Sanitize transport config and include in report (Alt Approach) #152
Conversation
amircybersec
changed the title
|
We should either merge this PR or PR #159, not both. |
amircybersec
changed the title
x/config/config.go
Outdated
| } else { | ||
| return u, nil | ||
| } | ||
| // If no user info is found, return the scheme and redacted placeholder |
There was a problem hiding this comment.
Why? Perhaps just drop the path or search params?
There was a problem hiding this comment.
sanitizeURLGeneric is a bit conservative in terms of not leaking any sensitive info. Right now if no UserInfo is detected, I redact everything.
Perhaps, I should further dissect the URL and keep url.host if it has the ip:port format and keep path, query params and fragments.
There was a problem hiding this comment.
see my other comment here
Co-authored-by: Vinicius Fortuna <[email protected]>
Co-authored-by: Vinicius Fortuna <[email protected]>
Co-authored-by: Vinicius Fortuna <[email protected]>
|
@fortuna Thanks for all the feedback! I applied the last requested changes, resolved merge conflicts and merged with main :) |
This PR scoped changed since opening it. Currently, it proposes a standalone sanitizer method in
config.gothat redacts sensitive user info.