Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Handles passwords containing double quotes #590

Merged
merged 3 commits into from
Sep 23, 2015
Merged

Handles passwords containing double quotes #590

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
71177d3
Sanitize now works on passwords containing double quotes
Zouuup Sep 17, 2015
7bdc9f3
new test added to test for passwords containing double quotes
Zouuup Sep 17, 2015
574cfee
typo fixed
Zouuup Sep 18, 2015
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Jump to
Jump to file
Failed to load files.
Diff view
Diff view
2 changes: 1 addition & 1 deletion cf/trace/trace.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -75,7 +75,7 @@ func newFileLogger(path string) Printer {

func Sanitize(input string) (sanitized string) {
var sanitizeJson = func(propertyName string, json string) string {
regex := regexp.MustCompile(fmt.Sprintf(`"%s":\s*"[^"]*"`, propertyName))
regex := regexp.MustCompile(fmt.Sprintf(`"%s":\s*"[^\,]*"`, propertyName))
return regex.ReplaceAllString(json, fmt.Sprintf(`"%s":"%s"`, propertyName, PRIVATE_DATA_PLACEHOLDER()))
}

Expand Down
20 changes: 19 additions & 1 deletion cf/trace/trace_test.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -125,7 +125,7 @@ grant_type=password&password=[PRIVATE DATA HIDDEN]&scope=&username=mgehard%2Bcli
Expect(Sanitize(request)).To(Equal(expected))
})

It("hides paswords in the JSON-formatted request body", func() {
It("hides passwords in the JSON-formatted request body", func() {
request := `
REQUEST: [2014-03-07T10:53:36-08:00]
PUT /Users/user-guid-goes-here/password HTTP/1.1
Expand All @@ -137,6 +137,24 @@ PUT /Users/user-guid-goes-here/password HTTP/1.1
REQUEST: [2014-03-07T10:53:36-08:00]
PUT /Users/user-guid-goes-here/password HTTP/1.1

{"password":"[PRIVATE DATA HIDDEN]","oldPassword":"[PRIVATE DATA HIDDEN]"}
`

Expect(Sanitize(request)).To(Equal(expected))
})

It("hides password containing \" in the JSON-formatted request body", func() {
request := `
REQUEST: [2014-03-07T10:53:36-08:00]
PUT /Users/user-guid-goes-here/password HTTP/1.1

{"password":"stanleys\"PasswordIsCool","oldPassword":"stanleypassword!"}
`

expected := `
REQUEST: [2014-03-07T10:53:36-08:00]
PUT /Users/user-guid-goes-here/password HTTP/1.1

{"password":"[PRIVATE DATA HIDDEN]","oldPassword":"[PRIVATE DATA HIDDEN]"}
`

Expand Down