Scrub parameter keys

This commit resolves #53.
aserafin · Sep 25, 2018 · ca4061e · ca4061e
1 parent f4502d6
commit ca4061e
Show file tree

Hide file tree

Showing 2 changed files with 32 additions and 22 deletions.
diff --git a/lib/grape_logging/loggers/filter_parameters.rb b/lib/grape_logging/loggers/filter_parameters.rb
@@ -29,7 +29,13 @@ def safe_parameters(request)
       end
 
       def clean_parameters(parameters)
-        parameter_filter.filter(parameters).reject{ |key, _value| @exceptions.include?(key) }
+        parameter_filter.filter(scrub_keys(parameters)).reject{ |key, _value| @exceptions.include?(key) }
+      end
+
+      def scrub_keys(parameters)
+        parameters.each_with_object({}) do |(k, v), h|
+          h[k.to_s.scrub] = v.is_a?(Hash) ? scrub_keys(v) : v
+        end
       end
     end
   end

diff --git a/spec/lib/grape_logging/loggers/filter_parameters_spec.rb b/spec/lib/grape_logging/loggers/filter_parameters_spec.rb
@@ -11,7 +11,8 @@
       that_one: 'one',
       two: 'two',
       three: 'three',
-      four: 'four'
+      four: 'four',
+      "\xff" => 'invalid utf8',
     })
   end
 
@@ -35,31 +36,34 @@
   shared_examples 'filtering' do
     it 'filters out sensitive parameters' do
       expect(subject.parameters(mock_request, nil)).to eq(params: {
-        this_one: subject.instance_variable_get('@replacement'),
-        that_one: subject.instance_variable_get('@replacement'),
-        two: 'two',
-        three: 'three',
-        four: subject.instance_variable_get('@replacement'),
+        'this_one' => subject.instance_variable_get('@replacement'),
+        'that_one' => subject.instance_variable_get('@replacement'),
+        'two' => 'two',
+        'three' => 'three',
+        'four' => subject.instance_variable_get('@replacement'),
+        "\ufffd" => 'invalid utf8',
       })
     end
 
     it 'deeply filters out sensitive parameters' do
       expect(subject.parameters(mock_request_with_deep_nesting, nil)).to eq(params: {
-        this_one: subject.instance_variable_get('@replacement'),
-        that_one: subject.instance_variable_get('@replacement'),
-        two: 'two',
-        three: 'three',
-        four: subject.instance_variable_get('@replacement'),
-        five: {
-          this_one: subject.instance_variable_get('@replacement'),
-          that_one: subject.instance_variable_get('@replacement'),
-          two: 'two',
-          three: 'three',
-          four: subject.instance_variable_get('@replacement'),
-          six: {
-            seven: 'seven',
-            eight: 'eight',
-            one: subject.instance_variable_get('@replacement'),
+        'this_one' => subject.instance_variable_get('@replacement'),
+        'that_one' => subject.instance_variable_get('@replacement'),
+        'two' => 'two',
+        'three' => 'three',
+        'four' => subject.instance_variable_get('@replacement'),
+        "\ufffd" => 'invalid utf8',
+        'five' => {
+          'this_one' => subject.instance_variable_get('@replacement'),
+          'that_one' => subject.instance_variable_get('@replacement'),
+          'two' => 'two',
+          'three' => 'three',
+          'four' => subject.instance_variable_get('@replacement'),
+          "\ufffd" => 'invalid utf8',
+          'six' => {
+            'seven' => 'seven',
+            'eight' => 'eight',
+            'one' => subject.instance_variable_get('@replacement'),
           },
         },
       })