From 39d21498d2e98c2888a27b94b35fe82a32f9c8b6 Mon Sep 17 00:00:00 2001 From: ernolf Date: Sun, 19 Jul 2026 11:22:47 +0200 Subject: [PATCH] fix: redact the key query parameter by default Signed-off-by: ernolf --- README.md | 4 ++-- lib/Http/Client/Middleware/HttpClientLoggerMiddleware.php | 1 + .../Client/Middleware/HttpClientLoggerMiddlewareTest.php | 8 ++++++-- 3 files changed, 9 insertions(+), 4 deletions(-) diff --git a/README.md b/README.md index 2b9faa9..07956fd 100644 --- a/README.md +++ b/README.md @@ -102,7 +102,7 @@ The following headers are always redacted and cannot be un-redacted: `Authorizat Additional query parameter names whose values are logged as `***REMOVED SENSITIVE VALUE***` in the `uri` field. Matching is case-insensitive; the parameter name and the rest of the URI stay unchanged. Default: `[]`. -The following parameters are always redacted and cannot be un-redacted: `access_token`, `api_key`, `apikey`, `auth`, `client_secret`, `password`, `secret`, `signature`, `token`, `X-Amz-Credential`, `X-Amz-Security-Token`, `X-Amz-Signature`. +The following parameters are always redacted and cannot be un-redacted: `access_token`, `api_key`, `apikey`, `auth`, `client_secret`, `key`, `password`, `secret`, `signature`, `token`, `X-Amz-Credential`, `X-Amz-Security-Token`, `X-Amz-Signature`. ```php 'audit_http_client_redact_params' => [ @@ -118,7 +118,7 @@ The following pattern is always applied and cannot be removed: `#(?<=/private-)[ ```php 'audit_http_client_redact_path_patterns' => [ - '#(?<=/)key-[0-9a-f]+#', + '#(?<=/)sess-[0-9a-f]+#', ], ``` diff --git a/lib/Http/Client/Middleware/HttpClientLoggerMiddleware.php b/lib/Http/Client/Middleware/HttpClientLoggerMiddleware.php index 074c6ab..6d11ae8 100644 --- a/lib/Http/Client/Middleware/HttpClientLoggerMiddleware.php +++ b/lib/Http/Client/Middleware/HttpClientLoggerMiddleware.php @@ -46,6 +46,7 @@ final class HttpClientLoggerMiddleware { 'apikey', 'auth', 'client_secret', + 'key', 'password', 'secret', 'signature', diff --git a/tests/unit/Http/Client/Middleware/HttpClientLoggerMiddlewareTest.php b/tests/unit/Http/Client/Middleware/HttpClientLoggerMiddlewareTest.php index ac87113..cef9e4f 100644 --- a/tests/unit/Http/Client/Middleware/HttpClientLoggerMiddlewareTest.php +++ b/tests/unit/Http/Client/Middleware/HttpClientLoggerMiddlewareTest.php @@ -284,6 +284,10 @@ public function testRedactUriRedactsDefaultParamsCaseInsensitively(): void { 'https://api.example.com/v1/data?Access_Token=***REMOVED SENSITIVE VALUE***', $this->invokePrivate($mw, 'redactUri', ['https://api.example.com/v1/data?Access_Token=geheim']), ); + $this->assertSame( + 'https://maps.googleapis.com/maps/api/geocode/json?address=Berlin&key=***REMOVED SENSITIVE VALUE***', + $this->invokePrivate($mw, 'redactUri', ['https://maps.googleapis.com/maps/api/geocode/json?address=Berlin&key=AIzaSyExample']), + ); } public function testRedactUriRedactsConfiguredExtraParams(): void { @@ -313,10 +317,10 @@ public function testRedactUriRedactsPrivatePathSegments(): void { } public function testRedactUriAppliesConfiguredPathPatterns(): void { - $mw = $this->middleware(0, [], [], [], ['#(?<=/)key-[0-9a-f]+#']); + $mw = $this->middleware(0, [], [], [], ['#(?<=/)sess-[0-9a-f]+#']); $this->assertSame( 'https://x.test/feed/***REMOVED SENSITIVE VALUE***/data.xml', - $this->invokePrivate($mw, 'redactUri', ['https://x.test/feed/key-abc123/data.xml']), + $this->invokePrivate($mw, 'redactUri', ['https://x.test/feed/sess-abc123/data.xml']), ); }