From 0f46bf5737012bb09b40f8e71c5f6db84125df8f Mon Sep 17 00:00:00 2001 From: Andrew Morgan <1342360+anoadragon453@users.noreply.github.com> Date: Thu, 3 Oct 2019 12:57:26 +0100 Subject: [PATCH] Replace client_secret with in server logs (#6158) Replace `client_secret` query parameter values with `` in the logs. Prevents a scenario where a MITM of server traffic can horde 3pids on their account. --- changelog.d/6158.bugfix | 1 + synapse/http/__init__.py | 6 ++++-- 2 files changed, 5 insertions(+), 2 deletions(-) create mode 100644 changelog.d/6158.bugfix diff --git a/changelog.d/6158.bugfix b/changelog.d/6158.bugfix new file mode 100644 index 000000000..6b48fce05 --- /dev/null +++ b/changelog.d/6158.bugfix @@ -0,0 +1 @@ +Redact `client_secret` in server logs. diff --git a/synapse/http/__init__.py b/synapse/http/__init__.py index 3acf772cd..3880ce0d9 100644 --- a/synapse/http/__init__.py +++ b/synapse/http/__init__.py @@ -42,11 +42,13 @@ def cancelled_to_request_timed_out_error(value, timeout): ACCESS_TOKEN_RE = re.compile(r"(\?.*access(_|%5[Ff])token=)[^&]*(.*)$") +CLIENT_SECRET_RE = re.compile(r"(\?.*client(_|%5[Ff])secret=)[^&]*(.*)$") def redact_uri(uri): - """Strips access tokens from the uri replaces with """ - return ACCESS_TOKEN_RE.sub(r"\1\3", uri) + """Strips sensitive information from the uri replaces with """ + uri = ACCESS_TOKEN_RE.sub(r"\1\3", uri) + return CLIENT_SECRET_RE.sub(r"\1\3", uri) class QuieterFileBodyProducer(FileBodyProducer):