Redact sensitive information in redirected URLs #1408
Merged
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Codecov Report
@@ Coverage Diff @@
## main #1408 +/- ##
=======================================
Coverage 73.40% 73.40%
=======================================
Files 115 115
Lines 8758 8747 -11
=======================================
- Hits 6429 6421 -8
+ Misses 1687 1685 -2
+ Partials 642 641 -1
Continue to review full report at Codecov.
|
jonjohnsonjr
requested changes
Jul 18, 2022
This adds internal methods to redact potentially sensitive information from URLs in error messages, especially when those URLs are the result of server-side redirects. We already redact potentially sensitive information like this as part of transport.CheckError, but this isn't called when the error is the result of an http.Client.Do (e.g., tcp dial error). The specific use case where this can happen is a registry like GCR which redirects blob requests to GCS with a sensitive access_token in the query parameter. If the request to GCS fails due to tcp error, the error message will include the sensitive access token. This method of redaction relies on the original error being a *url.Error, and redaction is accomplished by simply updating the error's URL with a redacted equivalent.
imjasonh
force-pushed
the
redact-fetchblob
branch
from
031787b
to
b6a54b6
Compare
jonjohnsonjr
approved these changes
Jul 18, 2022
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
This adds internal methods to redact potentially sensitive information
from URLs in error messages, especially when those URLs are the result
of server-side redirects.
We already redact potentially sensitive information like this as part of
transport.CheckError, but this isn't called when the error is the result
of an http.Client.Do (e.g., tcp dial error).
The specific use case where this can happen is a registry like GCR which
redirects blob requests to GCS with a sensitive access_token in the
query parameter. If the request to GCS fails due to tcp error, the error
message will include the sensitive access token.
This method of redaction relies on the original error being a
*url.Error, and redaction is accomplished by simply updating the error's
URL with a redacted equivalent.