domma-cms 1.6.35 → 1.6.37

package/server/services/request-log.js

@@ -0,0 +1,70 @@
+/**
+ * Request log redaction - credentials never reach the pino request line.
+ *
+ * Several routes carry a live credential in the query string: the mail reader's
+ * `/body?token=` grant, the ecards `/ecards/view?token=` link, the call invite's
+ * `?key=`. Fastify's default `req` serializer logs `req.url` whole, so the log
+ * (and anything shipping it) held usable tokens for as long as it was kept.
+ *
+ * Only the VALUES of the sensitive parameters are replaced; the path, the other
+ * parameters and every other field Fastify logs stay exactly as before, so log
+ * greps keep working.
+ */
+
+/** Parameter names redacted whatever their case. */
+const SENSITIVE = new Set(['token', 't', 'key', 'hostkey', 'invitekey']);
+
+/** Anything with secret or password in the name is redacted too. */
+const SENSITIVE_PATTERN = /secret|password|passwd/i;
+
+export const REDACTED = '[redacted]';
+
+/** Is this query parameter a credential? */
+export function isSensitiveParam(name) {
+    const n = String(name ?? '');
+    return SENSITIVE.has(n.toLowerCase()) || SENSITIVE_PATTERN.test(n);
+}
+
+/**
+ * The URL with credential values replaced by `[redacted]`.
+ *
+ * Works on the raw query text rather than URLSearchParams so a URL that does
+ * not re-encode identically still logs as it was requested: only the value
+ * between `=` and the next `&` (or `#`) is replaced.
+ *
+ * @param {string} url
+ * @returns {string}
+ */
+export function redactUrl(url) {
+    if (typeof url !== 'string') return url;
+    const q = url.indexOf('?');
+    if (q === -1) return url;
+    const hash = url.indexOf('#', q);
+    const query = hash === -1 ? url.slice(q + 1) : url.slice(q + 1, hash);
+    if (!query) return url;
+    const cleaned = query.split('&').map((pair) => {
+        if (!pair) return pair;
+        const eq = pair.indexOf('=');
+        const name = eq === -1 ? pair : pair.slice(0, eq);
+        let decoded = name;
+        try { decoded = decodeURIComponent(name); } catch { /* keep as sent */ }
+        if (!isSensitiveParam(decoded)) return pair;
+        return `${name}=${REDACTED}`;
+    }).join('&');
+    return url.slice(0, q + 1) + cleaned + (hash === -1 ? '' : url.slice(hash));
+}
+
+/**
+ * Fastify's default `req` serializer (fastify/lib/logger-pino.js) with the
+ * url redacted. Field for field the same otherwise.
+ */
+export function requestSerializer(req) {
+    return {
+        method: req.method,
+        url: redactUrl(req.url),
+        version: req.headers && req.headers['accept-version'],
+        host: req.host,
+        remoteAddress: req.ip,
+        remotePort: req.socket ? req.socket.remotePort : undefined,
+    };
+}