element-hq / element-hq/element-web

It is too easy to accidentally log message contents in rageshakes

Open
#26,380 3 comments 0 reactions 0 assignees View on GitHub
A-Developer-Experience O-Occasional S-Major T-Task
Dominant language
TypeScript
Stars
13.5k
Forks
2.8k
PR merge metrics
PR metrics pending

Description

There have been numerous occasions over the years where we accidentally include message contents in rageshakes, most recently https://github.com/vector-im/element-web/issues/26376.

A common failure mode is to write something like:

```
let event = getEventFromSomewhere();
// ...
logger.info("Processing event", e);
```

What happens then is that we call `JSON.stringify` (https://github.com/matrix-org/matrix-react-sdk/blob/v3.82.0/src/rageshake/rageshake.ts#L94) which in turn calls [`MatrixEvent.toJSON`](https://github.com/matrix-org/matrix-js-sdk/blob/v29.0.0/src/models/event.ts#L1606-L1617), which includes the message content.

I assert that we should either:

* change the existing consumers of `MatrixEvent.toJSON` to use some other method, then update `toJSON` to elide message content
* special-case `MatrixEvent` in rageshake.log

Contributor guide

Open the contributing guide

Research direction

Start in src/rageshake/rageshake.ts around the JSON.stringify call, then inspect the referenced MatrixEvent.toJSON implementation in matrix-js-sdk. Trace existing consumers of MatrixEvent.toJSON before choosing an approach. Done means rageshakes no longer include MatrixEvent message contents while existing serialization behavior remains correct.

Written by the indexing model from the issue text.

Assessment

Tech stack
typescript
Domain
observability, security
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
38/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.