ree_lib 1.3.15 → 1.3.16

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 2ecb6d379981355aad60ca8e7f67493643cc351e3f5232c2d8baa326a7630d07
-  data.tar.gz: 2530c228029eb4df4e96d6208f7a0c13c22aeb263c573e69372683f4f195449f
+  metadata.gz: 7b6bab291292300f6d1067e79262021b1a1ce40474fd4d3baf2ddec2398c521f
+  data.tar.gz: fe0536bc647d3bd48cbc04197a61fc5415aa8c58fb0aa1578eb90eafaa1c424c
 SHA512:
-  metadata.gz: b1cc7a1ffbb0a4946d8359bb24ac0340c567fe9631dd389c70dc78fba3b5812d963d7174352a0e50ea7c918e7004a2ffa9c989797673978687c7865199179eb0
-  data.tar.gz: 815c690e32475a28c02dc3bbf8b4b8808b0b23302dd0cb8e5f35322b688f26ed68f4e1d98a0c4e10a9b6d80194a5fafec15fa76d8a0e60895b394918c4446754
+  metadata.gz: 40ec71033ebe98320f43b20cf2dd626272cc313ee3d28540fd333d8aabf403f38c87c502c174184331aa6ca7e44cc6b657e5854a740f75eff844c6e9ab2f64b7
+  data.tar.gz: 03433f0fd291d8709afd41856ed2141e1b418ee39d72ce19148390c86660a7a13411e99f20e0d2a98dac5d37d96fbf05fba845f0ba8b6ae7e1c395e074fc381a

data/CHANGELOG.md

@@ -1,5 +1,16 @@
 ## [Unreleased]
 
+## [1.3.16] - 2026-10-21
+
+- `ree_roda`: the `ree_logger` plugin applies `filter_params` to the query
+  string of the `Request:` line. It used to be logged verbatim, so a secret
+  sent in the URL reached the log even though `Params` showed it filtered.
+  A bracketed name (`user[password]`, also percent-encoded) is matched by
+  each of its segments.
+- `ree_roda`: `filter_params` in the `ree_logger` plugin now walks nested
+  hashes and arrays; it used to check top level keys only. Names are still
+  matched exactly.
+
 ## [1.3.12] - 2026-09-02
 
 - `ree_audit`: `annotate_audit` fn — the entry point product code uses to attach

data/Gemfile.lock

@@ -9,7 +9,7 @@ PATH
 PATH
   remote: .
   specs:
-    ree_lib (1.3.15)
+    ree_lib (1.3.16)
       bigdecimal
       binding_of_caller
       i18n

data/lib/ree_lib/packages/ree_roda/package/ree_roda/plugins/ree_logger.rb

@@ -1,3 +1,4 @@
+require "uri"
 package_require "ree_logger/beans/logger"
 
 class Roda
@@ -50,7 +51,7 @@ class Roda
 
           message = <<~DOC
             Request/Response details:
-              Request: #{env["REQUEST_METHOD"]} #{env["QUERY_STRING"] && !env["QUERY_STRING"].empty? ? env["SCRIPT_NAME"].to_s + env["PATH_INFO"] + "?#{env["QUERY_STRING"]}": env["SCRIPT_NAME"].to_s + env["PATH_INFO"]} #{opts[:ree_logger_log_params] ? "\n  Params: " + _ree_logger_filtered_params.inspect : ""}
+              Request: #{env["REQUEST_METHOD"]} #{_ree_logger_request_path(env)} #{opts[:ree_logger_log_params] ? "\n  Params: " + _ree_logger_filtered_params.inspect : ""}
               Response status: #{response.status || "-"}#{(400..499).include?(response.status) ? "\n  Response body: " + response.body[0].to_s : ""}
               Time Taken: #{elapsed_time}
           DOC
@@ -64,11 +65,69 @@ class Roda
 
           return params if filter_keys.empty?
 
+          _ree_logger_filter_value(params, filter_keys, opts[:ree_logger_filter_params_placeholder])
+        end
+
+        # Keys are matched by exact name at any depth: a password nested in
+        # `{user: {password: ...}}` is still a password. Exact match, unlike the
+        # substring match of ree_audit, keeps `token_id` and the like readable.
+        def _ree_logger_filter_value(value, filter_keys, placeholder)
+          case value
+          when Hash
+            value.each_with_object({}) do |(k, v), h|
+              h[k] = if filter_keys.include?(k.to_s)
+                placeholder
+              else
+                _ree_logger_filter_value(v, filter_keys, placeholder)
+              end
+            end
+          when Array
+            value.map { _ree_logger_filter_value(_1, filter_keys, placeholder) }
+          else
+            value
+          end
+        end
+
+        def _ree_logger_request_path(env)
+          path = env["SCRIPT_NAME"].to_s + env["PATH_INFO"].to_s
+          query = env["QUERY_STRING"]
+
+          return path if query.nil? || query.empty?
+
+          "#{path}?#{_ree_logger_filtered_query(query)}"
+        end
+
+        # The query string is logged verbatim next to the path, so without this
+        # a secret sent in the URL (OAuth callback code, a token from an email
+        # link) reached the log even though Params showed it as filtered.
+        def _ree_logger_filtered_query(query)
+          filter_keys = opts[:ree_logger_filter_params]
+
+          return query if filter_keys.empty?
+
           placeholder = opts[:ree_logger_filter_params_placeholder]
 
-          params.each_with_object({}) do |(k, v), h|
-            h[k] = filter_keys.include?(k.to_s) ? placeholder : v
+          query.split("&", -1).map do |pair|
+            key, value = pair.split("=", 2)
+
+            if value && _ree_logger_filtered_query_key?(key, filter_keys)
+              "#{key}=#{placeholder}"
+            else
+              pair
+            end
+          end.join("&")
+        end
+
+        # `user[password]=...` is the nested form of the same param, so every
+        # bracket segment of the name is checked.
+        def _ree_logger_filtered_query_key?(key, filter_keys)
+          name = begin
+            URI.decode_www_form_component(key)
+          rescue ArgumentError
+            key
           end
+
+          name.scan(/[^\[\]]+/).any? { filter_keys.include?(_1) }
         end
 
         # Create timer instance used for timing

data/lib/ree_lib/packages/ree_roda/spec/ree_roda/plugins/ree_logger_spec.rb

@@ -3,34 +3,107 @@
 package_require("ree_roda/plugins/ree_logger")
 
 RSpec.describe :ree_logger do
-  it "filters request params" do
-    class TestFilterApp < ReeRoda::App
+  class TestFilterLogger
+    def info(msg)
+      logs << msg
+    end
+
+    def logs
+      @logs ||= []
+    end
+  end
+
+  let(:logger) { TestFilterLogger.new }
+
+  let(:app) {
+    log = logger
+
+    Class.new(ReeRoda::App) do
+      plugin(:ree_logger, ree_logger: log, filter_params: ["password", "token"])
+
       route do |r|
-        r.get "health" do
+        r.is "health" do
           "success"
         end
-
-        r.ree_routes
       end
     end
+  }
 
+  def request_line
+    logger.logs.first.lines.find { _1.include?("Request:") }
+  end
+
+  def params_line
+    logger.logs.first.lines.find { _1.include?("Params:") }
+  end
+
+  it "filters request params" do
     env = { "REQUEST_METHOD" => "GET", "PATH_INFO" => "/health", "QUERY_STRING" => "email=test@example.com&password=password" }
 
-    class TestFilterLogger
-      def info(msg)
-        @logs ||= []
-        @logs << msg
-      end
+    app.app.call(env)
+
+    expect(logger.logs.first).to match('"password" => "\[FILTERED\]"')
+  end
+
+  it "filters secrets in the query string of the request line" do
+    env = { "REQUEST_METHOD" => "GET", "PATH_INFO" => "/health", "QUERY_STRING" => "email=test%40example.com&password=s3cret&token=tok-1" }
+
+    app.app.call(env)
 
-      def logs
-        @logs
+    expect(request_line).to include("/health?email=test%40example.com&password=[FILTERED]&token=[FILTERED]")
+    expect(logger.logs.first).not_to include("s3cret")
+    expect(logger.logs.first).not_to include("tok-1")
+  end
+
+  it "filters bracketed and encoded names in the query string" do
+    env = { "REQUEST_METHOD" => "GET", "PATH_INFO" => "/health", "QUERY_STRING" => "user%5Bpassword%5D=s3cret&user[name]=bob&token_id=7" }
+
+    app.app.call(env)
+
+    expect(request_line).to include("user%5Bpassword%5D=[FILTERED]&user[name]=bob&token_id=7")
+    expect(logger.logs.first).not_to include("s3cret")
+    expect(params_line).to include('"token_id" => "7"')
+  end
+
+  it "keeps an empty query string out of the request line" do
+    env = { "REQUEST_METHOD" => "GET", "PATH_INFO" => "/health", "QUERY_STRING" => "" }
+
+    app.app.call(env)
+
+    expect(request_line).to include("Request: GET /health \n")
+  end
+
+  it "filters nested params of a JSON body" do
+    body = '{"user":{"name":"bob","password":"s3cret"},"sessions":[{"token":"tok-1","id":1}]}'
+    env = {
+      "REQUEST_METHOD" => "POST", "PATH_INFO" => "/health",
+      "CONTENT_TYPE" => "application/json", "rack.input" => StringIO.new(body)
+    }
+
+    app.app.call(env)
+
+    expect(params_line).to include('"name" => "bob"')
+    expect(params_line).to include('"id" => 1')
+    expect(logger.logs.first).not_to include("s3cret")
+    expect(logger.logs.first).not_to include("tok-1")
+  end
+
+  it "logs the query string untouched without filter params" do
+    log = logger
+    plain_app = Class.new(ReeRoda::App) do
+      plugin(:ree_logger, ree_logger: log)
+
+      route do |r|
+        r.is "health" do
+          "success"
+        end
       end
     end
-    logger = TestFilterLogger.new
 
-    TestFilterApp.plugin(:ree_logger, ree_logger: logger, filter_params: ['password'])
-    TestFilterApp.app.call(env)
+    env = { "REQUEST_METHOD" => "GET", "PATH_INFO" => "/health", "QUERY_STRING" => "password=p" }
 
-    expect(logger.logs.first).to match('"password" => "\[FILTERED\]"')
+    plain_app.app.call(env)
+
+    expect(request_line).to include("/health?password=p")
   end
-end
+end

data/lib/ree_lib/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module ReeLib
-  VERSION = "1.3.15"
+  VERSION = "1.3.16"
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: ree_lib
 version: !ruby/object:Gem::Version
-  version: 1.3.15
+  version: 1.3.16
 platform: ruby
 authors:
 - Ruslan Gatiyatov