Skip to content

Commit 6d94c28

Browse files
committed
fix: fix regex for filtering credentials from logs
The ending "=" character of a base64 encoded string is padding. When the input length is a multiple of three (which is the case for our account id and license key), the output would not have the padding character. This results in our credentials not being filtered in the logs. This fixes the regex by removing the incorrect assumption. https://en.wikipedia.org/wiki/Base64#Output_padding
1 parent 69822e9 commit 6d94c28

File tree

2 files changed

+21
-1
lines changed

2 files changed

+21
-1
lines changed

lib/avatax/connection.rb

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -4,7 +4,8 @@ module AvaTax
44

55
module Connection
66
private
7-
AUTHORIZATION_FILTER_REGEX = /(Authorization\:\ \"Basic\ )(\w+)\=/
7+
8+
AUTHORIZATION_FILTER_REGEX = /(Authorization:\ "Basic\ )(\w+)/
89
REMOVED_LABEL = '\1[REMOVED]'
910

1011
def connection

spec/avatax/request_spec.rb

Lines changed: 19 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,5 @@
11
require File.expand_path('../../spec_helper', __FILE__)
2+
require 'logger'
23

34
describe AvaTax::Request do
45

@@ -22,4 +23,22 @@
2223
expect(response.env.request['timeout']).to eq(10)
2324
end
2425
end
26+
27+
describe 'filter credentials from logs' do
28+
let(:string_io) { StringIO.new }
29+
let(:logger) { Logger.new(string_io) }
30+
31+
it 'replaces credentials with a label' do
32+
# Make 'name:pass' string length is a multiple of three so the base64
33+
# encoded string will not have padding '=' characters at the end.
34+
@client.username = 'name'
35+
@client.password = 'pass'
36+
37+
@client.custom_logger = logger
38+
response = @client.request(:get, 'path', 'model')
39+
40+
expect(response.env.request_headers).to include('Authorization' => 'Basic bmFtZTpwYXNz')
41+
expect(string_io.string).to match(/Authorization: "Basic \[REMOVED\]"/)
42+
end
43+
end
2544
end

0 commit comments

Comments
 (0)