Parameter filter logic for Honeybadger is different from Rails

[jasonkim]

For string filters, Honeybadger will use string comparison, whereas Rails will convert it into regexp and compare using regex.

In Honeybadger, see line
https://github.com/honeybadger-io/honeybadger-ruby/blob/master/lib/honeybadger/util/sanitizer.rb#L128

In Rails, see lines 24-44 in https://github.com/rails/rails/blob/master/actionpack/lib/action_dispatch/http/parameter_filter.rb#L24

More specifically, this action dispatch code converts it into regexp

regexps << Regexp.new(strings.join('|'.freeze), true) unless strings.empty?

Let me know if you need more information or if I misunderstood something.

[joshuap]

@jasonkim yep, looks like you're right. It would be ideal if our filters behaved the same way as Rails'; I'll have to think about the implications of making a change.

[joshuap]

One solution to this could be to separate the Rails filters from ours; if Rails filters are available then we would use an instance of ActionDispatch::Http:: ParameterFilter to apply them in addition to performing our own sanitization.

[jasonkim]

Yeah, I guess I don't really understand the implications of converting everything into regex. Whether that'll cause something unexpected, at least for me, is unknown. If that was possible, it's pretty simple to change it in the initializer.
The solution you proposed is a good compromise. Although the default behaviors for hb and rails are different, it also isn't a breaking change to the existing hb applications.

I would, at some point, deprecate string matching and go with regex only as it should be more robust (like any field called [something]_password should never be exposed). You can also emulate string match with regex by matching on first/last chars.
It's just a suggestion. For now, I've added a separate regex in the yml file to filter out the same keys in my hb config.

[joshuap]

Sounds good; agreed on your suggestion to eventually do regexp conversion (I'll think about that some more). I'll plan to move to ActionDispatch::Http:: ParameterFilter for Rails in the next minor release.