Security | Also mask lowercased variant of filter params

src/Models/RequestLog.php

@@ -178,15 +178,9 @@ protected function getFiltered(array $data)
         return $this->replaceParameters($data, RequestLoggerFacade::getFilters());
     }
 
-    protected function replaceParameters(array $array, array $hidden, string $value = '********'): array
+    protected function replaceParameters(array $array, array $hidden, string $value = '*'): array
     {
-        foreach ($hidden as $parameter) {
-            if (Arr::get($array, $parameter)) {
-                Arr::set($array, $parameter, '********');
-            }
-        }
-
-        return $array;
+        return Arr::maskCaseInsensitive($array, $hidden, $value);
     }
 
     protected function truncateToLength(?string $string, int $length = 255): ?string

src/RequestLoggerServiceProvider.php

@@ -8,8 +8,10 @@
 use Illuminate\Foundation\Http\Events\RequestHandled;
 use Illuminate\Http\Request;
 use Illuminate\Routing\Router;
+use Illuminate\Support\Arr;
 use Illuminate\Support\Facades\Event;
 use Illuminate\Support\ServiceProvider;
+use Illuminate\Support\Str;
 
 class RequestLoggerServiceProvider extends ServiceProvider
 {
@@ -73,5 +75,40 @@ private function bootMacros(): void
 
             return $this;
         });
+
+        /**
+         * Mask an array's values by keys, supporting nested keys with case-insensitive matching.
+         * If the provided mask is a single character, it will be repeated to match the original value's length.
+         */
+        Arr::macro('maskCaseInsensitive', function (array $array, array $keys, string $character = '*'): array {
+            $lowerKeys = array_map('mb_strtolower', $keys);
+
+            // Iterate over the flattened array keys
+            foreach (array_keys(Arr::dot($array)) as $dottedKey) {
+                $lowerDottedKey = mb_strtolower($dottedKey);
+                // Try to match the lowercased dotted key or its parent key, so we can also mask nested arrays.
+                $matchedKey = in_array($lowerDottedKey, $lowerKeys, true)
+                    ? $dottedKey
+                    : (in_array(Str::beforeLast($lowerDottedKey, '.'), $lowerKeys, true)
+                        ? Str::beforeLast($dottedKey, '.')
+                        : null);
+
+                if ($matchedKey !== null) {
+                    $value = Arr::get($array, $matchedKey);
+                    $masked = match (true) {
+                        mb_strlen($character) > 1 => $character,
+                        ! filled($value) => $value,
+                        is_string($value) || is_int($value) => Str::mask((string) $value, $character, 0),
+                        default => str_repeat($character, 8), // default mask: '********'
+                    };
+
+                    if ($value !== $masked && Arr::has($array, $matchedKey)) {
+                        Arr::set($array, $matchedKey, $masked);
+                    }
+                }
+            }
+
+            return $array;
+        });
     }
 }