Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[BUG] deserialization error exposes sensitive values in the logs #1943

Open
2 tasks done
dracarys18 opened this issue Aug 16, 2023 · 4 comments
Open
2 tasks done

[BUG] deserialization error exposes sensitive values in the logs #1943

dracarys18 opened this issue Aug 16, 2023 · 4 comments
Labels
C-bug Category: Bug

Comments

@dracarys18
Copy link
Member

dracarys18 commented Aug 16, 2023

Bug Description

When there's a deserialization error from external systems serde exposes even the sensitive values in the logs.

For example a deserialization error from card locker:-

Unable to parse router::core::payment_methods::transformers::GetCardResponse from bytes b\"{\\\"card\\\":{\\\"cardId\\\":\\\"08657065-fa64-abcd\\\",\\\"externalId\\\":\\\"abcdefghijkl\\\",\\\"merchantId\\\":\\\"merchant1\\\",\\\"cardNumber\\\":\\\"121312313131313131\\\",\\\"cardExpYear\\\":\\\"25\\\",\\\"cardExpMonth\\\":\\\"10\\\",\\\"nameOnCard\\\":\\\"name\\\",\\\"cardFingerprint\\\":\\\"2602abcbabcabcabc\\\",\\\"cardGlobalFingerprint\\\":\\\"fafafafafafaf\\\",\\\"nickname\\\":\\\"hyperswitch\\\",\\\"customerId\\\":\\\"Customer123\\\"}}\"\n│\n╰─▶ \u001b[1mnot a valid credit card number at line 1 column 157\u001b[22m\n

Expected Behavior

It should ideally mask the values in the logs like

Unable to parse router::core::payment_methods::transformers::GetCardResponse from bytes b\"{\\\"card\\\":{\\\"cardId\\\":\\\"08657065-fa64-abcd\\\",\\\"externalId\\\":\\\"abcdefghijkl\\\",\\\"merchantId\\\":\\\"merchant1\\\",\\\"cardNumber\\\":\\\"*****3131\\\",\\\"cardExpYear\\\":\\\"**\\\",\\\"cardExpMonth\\\":\\\"**\\\",\\\"nameOnCard\\\":\\\"***\\\",\\\"cardFingerprint\\\":\\\"2602abcbabcabcabc\\\",\\\"cardGlobalFingerprint\\\":\\\"fafafafafafaf\\\",\\\"nickname\\\":\\\"hyperswitch\\\",\\\"customerId\\\":\\\"****\\\"}}\"\n│\n╰─▶ \u001b[1mnot a valid credit card number at line 1 column 157\u001b[22m\n

Actual Behavior

Exposes even the sensitive values in the logs

Steps To Reproduce

Manually insert a wrong value into the database and try to fetch it with application. You will see a parsing error with the values exposed

Context For The Bug

No response

Environment

Are you using hyperswitch hosted version? Yes/No
If yes, please provide the value of the x-request-id response header to help us debug your issue.

If not (or if building/running locally), please provide the following details:

  1. Operating System or Linux distribution: MacOS
  2. Rust version (output of rustc --version): 1.71.1
  3. App version (output of cargo r --features vergen -- --version): NA

Have you spent some time checking if this bug has been raised before?

  • I checked and didn't find a similar issue

Have you read the Contributing Guidelines?

Are you willing to submit a PR?

None

@dracarys18 dracarys18 added C-bug Category: Bug S-awaiting-triage Status: New issues that have not been assessed yet labels Aug 16, 2023
@SanchithHegde SanchithHegde removed the S-awaiting-triage Status: New issues that have not been assessed yet label Aug 20, 2023
@Shounmay
Copy link

I want to work on this Bug. Can it be assigned to me?

@SanchithHegde
Copy link
Member

We'll be keeping this open for contribution since @Shounmay took up #1973.

@jeevaprakashdr
Copy link
Contributor

jeevaprakashdr commented Sep 12, 2023

@SanchithHegde I would like to look at this. please can you assign this to me.

@SanchithHegde
Copy link
Member

Sure, @jeevaprakashdr I've assigned this to you.

@jeevaprakashdr jeevaprakashdr removed their assignment Oct 31, 2023
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
C-bug Category: Bug
Projects
None yet
Development

No branches or pull requests

4 participants