...&sv=...&sig={secret}
+        parameter_filter = ActiveSupport::ParameterFilter.new(Rails.application.config.filter_parameters + [:sig])
+        query = query.gsub(/([^&=]+)=([^&]*)/) { "#{$1}=#{parameter_filter.filter_param($1, $2)}" }
+      end
+
+      query ? "#{path}?#{query}" : path
+    end
   end
 end

data/lib/noticed/version.rb

@@ -1,3 +1,3 @@
 module Noticed
-  VERSION = "3.1.0"
+  VERSION = "3.1.1"
 end

data/lib/noticed.rb

@@ -35,10 +35,10 @@ module Noticed
 
     def initialize(response, url, args)
       @response = response
-      @url = url
+      @url = ApiClient.filtered_url(url)
       @args = args
 
-      super("POST request to #{url} returned #{response.code} response:\n#{response.body.inspect}")
+      super("POST request to #{@url} returned #{response.code} response:\n#{response.body.inspect}")
     end
   end
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: noticed
 version: !ruby/object:Gem::Version
-  version: 3.1.0
+  version: 3.1.1
 platform: ruby
 authors:
 - Chris Oliver