element-hq / element-hq/element-web
It is too easy to accidentally log message contents in rageshakes
- Dominant language
- TypeScript
- Stars
- 13.5k
- Forks
- 2.8k
- PR merge metrics
- PR metrics pending
Description
There have been numerous occasions over the years where we accidentally include message contents in rageshakes, most recently https://github.com/vector-im/element-web/issues/26376.
A common failure mode is to write something like:
```
let event = getEventFromSomewhere();
// ...
logger.info("Processing event", e);
```
What happens then is that we call `JSON.stringify` (https://github.com/matrix-org/matrix-react-sdk/blob/v3.82.0/src/rageshake/rageshake.ts#L94) which in turn calls [`MatrixEvent.toJSON`](https://github.com/matrix-org/matrix-js-sdk/blob/v29.0.0/src/models/event.ts#L1606-L1617), which includes the message content.
I assert that we should either:
* change the existing consumers of `MatrixEvent.toJSON` to use some other method, then update `toJSON` to elide message content
* special-case `MatrixEvent` in rageshake.log
Contributor guide
Research direction
Start in src/rageshake/rageshake.ts around the JSON.stringify call, then inspect the referenced MatrixEvent.toJSON implementation in matrix-js-sdk. Trace existing consumers of MatrixEvent.toJSON before choosing an approach. Done means rageshakes no longer include MatrixEvent message contents while existing serialization behavior remains correct.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- typescript
- Domain
- observability, security
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 38/100