Mask secrets

[tomasbjerre]

I configured logging like this:

gitLabApi.withRequestResponseLogging(
        new Logger(MyClass.class.getName(), null) {
          @Override
          public void log(final LogRecord record) {
            myLogger.log(record.getLevel(), record.getMessage());
          }
        },
        Level.FINE);

And in my log I got:

...
1 > PRIVATE-TOKEN: token-in-clear-text
...

It might be a good idea to mask secrets in this lib. I am now masking the token in my user code. But it is very likely that a user does not notice that the secret is there in clear text in the log.

[gmessner]

@tomasbjerre
I am aware of this and would like to mask it, can you share your mechanism for masking?

[tomasbjerre]

I just do a replace like this:

    gitLabApi.withRequestResponseLogging(
        new Logger(GitLabCommentsProvider.class.getName(), null) {
          @Override
          public void log(final LogRecord record) {
            final String masked =
                record
                    .getMessage() //
                    .replace(apiToken, MASK) //
                    .replace(api.findProxyPassword().orElse(""), MASK);
            violationsLogger.log(record.getLevel(), masked);
          }
        },
        Level.FINE);

Here: https://github.com/tomasbjerre/violation-comments-to-gitlab-lib/blob/master/src/main/java/se/bjurr/violations/comments/gitlab/lib/GitLabCommentsProvider.java
And the violationsLogger is an interface: https://github.com/tomasbjerre/violation-comments-lib/blob/master/src/main/java/se/bjurr/violations/comments/lib/ViolationsLogger.java

[tomasbjerre]

I can only find this: https://stackoverflow.com/questions/40171273/how-to-print-server-responses-using-loggingfeature-in-dropwizard-1-0-2

Not pretty, but I guess it should work.

[gmessner]

@tomasbjerre
I finally got around to addressing this issue. What I ended up doing was creating a new filter that is patterned after the one that comes with Jersey but added in functionality to mask headers that contain secrets. See org.gitlab4j.api.utils.MaskingLoggingFilter

This has been released in GitLab4J-API 4.10.4. Please verify and close this issue when you have time.

[tomasbjerre]

Looks great! Thanks!