scriptoriumadmin/skillhub
1
0
Fork 0
mirror of https://github.com/iflytek/skillhub.git synced 2026-08-27 11:14:59 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 2

fix(auth): omit account merge request bodies from logs

Browse source 
Signed-off-by: XiaoSeS <87064762+XiaoSeS@users.noreply.github.com>
This commit is contained in:
XiaoSeS 2026-07-31 17:34:06 +08:00
parent c6b18c6be6
commit 51d781908d
2 changed files with 41 additions and 1 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

3
server/skillhub-app/src/main/java/com/iflytek/skillhub/filter/RequestLoggingFilter.java
View file

@ -37,7 +37,8 @@ public class RequestLoggingFilter extends OncePerRequestFilter {
"/sse"
);
private static final Set<String> SENSITIVE_BODY_PREFIXES = Set.of(
"/api/v1/auth/"
"/api/v1/auth/",
"/api/v1/account/merge"
);
private final SensitiveLogSanitizer sensitiveLogSanitizer;

39
server/skillhub-app/src/test/java/com/iflytek/skillhub/filter/RequestLoggingFilterTest.java
View file

@ -16,6 +16,8 @@ import java.util.List;
import java.util.concurrent.atomic.AtomicReference;
import org.junit.jupiter.api.AfterEach;
import org.junit.jupiter.api.Test;
import org.junit.jupiter.params.ParameterizedTest;
import org.junit.jupiter.params.provider.ValueSource;
import org.slf4j.LoggerFactory;
import org.springframework.http.HttpHeaders;
import org.springframework.http.MediaType;
@ -204,6 +206,43 @@ class RequestLoggingFilterTest {
});
}
@ParameterizedTest
@ValueSource(strings = {
"/api/v1/account/merge/reauthenticate/local",
"/api/v1/account/merge/intents/merge-intent/secondary-auth/local",
"/api/v1/account/merge/verify"
})
void doFilterInternal_omitsAccountMergeBody(String requestUri)
throws Exception {
RequestLoggingFilter filter = filter();
attachAppender();
MockHttpServletRequest request =
new MockHttpServletRequest("POST", requestUri);
request.setCharacterEncoding(StandardCharsets.UTF_8.name());
request.setContentType(MediaType.APPLICATION_JSON_VALUE);
request.setContent(
"""
{"username":"secondary-user","password":"body-secret",
"verificationToken":"verification-secret"}
""".getBytes(StandardCharsets.UTF_8));
MockHttpServletResponse response =
new MockHttpServletResponse();
filter.doFilter(
request,
response,
(req, res) -> req.getReader().lines().count());
assertThat(loggedMessages()).anySatisfy(message -> {
assertThat(message)
.contains("POST " + requestUri)
.doesNotContain("secondary-user")
.doesNotContain("body-secret")
.doesNotContain("verification-secret")
.doesNotContain("Body:");
});
}
private RequestLoggingFilter filter() {
return new RequestLoggingFilter(
new SensitiveLogSanitizer());