Changeset 4200

Timestamp:

04/07/06 22:26:25 (3 years ago)

Author:

david

Message:

Added ActionController.filter_parameter_logging that makes it easy to remove passwords, credit card numbers, and other sensitive information from being logged when a request is handled #1897 [jeremye@bsa.ca.gov]

Files:

• trunk/actionpack/CHANGELOG (modified) (1 diff)
• trunk/actionpack/lib/action_controller/base.rb (modified) (2 diffs)
• trunk/actionpack/test/controller/filter_params_test.rb (added)

trunk/actionpack/CHANGELOG

@@ +1 @@
+*SVN*
+
+* Added ActionController.filter_parameter_logging that makes it easy to remove passwords, credit card numbers, and other sensitive information from being logged when a request is handled #1897 [jeremye@bsa.ca.gov]
+
+
-*1.12.1* (April 6th, 2005)
-

trunk/actionpack/lib/action_controller/base.rb

@@ -367 +367 @@
-        write_inheritable_attribute(:hidden_actions, hidden_actions | names.collect { |n| n.to_s })
-      end
+      
+      # Replace sensitive paramater data from the request log.
+      # Filters paramaters that have any of the arguments as a substring.
+      # Looks in all subhashes of the param hash for keys to filter.
+      # If a block is given, each key and value of the paramater hash and all
+      # subhashes is passed to it, the value or key
+      # can be replaced using String#replace or similar method.
+      #
+      # Examples:
+      #   filter_parameter_logging
+      #   => Does nothing, just slows the logging process down
+      #
+      #   filter_parameter_logging :password
+      #   => replaces the value to all keys matching /password/i with "[FILTERED]"
+      #
+      #   filter_parameter_logging :foo, "bar"
+      #   => replaces the value to all keys matching /foo|bar/i with "[FILTERED]"
+      #
+      #   filter_parameter_logging { |k,v| v.reverse! if k =~ /secret/i }
+      #   => reverses the value to all keys matching /secret/i
+      #
+      #   filter_parameter_logging(:foo, "bar") { |k,v| v.reverse! if k =~ /secret/i }
+      #   => reverses the value to all keys matching /secret/i, and 
+      #      replaces the value to all keys matching /foo|bar/i with "[FILTERED]"
+      def filter_parameter_logging(*filter_words, &block)
+        parameter_filter = Regexp.new(filter_words.collect{ |s| s.to_s }.join('|'), true) if filter_words.length > 0
+
+        define_method(:filter_parameters) do |unfiltered_parameters|
+          filtered_parameters = {}
+
+          unfiltered_parameters.each do |key, value|
+            if key =~ parameter_filter
+              filtered_parameters[key] = '[FILTERED]'
+            elsif value.is_a?(Hash)
+              filtered_parameters[key] = filter_parameters(value) 
+            elsif block_given?
+              key, value = key.dup, value.dup
+              yield key, value
+              filtered_parameters[key] = value
+            else 
+              filtered_parameters[key] = value
+            end
+          end
+
+          filtered_parameters
+        end
+      end
-    end
-
@@ -902 +949 @@
-          logger.info "\n\nProcessing #{controller_class_name}\##{action_name} (for #{request_origin}) [#{request.method.to_s.upcase}]"
-          logger.info "  Session ID: #{@session.session_id}" if @session and @session.respond_to?(:session_id)
-
+respond_to?(:filter_parameters) ? filter_parameters(@params).inspect : 
-        end
-      end